Design principles of government network security scheme
The following principles should be followed when designing and planning the security scheme of the government network system:
1. Principle of demand, risk and cost balance analysis
For any network, absolute security is difficult to achieve and is not necessarily necessary. It is necessary to conduct practical research on a network (including tasks, performance, structure, reliability, maintainability, etc.), and conduct qualitative and quantitative analysis on the threats faced by the network and the risks that may be undertaken, and then formulate specifications and measures to determine the security strategy of the system.
2. Principle of comprehensiveness and integrity
The viewpoint and method of system engineering shall be used to analyze the network security and specific measures. Security measures mainly include administrative legal means, various management systems (personnel review, workflow, maintenance and guarantee system, etc.) and professional technical measures (access control, encryption technology, authentication technology, attack detection technology, fault tolerance, anti-virus, etc.). A better security measure is often the result of the application of appropriate integration of multiple methods.
The position and influence of each link of computer network, including individuals (use, maintenance, management), equipment (including facilities), software (including application systems), data, etc. in network security can only be effectively and feasible measures if viewed and analyzed from the perspective of the whole system. Different security measures have different costs and effects on different networks. The computer network security should follow the overall security principle, and develop a reasonable network architecture and network security architecture according to the determined security strategy.
3. Principle of consistency
The principle of consistency mainly means that network security issues should coexist with the work cycle (or life cycle) of the entire network, and the security architecture formulated must be consistent with the network security requirements. Safe network system design (including preliminary or detailed design) and implementation plan, network verification, acceptance, operation, etc. shall have safety contents and measures. In fact, it is easier and cheaper to consider network security measures at the beginning of network construction than to consider security measures after network construction.
4. Principle of operability
Safety measures need to be completed by people. If the measures are too complex and require too much people, the safety will be reduced; Secondly, the adoption of measures shall not affect the normal operation of the system.
5. Principle of adaptability and flexibility
Security measures must be able to change with the changes of network performance and security requirements, and be easy to adapt, modify and upgrade.
6. Multiple protection principle
Any security measures are not absolutely safe and may be broken. However, a multiple protection system is established, and each layer of protection complements each other. When one layer of protection is broken, other layers of protection can still protect the security of information.
7. Principle of evaluability
How to pre evaluate a security design and verify its network security needs to be evaluated by the national network information security evaluation and certification authority.
Network security is holistic and dynamic. The integrity of network security refers to the establishment of a security system, which includes the use of corresponding security equipment and corresponding management means. Safety equipment is not a single safety equipment, but a combination of several safety equipment. The dynamic nature of network security means that network security changes with the environment and time. In a certain environment, it is a secure system. When the environment changes (such as changing a machine), the original secure system becomes unsafe; In a period of time, the time of a secure system has changed (for example, today is a secure system, maybe because hackers have found a loophole in a system, it will become unsafe tomorrow), and the original system will become unsafe. Therefore, building a network security system is not a once and for all thing.
According to the characteristics of the security system, we can adopt the principle of "unified planning and step-by-step implementation". Specifically, we can first make a comprehensive security system plan for the network, and then, according to the actual application of our network, first establish a basic security protection system to ensure the basic and proper security. With the increase of the types and complexity of applications in the future, an enhanced security protection system will be established based on the original basic protection system.
For the establishment of the government industry network security system, we suggest that the above principles should be adopted. First, we should make an overall security plan for the entire network, and then, according to the actual situation, we should establish a security protection system based on protection detection response to improve the security of the entire network foundation and ensure the security of the application system.
