面向等级保护的软件安全需求分析方法研究被引量：1

Research on Software Security Requirement Analysis Based on Information Classified Security Protection

下载PDF

导出

摘要文章分析了在等级保护过程中进行威胁建模的必要性，结合《实施指南》提出一种基于威胁建模的软件安全需求分析方法，通过威胁一攻击图（TAG）评估攻击，根据评估结果及《基本要求》确定应对方案，将等级保护思想融入到软件安全设计阶段中，使得应对方案能更高效地改进软件设计以增强软件安全性，并通过实际案例对本方法进行了验证。 In this paper, the necessity of threat modeling during the process of information system classified security protection is analysed. Combined with the ＂Implementation Guide＂, a method of software security requirements analysis, which evaluated the risk by generating threat-attack graph and figures out the responses based on the assessment and the ＂basic requirements ＂, is proposed. By applying this method, the idea of information classified security protection is introduced into the software design phase, which facilitates the development of software security. A case is given to test the validity of the method.

作者江雷朱建平

机构地区公安部信息安全等级保护评估中心

出处《信息网络安全》 2011年第9期101-103,共3页 Netinfo Security

关键词等级保护软件安全威胁建模 information classified security protection software security threat modeling

分类号 TP393.08 [自动化与计算机技术—计算机应用技术]

引文网络
相关文献

参考文献7

1GB/T22239-2008.信息系统安全等级保护基本要求[S].2008.
2公安部.GB/T25058-2010信息系统安全等级保护实施指南[S].
3GB/T 20984-2007,信息安全风险评估规范[S].
4何可,李晓红,冯志勇.面向对象的威胁建模方法[J].计算机工程,2011,37(4):21-23. 被引量：9
5Chess B, McGraw G. Static Analysis for Security[J]. IEEE Security & Privacy, 2004, 2(4): 32-36.
6Mitchell J C. Programming language methods in computer security[M].UK, 2001.
7张继业,谢小权.基于攻击图的渗透测试模型的设计[J].计算机工程与设计,2005,26(6):1516-1518. 被引量：12

二级参考文献11

1陈火旺,王戟,董威.高可信软件工程技术[J].电子学报,2003,31(z1):1933-1938. 被引量：115
2Michael H, David L. Writing Secure Code[M]. Redmond, Washington, USA: Microsoft Press, 2003.
3Dewri R, Poolsappasit N, Ray I, et al. Optimal Security Hardening Using Multi-objective Optimization on Attack Tree Models of Networks[C]//Proc. of CCS'07. Alexandria, Virginia, USA:[s. n.], 2007.
4Gran B A, Fredriksen R, Thunem A P J. Addressing Dependability by Applying an Approach for Model-based Risk Assessment[J]. Reliability Engineering & System Safety, 2007, 92(11):1492-1502.
5Li Xiaohong, He Ke. A Unified Threat Model for Assessing Threat in Web Applications[C]//Proc. of the 2nd International Conference on Information Security and Assurance. Busan, Korea: [s. n.], 2008.
6Swiler L P, Philips C, Gaylor T. A graph-based newtwork-vulnerability analysis system[R]. Livermore, California, USA: Sandia National Laboratories, 1998.
7Sheyner O, Haines J, Jha S, et al. Automated generation and analysis of attack graphs[C]. IEEE Symposium on Security and Privacy,2002.
8Kurtz G, Prosise C. Penetration testing exposed[J]. Information Security, 2000, (9).
9Herzog P. Open-source security testing methodology manual[EB/OL]. Http://isecom.securentled.com/osstmm.es.2.1.pdf.
10Wack J, Tracy M, Souppaya M. Computer security[R]. Washington, USA: National Institute of Standards and Technology, 2003.