信息安全保障评价指标体系的研究.PDFVIP

37 7 Vol.37 No. 7 2010 7 Computer Science July 2010 1 2 ( 中国民航大学电子信息工程学院 天津300300) 1 ( 北京邮电大学网络与交换技术国家重点实验室信息 全中心 北京100876)2 信息安全保障与信息系统本身 一样是一个复杂的系统为了能够很好反映信息安全保障系统的功效, 需要 用 量化的参数作为衡量指标从中国信息安全保障的国家战略管理策略工程规范和技术措施方面出发,提出了 以 安全基线政策 (Security Baseline Policy) 为核心的信息安全评价指标体系( Indicator) ;研究了具有双重反馈的评 价思想和流程利用信息安全保障评价指标体系有助于建立信息系统安全保障的长效机制, 增强信息系统的安全性 评价指标体系,信息安全保障, 安全基线政策, 评价 TP309 Research of Indicator for Information Assurance Evaluation 1 2 WU Zhi jun Y NG Yixian ( School of Electronics Information Engineering, Civil viation University of China, Tianjin 300300, China) 1 ( Information Security Center, State Key Laboratory of Networking and Switching T echnology, Beijing U niversity of Posts and Telecommunications, Beijing 100876, China) 2 Abstract Both information system and information assurance are complex systems. To demonstrate the efficiency of in formation assurance better, it needs the quantitative parameters which are used as the indicators for the purpose of secu rity evaluation.This paper presented the indicators for information assurance based on the core of security baseline poli cy,which is extracted from the juristic documents of national stratagem, management policy, engineering criterion, and technique measurements. The evaluate methods and procedures with double feedbacks were given in this paper. The in dicators will help to improve the efficient and persistent of information assurance, and make the information system more secure. Keywords Indicator, Information assurance,Security baseline p