通用漏洞评价体系在等级保护测评中的应用研究  

Research on the Application of Common Vulnerability Scoring System in Classified Protection Evaluation

作　　者：张德馨[1] 周永战[2] 唐刚[1] Dexin Zhang;Yongzhan Zhou;Gang Tang(China Software Testing Center,Beijing,100089,China;Beijing Public Security Bureau,Beijing,100073,China)

机构地区：[1]中国软件评测中心,北京100089 [2]北京市公安局网安总队,北京100073

出　　处：《电子科学技术》2017年第2期20-23,共4页Electronic Science & Technology

摘　　要：在等级保护测评活动中,漏洞评价通常基于测评者经验判断,没有统一标准。针对此种情况,本文提出根据国际通用漏洞评价体系(CVSS)对等保测评活动中漏洞等级评价,解决了基于漏洞本身和漏洞所处环境对信息系统危害的一致性评价问题,将有利于等保测评对信息系统安全保障的促进作用。In activities of classified protection evaluation,vulnerability assessment is usually based on theevaluator’s experience because of no uniform standard.In view of this situation,a vulnerability evaluationmethod was put forwards based on the international common vulnerability scoring system(CVSS).The newmethod solves the problem of consistency evaluation for the information system based on vulnerability itselfand the situation of vulnerability,which will be beneficial to theclassified protection evaluation.

关 键 词：等级测评 漏洞 漏洞评价 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]