面向电信系统的信息安全风险评估研究及应用

发布时间：2018-01-09 08:20

本文关键词：面向电信系统的信息安全风险评估研究及应用　出处：《重庆理工大学》2016年硕士论文　论文类型：学位论文

【摘要】：随着信息安全事件的不断涌现,信息安全已上升到国家安全战略高度,变被动修护为主动防御已成为解决安全问题趋势。信息安全风险评估是识别系统存在的潜在风险、全面了解系统安全状况的有效手段。目前我国对信息安全风险评估研究正处于高速发展阶段,我国颁布了很多信息安全风险评估标准及行业标准,对此也进行了大量研究,但多为标准解读和理论研究,对信息安全风险评估项目实施研究较少,如何在分析评估流程的基础上构建评估实施体系为普通评估者提供有效指导,及如何优化已有的评估方法使评估结果更科学、客观、全面的反映评估目的,将是信息安全防护研究的重点。首先,分析了信息安全风险评估、等级保护、风险管理三者流程和相互关系,深入了解我国信息安全风险评估现状,在此基础上将研究对象界定为:电信系统的运行维护阶段。其次,构建了“电信系统信息安全风险评估实施体系”,通过分析信息安全风险流程并结合项目实践经验,详细制定了相关人员职责、实施流程、输入输出文档等通用活动;并针对电信系统的特点,详细归纳了风险要素识别阶段的工作及需要注意的事项,以提高电信系统信息安全风险评估项目的实施效率和保障项目的实施质量,并对其他风险评估项目的实施具有指导与借鉴作用。再次,通过对常用评估方法的比较分析,选择运用基于熵权法的模糊综合评价的评估方法对整个电信系统安全状况进行评估,有效解决了整体评估中评估指标多、数据量大、结论带有模糊性等问题;选择运用基于G1法和模糊距离相结合的组合评估方法对具体风险值进行求解,有效解决了具体风险求解过程中评估指标少、主观性强、数据量少、精确度低等问题。最后,论文选取一个典型的电信系统进行实例应用,并根据系统实际运行情况,建立系统整体安全评估体系和具体风险值求解体系,利用论文提出的评估方法评估出电信系统整体安全部署现状并有效验证了评估方法的科学性和有效性。
[Abstract]:Along with the information security incidents continue to emerge, the information security has risen to the height of the national security strategy, change from passive to active defense repair has become a trend. To solve the security problem of information security risk assessment is to identify potential risks existing in the system, effective means to fully understand the system security situation. China's current research on information security risk assessment is in high speed the stage of development, China issued a lot of information security risk assessment standards and industry standards, have also done a lot of research, but is the standard interpretation and theoretical research on information security risk assessment project research, how to evaluate the process based on the construction of system for common assessment of the implementation of assessment and provide effective guidance in the analysis. How to optimize the existing evaluation methods and the evaluation results more scientific, objective, comprehensive evaluation reflects the purpose of the protection of information security Key. Firstly, the analysis of information security risk assessment, the level of protection, the three risk management processes and relationships, in-depth understanding of China's information security risk assessment based on the present situation, the research object is defined as: telecommunications system operation and maintenance stage. Secondly, the construction of the telecommunications system of information security risk assessment system, through the implementation of "information security risk analysis process and combined with the project practice, the elaboration of the relevant personnel responsibilities, implementation process, input and output documents and other general activities; and according to the characteristics of telecom system, summarizes the stage risk factors identified work and the need to pay attention, to improve the quality of information security risk assessment project implementation efficiency of telecommunication system and security projects, and has guidance and reference to other project risk assessment. Thirdly, through the method of common assessment than Compared with the analysis, selection using evaluation method of fuzzy comprehensive evaluation based on entropy method on the safety status of the whole telecommunication system to assess the effective solution to the overall evaluation of the evaluation index, the large amount of data, the conclusion with ambiguous problems; the choice and use of combination evaluation method G1 method and fuzzy distance based on the combination of specific risk the value for effective solution in the process of solving the specific risk assessment index, subjective data quantity is less, the problem of low accuracy. Finally, this paper selects a typical telecommunications system application, and according to the actual operation of the system, establish the whole system safety assessment system and the specific risk value calculation system, evaluation method the assessment of the overall security situation and the deployment of telecommunications system can verify the scientific and effective evaluation method.

【学位授予单位】：重庆理工大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP309;F626

【相似文献】