基于SCAP框架的信息系统安全基线技术研究与应用  

Research and Application of Information Security Baseline Technology Based on SCAP Framework

作　　者：罗朝宇 王福新[2] 李宗涛[2] 

机构地区：[1]内蒙古电力(集团)有限责任公司,内蒙古呼和浩特010020 [2]内蒙古电力信息通信中心,内蒙古呼和浩特010020

出　　处：《电力信息与通信技术》2014年第7期97-100,共4页Electric Power Information and Communication Technology

摘　　要：为使内蒙古电力公司信息系统达到预定的安全防护水平,在借鉴参考国际上主流的安全检查策略即SCAP框架基础上,结合企业信息安全实际情况,对适用于国内的强制性系统安全差距与策略标准进行探讨,建成了自动化的信息安全基线检查系统,实现了对信息设备安全配置的自动检查,并根据检查结果给出安全状况评估值,改进了企业信息安全检查的工作方式,提高了信息安全检查结果的准确性,完成了自动检测技术、信息智能重整技术和安全评估方法等关键技术的研究和应用,从而提升了企业的信息安全水平。To achieve the predetermined security level of information system in Inner Mongolia Power Company, this paper builds an automatic information security baseline inspection system in reference to safety inspection strategies of international mainstream based on the SCAP framework, with the actual situation of the enterprise information security and the study of domestic mandatory system security gap and the strategy of information security standards, which realizes the automatic inspection of the security confi guration of information equipment, and according to the inspection results, security assessment value are proposed to improve the enterprise information security work and the accuracy of the information safety inspection results. Due to the application of the automatic inspection technology, intelligent information reforming technology and safety assessment methods, the information security is enhanced.

关 键 词：SCAP框架 信息安全 安全基线 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]