信息网络安全 ›› 2020, Vol. 20 ›› Issue (11): 15-21.doi: 10.3969/j.issn.1671-1122.2020.11.003

• 等级保护 • 上一篇    下一篇

等级保护测评模拟环境设计与实践

郑国刚(), 尹湘培, 王魁, 何坤鹏   

  1. 公安部信息安全等级保护评估中心,北京 100142
  • 收稿日期:2020-08-15 出版日期:2020-11-10 发布日期:2020-12-31
  • 通讯作者: 郑国刚 E-mail:guogangzheng@qq.com
  • 作者简介:郑国刚(1962—),男,湖北,副研究员,硕士,主要研究方向为网络安全|尹湘培(1982—),男,湖南,硕士,主要研究方向为网络安全|王魁(1989—),男,河北,本科,主要研究方向为网络安全|何坤鹏(1990—),男,陕西,硕士,主要研究方向为网络安全

Design and Practice of Simulation Environment for Cyber Security Classified Protection Evaluation

ZHENG Guogang(), YIN Xiangpei, WANG Kui, HE Kunpeng   

  1. MPS Information Security Classified Protection Evaluation Center, Beijing 100142, China
  • Received:2020-08-15 Online:2020-11-10 Published:2020-12-31
  • Contact: ZHENG Guogang E-mail:guogangzheng@qq.com

摘要:

文章详细介绍了一个以办公自动化系统为原型,涵盖等级保护二级、三级区域的模拟环境和等级测评实践活动。模拟环境中设计有办公自动化应用场景和安全防护场景,其中安全防护措施按照2019年颁布的《网络安全等级保护基本要求》进行设计部署,安全策略可以根据实践活动的需要进行配置。通过对模拟环境进行等级测评实操活动,可以了解等级测评现场技术测评的主要工作过程和安全分析方法,比较安全防护措施的效果,验证安全防护策略配置的重要性,同时通过模拟环境可以进一步研究并优化相关安全设计方案,验证安全设备部署、安全策略配置的有效性。

关键词: 等级保护测评, 信息系统模拟环境, 安全测评技术, 等级测评实践

Abstract:

This paper introduces in detail a simulation environment and a practical activity of classified protection evaluation in the area of security level 2 and level 3 with OA system as the prototype.In the simulation environment, there are office automation application scenarios and various security protection scenarios. The security protection measures adopted are designed and deployed according to the "Baseline for Classified Protection of Cybersecurity" issued in 2019. Security policies can be configured according to the needs of practical activities.Through simulation environment for classified evaluation practice activity, the main work process and security analysis method of the technical assessment of the classified evaluation site can be understood, the effect of security protection measures can be compared, and the importance of security protection policy configuration can be verified. At the same time, through the simulation environment, the related security design scheme can be further studied and optimized, and the effectiveness of security equipment deployment and security policy configuration can be verified.

Key words: classified protection evaluation, information system simulation environment, security evaluation technology, classified evaluation practice

中图分类号: