美国网络安全漏洞披露管理情况研究  

Research on Disclosure Management of Cyber Security Vulnerability in the U.S.

作　　者：刘力平 尹晗 张玲[2] 罗仙 LIU Liping;YIN Han;ZHANG Ling;LUO Xian(No.30 Institute of CETC,Beijing 100043,China;No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,北京100043 [2]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2024年第6期30-38,共9页Information Security and Communications Privacy

摘　　要：网络安全漏洞披露是有效缓解攻防不平衡态势和降低网络安全风险的重要手段,美国在网络安全漏洞披露管理方面拥有一套行之有效的机制。为此,聚焦美国联邦政府互联网信息系统和国防部信息网络,分析其网络安全漏洞披露管理情况。首先,概述美国网络安全漏洞管理战略法规,了解其网络安全漏洞披露管理的战略布局和体系计划;其次,梳理国防部信息网络的漏洞管理依据和漏洞管理流程,分析以漏洞披露计划为代表的主要漏洞管理举措;最后,多角度分析联邦互联网系统漏洞披露的相关实践。以点带面透视美国网络安全漏洞披露管理的体系化和多元化情况,对完善我国漏洞管理机制具有一定借鉴意义。Cyber security vulnerability disclosure is an important means to effectively alleviate the offensive and defensive imbalance and reduce cyber security risks,and the United States has a set of effective management mechanisms in this regard.To this end,this paper focuses on U.S.federal government Internet information systems and Department of Defense information networks to analyze their cyber security vulnerability disclosure management.First,it outlines the U.S.cybersecurity vulnerability management strategy and regulations to understand its strategic layout and system plan for cyber security vulnerability disclosure management.Then,it reviews the vulnerability management rationale as well as the vulnerability management process of DoD’s information networks,and analyzes the major vulnerability management initiatives represented by the vulnerability disclosure program.Finally,it analyzes practices related to vulnerability disclosure in federal Internet systems from multiple perspectives.The systematic and diversified situation of cyber security vulnerability disclosure management in the U.S.is a reference for improving China’s vulnerability management mechanism.

关 键 词：网络安全 漏洞披露 漏洞披露管理 国防部信息网络 联邦互联网系统 

分 类 号：G353.12[文化科学—情报学] TP309[自动化与计算机技术—计算机系统结构]