漏洞分类分级标准在国家信息安全漏洞库的应用  

Application of Vulnerabilities Category and Classification Standard in China National Vulnerability Database of Information Security

作　　者：孙成昊 杨一未 易锦[1] 方硕[1] 曲泷玉 

机构地区：[1]中国信息安全测评中心

出　　处：《信息技术与标准化》2022年第5期82-86,共5页Information Technology & Standardization

摘　　要：为提升国家信息安全漏洞库(CNNVD)服务水平,通过制定内部制度规范、开发支撑工具、实施内控机制、加强宣传推广等方式,应用GB/T 30279—2020《信息安全技术网络安全漏洞分类分级指南》提升漏洞分类分级的科学性与规范性。该应用在漏洞信息分析与发布业务中取得良好成效,同时对我国信息安全产业起到示范引领作用。In order to improve the service level of China National Information Security Vulnerability Database(CNNVD),by formulating internal rules and regulations,developing automatic tools,implementing Internal Control mechanism,strengthening publicity and promotion,the GB/T 30279-2020"Information security technology-Guidelines for the category and classification of cybersecurity vulnerability"has been applied to improve the scientificity and standardization of vulnerability category and classification.This application has achieved good results in vulnerability information analysis and release business,and played a demonstration and leading role in China’s information security industry.

关 键 词：网络安全 漏洞 分类 分级 CNNVD 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]