基于威胁情报的DNS助力医院网络安全建设实践  

Practice of Using Threat Intelligence-Enabled DNS to Enhance Hospital Network Security

作　　者：余莎莎[1] 肖辉[1] 郑清 赵幽 YU Shasha;XIAO Hui;ZHENG Qing;ZHAO You(Zhongnan Hospital of Wuhan University,Wuhan 430071,Hubei,China)

机构地区：[1]武汉大学中南医院,湖北省武汉市430071

出　　处：《中国卫生信息管理杂志》2024年第6期909-914,共6页Chinese Journal of Health Informatics and Management

基　　金：湖北科技厅重点研发计划“磁光电融合的海量数据智能存储与管理系统关键技术研究”(2022BAA042)。

摘　　要：目的利用威胁情报和域名解析系统(DNS)加强医院网络安全。方法在医院互联网出口配置基于威胁情报的安全DNS策略,让医院终端及互联网信息系统通过安全DNS访问互联网。结果应用安全DNS后,医院对外的恶意域名访问被100%拦截,能有效拦截和阻断高级持续性威胁。结论通过应用基于威胁情报的安全DNS,提升了医院对网络安全漏洞的定位能力,缩短了响应时间,降低了处置成本,这对于做好医院网络安全加固和提升医院安全整体水平具有借鉴意义。Objective To enhance hospital network security using threat intelligence and DNS.Methods Configure a threat intelligence-enabled secure DNS strategy at the hospital's internet exit,allowing hospital terminals and internet information systems to access the internet through the secure DNS.Results After implementing the secure DNS,the hospital has achieved a 100%interception rate for outbound malicious domain access.It can effectively intercept and block advanced persistent threats.Conclusion By utilizing a secure DNS based on threat intelligence,the hospital has strengthened its ability to locate security threats,shortened the time and cost of threat response.It is of reference significance for strengthening hospital network security and improving the overall level of hospital security.

关 键 词：威胁情报 DNS 网络安全 

分 类 号：R-039[医药卫生] R319