信息保护系统脆弱性评价方式研究

保证可信度的评价标准得到了统一,但各国的评价方法等客观性的保证方面上的一些部分还是有点模糊。换言之,脆弱性评价有范围,深度,实验用道具,提纲和评价者因素,而随着这些因素的不同其评价结果也会出现差异,这样一来,评价的公正性和客观性的保证上就存在困难。本论文提出了能保证信息保护产品保安脆弱性评价的公正性客观性和效率性的信息保护产品保安脆弱性评价方法,体现了自动化完成评价系统的设计。

Study on Vulnerability Evaluation Methodology for Information Security System

Although an evaluation criterion for reliable guarantee is unified, the difference in evaluation mechanism is already ambiguity in every country. In other words, the aspect of objectivity would be a little because it is true that the vulnerability evaluation include evaluator, scenario and target of evaluation (TOE) security vulnerability evaluation system applying in test, depth and scope of evaluation. Bu evaluation results can be difference in accordance with each evaluation elements. We propose the system to evaluate network security vulnerability. First, we expected the evaluation results are impartiality objectivity, repeatability, reproducibility, appropriateness and soundness of results. Second, it could be transferred manual ways into automation ways, and then expected easiness and safety of extension and modification in a quality of products as well as reduction of waste of time and energy.