Automatic testing and evaluation method for database security in classified protection testing and evaluation and system thereof

Abstract

The invention discloses an automatic testing and evaluation method for database security in classified protection testing and evaluation. The method comprises the steps of establishing testing and evaluation script library which can check various security configuration check points of each database, identifying types of the databases to be tested through a testing and evaluation script execution module, selecting an appropriate testing and evaluation script from the testing and evaluation script library, executing the testing and evaluation script, analyzing testing and evaluation script evaluation return results through a script return data analysis module to form a testing and evaluation result, storing the result into a database, and automatically generating a testing and evaluation report of the security database through a testing and evaluation report generation module. The invention also discloses an automatic testing and evaluation system of the database security in classified protection testing and evaluation, which comprises a testing and evaluation script library module, the testing and evaluation script evaluation module, the script return data analysis module and the testing and evaluation report generation module which are connected in sequence. The method and the system can perform automatic testing and evaluation on database security, so as to obtain a classified protection testing and evaluation result.

Description

technical field [0001] The present invention relates to information system security level protection evaluation (referred to as equal protection evaluation) technology, more specifically, to an automatic evaluation method for database security in equal protection evaluation. An automated evaluation system for database security. Background technique [0002] Information security involves national interests, security and sovereignty. In 2007, the Ministry of Public Security of the People's Republic of China, the State Secrets Bureau, the State Cryptography Administration, and the State Council Informatization Office jointly issued the "Notice on Carrying out the Classification of National Important Information System Security Level Protection", requiring all industries, provinces and cities to Organized and carried out the grading work for the security level protection of important information systems. According to the "Information Security Level Protection Management Measur...

AI Technical Summary

Problems solved by technology

[0004] 1) The inspection method is too simple, resulting in incomplete evaluation results;

[0005] 2) It takes too long and the evaluation efficiency is low;

[0006] 3) Man-made evaluation errors are likely to bring the risk of evaluation errors;

[0007] 4) When checking and evaluating the security configuration checkpoints of different database hosts, it is not standardized enough due to human factors

Images