网站安全测评服务的安全评估研究

发布时间：2018-04-29 10:04

本文选题：网站安全 + 安全测评　；参考：《北京邮电大学》2017年硕士论文

【摘要】：网站安全测评是一种新兴的第三方服务,可以提供信息安全评估,帮助企业及时发现网站存在的安全漏洞和威胁,提供隐私和数据保护等。然而,有些网站安全测评服务留有“后门”,嵌入了非测评的商业服务,泄露了用户信息,引入了新的安全问题。针对网站安全测评服务本身存在的安全问题,本文开展的研究工作如下:(1)研究了主流的网站安全测评服务,并具体分析其测评内容、方法和过程等。(2)提出了网站安全测评服务中可能存在的信息安全问题,重点针对服务对象安全(网站安全)、测评工具安全、服务过程安全、服务人员安全四方面总结其信息安全问题,并根据这些信息安全问题列出了网站安全测评服务应满足的安全要求和原则。(3)设计了一种面向网站安全测评服务的信息安全度量模型。该模型中,本文针对网站安全测评服务可能存在的安全问题,提出了面向网站安全测评服务的安全度量指标体系,该体系包含70个左右的安全度量指标,具有全面性和具体性。该模型采用对偶加权法来确定各度量指标的权重,最终使用模糊综合评估法结合专家可信度加权法来对网站安全测评服务进行安全评估。该模型将定性的安全评价转为定量评分,有效地降低了专家的主观性及其评价的不确定性。(4)设计并实现了面向网站安全测评服务的专家安全评估软件。该软件将专家的安全评价使用上述模型来对网站安全测评服务进行综合安全评估,现已被采用。本文采用不同数目的度量指标进行安全评估仿真实验,仿真结果表明,该安全度量指标体系具有全面性,可以在不同的环境下较好地覆盖关键指标。然后,本文采用该安全评估软件对32家网站安全测评服务进行安全评估,实验结果显示,仍有25%的测评服务处于安全隐患较高的状态,对测评服务进行安全评估是迫切和必要的。本文的研究不仅可以使用户、网站和政府意识到对网站安全测评服务进行安全评估的重要性,而且对政府评估认证这些第三方服务的信息安全有一定的指导意义。
[Abstract]:Website security evaluation is a new kind of third party service, which can provide information security evaluation, help enterprises to discover the security vulnerabilities and threats, provide privacy and data protection and so on. However, some website security evaluation services have "backdoor", embedded non-evaluation business services, leaked user information, and introduced new security issues. In view of the security problems existing in the website security evaluation service itself, the research work in this paper is as follows: 1) the mainstream website security assessment service is studied, and its evaluation content is analyzed concretely. Methods and procedures, etc.) this paper puts forward the possible information security problems in the website security assessment service, focusing on the security of the service object (website security, evaluation tool security, service process security). Four aspects of the security of service personnel summarized their information security issues, According to these information security problems, this paper lists the security requirements and principles that should be met by the website security assessment service, and designs a kind of information security measurement model for the website security evaluation service. In this model, aiming at the possible security problems of website security evaluation service, this paper puts forward a security measurement index system for website security evaluation service. The system includes about 70 security metrics, which is comprehensive and concrete. The model uses dual weighting method to determine the weights of each metric, and finally uses the fuzzy comprehensive evaluation method combined with the expert credibility weighting method to evaluate the security of the website security evaluation service. The model converts the qualitative security evaluation into the quantitative evaluation, effectively reduces the subjectivity of the experts and the uncertainty of the evaluation. It designs and implements the expert security assessment software for the website security evaluation service. The software uses the above model to evaluate the security of the web site. The simulation results show that the security metric system is comprehensive and can cover the key indexes in different environments. Then, this paper uses the security assessment software to evaluate the security of 32 websites. The experimental results show that 25% of the evaluation services are still in the state of high security hidden danger. It is urgent and necessary to evaluate the safety of the evaluation service. The research in this paper can not only make users, websites and governments realize the importance of security assessment of website security assessment services, but also have certain guiding significance for government evaluation and certification of information security of these third-party services.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.092

【相似文献】