基于安全生命周期的网络安全审查架构  

Network Security Review Architecture Based on Security Lifecycle

作　　者：蒋诚智[1,2] 马潇潇[1,2] 朱立新[1,2] 王珩[1,2] 

机构地区：[1]信息系统工程重点实验室,南京210007 [2]软件新技术与产业化协同创新中心,南京210007

出　　处：《指挥信息系统与技术》2016年第3期8-14,共7页Command Information System and Technology

基　　金：中国电子科技集团公司技术创新基金资助项目

摘　　要：网络安全审查制度已列入新的国家安全法和网络安全法草案,确定有效开展网络安全审查工作的流程成为国家网信部门的主要任务之一。首先,分析了美国网络安全审查相关措施,并在美国联邦信息系统风险管理思想基础上,提出了基于安全生命周期的网络安全审查架构;然后,阐述了架构中每个环节的主要任务及技术,分析了审查关键技术。该架构可为我国网络安全审查工作提供完整的流程和技术途径参考。The network security review policy has been included in the National Security Law and the Network Security Law（Draft）.It is confirmed that effectively carrying out the national security review becomes one of the primary tasks of national network and information security department.Firstly,the network security review measurements of the United States are analyzed.Based on the risk management idea of American federal information system,a network security review architecture based on security lifecycle is proposed.Then,the primary missions and technologies of each step in the architecture are described.The key technologies of the review are analyzed.The architecture can provide an integral procedure and a technology roadmap reference for the review job of the national network security.

关 键 词：网络安全审查 安全生命周期 信息安全 风险管理 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]