基于关键信息基础设施安全保护要求的风险管控研究  

Risk management and control based on security protection requirements for critical information infrastructure

作　　者：崔日云 付晓丹 CUI Riyun;FU Xiaodan(Institute of Computing Technologies,China Academy of Railways Sciences Corporation Limited,Beijing 100081,China)

机构地区：[1]中国铁道科学研究院集团有限公司电子计算技术研究所,北京100081

出　　处：《铁路计算机应用》2023年第11期11-14,共4页Railway Computer Application

基　　金：中国国家铁路集团有限公司科技研究开发计划系统性重大课题(P2022S007)。

摘　　要：为提升铁路关键信息基础设施综合防护水平,文章设计基于关键信息基础设施安全保护要求的风险管控流程,从风险识别与分析、技术安全保护、管理安全保护、预警处置等角度,提出关键信息基础设施的信息安全风险管控方法,并给出风险报告示例。研究结果可为铁路有关单位开展安全保护工作提供参考,为进一步完善我国关键信息基础设施安全防护工作提供支撑。In order to improve the comprehensive protection level of railway critical information infrastructure,this paper designed a risk management and control process based on the security protection requirements of critical information infrastructure,proposed information security risk management and control methods for critical information infrastructure from the perspectives of risk identification and analysis,technical security protection,management security protection,early warning and disposal,and provides risk report examples.The research results can provide reference for railway related units to carry out security protection work,and provide support for further improving the security protection work of key information infrastructure in China.

关 键 词：关键信息基础设施 技术安全 管理安全 预警处置 风险报告 

分 类 号：U29[交通运输工程—交通运输规划与管理] TP39[交通运输工程—道路与铁道工程]