移动互联网信息系统的等级保护测评研究  

Research on Classified Protection Evaluation Based on Mobile Internet Information System

作　　者：胡亚兰[1] 张艳[1] 

机构地区：[1]公安部第三研究所,上海200031

出　　处：《网络空间安全》2017年第10期73-76,共4页Cyberspace Security

基　　金：移动智能终端安全关键技术研究及应用示范上海市科学技术委员会2015年度"科技创新行动计划"高新技术领域项目(项目编号:15511103000)

摘　　要：移动互联网信息系统将管理终端以及业务终端延伸至移动智能终端上,移动智能终端的加入给的传统信息系统带来了新的威胁。而目前的等级保护测评工作并未将移动智能终端带来的安全问题列入测评范围,测评机构还是按照常规的等级保护测评方法,如主机安全仅限于PC操作系统的配置安全和数据库的配置安全,网络安全也仅限于使用PC访问业务系统过程中的数据传输安全和访问控制等。论文根据移动互联网信息系统的威胁特点,从网络安全、终端安全、应用安全、数据安全、安全管理等环节对移动业务信息系统的测评指标进行了分析,并给出了新增的测评指标及测评方法。Due to the management and business terminal extend to the mobile business information system, it makes a new path of the security threat sources of the information system. That is the security of the mobile terminal itself and the security of the mobile terminal when accessing to the business system. The traditional classified protection evaluation work by the evaluation institutions is according to the general classified protection evaluation method. Such as the evaluation of hosts security only is limited to configuration security and database of configuration security of the PC operating system, network security is limited to data transmission security and access control when accessing to the business system by PC. Based on the threat characteristics of mobile Internet information system, this paper analyzes the evaluation index of mobile service information system from the aspects of network security, terminal security, application security, data security and safety management, and gives the new evaluation index and evaluation method.

关 键 词：移动互联网信息系统 移动智能终端 等级保护测评 信息安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]