Automatic evaluation method for operation system security in classified protection evaluation and system thereof

Abstract

The invention discloses an automatic evaluation method for operation system security in classified protection evaluation. The method comprises the following steps of establishing an evaluation script library capable of checking each security configuration checkpoint of various operation systems; identifying the type of an operated system through an evaluation script executing module, selecting an appropriate evaluation script from the evaluation script library, and executing the evaluation script; analyzing a result executed and returned by the evaluation script through a scrip return data analysis module and forming an evaluation result, and storing the result into a data base; and automatically generating an evaluation report of the operation system security through an evaluation report generation module. The invention further discloses an automatic evaluation system for the operation system security in the classified protection evaluation. The system comprises an evaluation scrip library module, an evaluation scrip executing module, a script return data analysis module and an evaluation report generation module which are sequentially connected. The automatic evaluation method for operation system security in the classified protection evaluation and the system of the automatic evaluation method achieve automatic evaluation on the operation system security and obtain the classified protection evaluation results.

Description

technical field [0001] The present invention relates to information system security level protection evaluation (referred to as equal protection evaluation) technology, more specifically, to an automatic evaluation method for operating system security in equal protection evaluation, and the present invention also relates to the use of this method for equal protection evaluation An automated evaluation system for operating system security in China. Background technique [0002] Information security involves national interests, security and sovereignty. In 2007, the Ministry of Public Security of the People's Republic of China, the State Secrets Bureau, the State Cryptography Administration, and the State Council Informatization Office jointly issued the "Notice on Carrying out the Classification of National Important Information System Security Level Protection", requiring all industries, provinces and cities to Organized and carried out the grading work for the security lev...

AI Technical Summary

Problems solved by technology

[0004] 1) The inspection method is too simple, resulting in incomplete evaluation results;

[0005] 2) It takes too long and the evaluation efficiency is low;

[0006] 3) Man-made evaluation errors are likely to bring the risk of evaluation errors;

[0007] 4) When checking and evaluating the security configuration checkpoints of different types of operating systems, it is not standardized enough due to human factors

Images