«上一篇/Previous Article|本期目录/Table of Contents|下一篇/Next Article»

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

28

期数:

2018年04期

页码:

141-143

栏目:

安全与防范

出版日期:

2018-04-10

文章信息/Info

Title:

Research on Network Security Assessment Method Based on CIA

文章编号:

1673-629X(2018)04-0141-03

作者:

刘意先; 慕德俊

西北工业大学 自动化学院,陕西 西安 710072

Author(s):

LIU Yi-xian; MU De-jun

School of Automation,Northwestern Polytechnical University,Xi，an 710072,China

关键词:

网络安全; 安全评估; 漏洞; 资产

Keywords:

network security; security assessment; vulnerability; asset

分类号:

TP309

DOI:

network security；security assessment；vulnerabilit

文献标志码:

A

摘要:

随着网络技术的发展,安全事件不断出现,如何实现整体的安全保护是一项重要的研究问题。 安全评估作为一种有效的信息系统的保护手段,与传统的安全保护方法相比,能为信息系统提供全面的安全技术支持。 通过分析系统中的资产漏洞对机密性、完整性以及可用性(CIA)的影响程度,采用 CVSS 方式进行相应的评分,结合指标的权重实现了对网络信息系统的评估。 实验构建了简单的网络信息系统,使用扫描器对系统中的设备进行扫描发现资产的漏洞信息,从NVD 漏洞库中获得基本的评分数据,完成了资产风险值的计算,并将相应的风险值进行了转换,实现了定性的评估结果。实验结果验证了该方法的可行性和有效性。

Abstract:

With the development of network technology,security events continually emerge,so how to achieve the overall security protection is an important issue. As an effective protection method to information system,the security assessment can provide the comprehensive support of security technology for information system compared with traditional security protection methods. By analyzing the impacts on the system，s asset vulnerability to its confidentiality,integrity and availability,the scores are assigned by CVSS (common vulnerability scoring system),and then the assessment of network information system is achieved with the weight of the attributes. A simple network information system is constructed in the experiment and the scanner is used in the system equipment to find the vulnerability information of assets. The basic score data is obtained from the NVD for the calculation of risk assets value which is transformed for qualitative assessment. The experiment verifies the feasibility and the effectiveness of the proposed method.

常用功能

更新日期/Last Update: 2018-06-08