GB/T 31495.1-2015Information security technology - Indicator system of information security assurance and evaluation methods - Part 1: Concepts and model (English PDF)

Foreword

GB/T 31495 "Information Security Information Security System Evaluation Index" is divided into the following three parts.

--- Part 1. Concepts and models;

--- Part 2. Index System;

--- Part 3. Implementation Guide. This section GB/T Part of 131,495. This section drafted in accordance with GB/T 1.1-2009 given rules. Please note that some of the content of this document may involve patents. Release mechanism of the present document does not assume responsibility for the identification of these patents. This part of the National Security Standardization Technical Committee (SAC/TC260) and focal points. This section is drafted. State Information Center, the State Press and Publication Administration of Radio Supervision Center, China Information Security Evaluation Center, China Electric Holdings, China Mobile Communications Group, Dalian University of Technology, the National Energy Administration Information Center, Jiangsu Information Center, China Civil Aviation University of China Electric Power Research Institute. The main drafters of this section. Dequan, LU Xin, Wang Xianlei, Wang Changsheng, Guo Yanqing, Yang full moon, Lishou Peng, Lv Hanyang, Du Wei, Xiao Ying, Mo Zhang Nan, Luo Cheng, Wu Zhijun, a Young Man, Xie Donghui, Cheng Lu, Hong Hu liter, Sun Xiaohong, Xu Hao, Zhou Chi, Chen Min, the Lei Jin, Fan Hui, Kunlun high, Li Peng, Li Hui.

GB/T 31495 in accordance with relevant national requirements for information security work, the proposed information security concepts and model evaluation Index System and Implementation Guide. 31495 consists of three parts. Part 1 describes the various parts of this standard on the basis of common concepts, and gives information security Concepts and models for information security evaluation model gives a measure of indicators; Part

2 In the first part of the model guidance given letter Income security index system and index measurement process; Section 3 presents the evaluation of the implementation of information security should comply with the requirements of stream Processes and methods. 31495 is mainly used for. information security posture government departments judgment and macro support decision-making; and a heavy-based information network Information security management to management of information systems departments and operating units to provide support. Information Security techniques - Information security Index System And evaluation method Part 1. Concepts and models

1 Scope

GB/T 31495.1-2015 is the foundation part of a series about measuring information security rather than merely requiring it. Security assurance is routinely asserted and rarely quantified, and the reason is not laziness: the thing being measured is the absence of successful attacks, which cannot be observed directly, so any indicator is a proxy and any evaluation depends on how the proxies were chosen and combined. A series that intends to define indicators therefore has to start by fixing what an evaluation is, what it produces, and what the parts of it are called - otherwise each subsequent part builds on a different foundation. This part of GB/T 31495 defines the basic concepts of information security evaluation and establishes the general information security evaluation model on which the later parts rest. It applies to information security evaluation. Under ICS 35.040 and CCS L80, it is written for the assessment bodies conducting security evaluations, for the organisations being evaluated who need to understand what the result means, and for anyone drafting a security assurance requirement that is intended to be checkable.

GB/T 31495 in this section defines the basic concepts of information security assessment, established the general information security evaluation model. This section applies to information security evaluation.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) applies to this document.

GB/T 25069-2010 Information security technology terms

3 Terms and Definitions

GB/T 25069-2010 and as defined in the following terms and definitions apply to this document.

3.1 Information Security informationsecurityassurance Security attributes and functions of information and information systems, the efficiency of the act or process of a series of appropriate safeguards.

3.2 Information Security Evaluation evaluationofinformationsecurityassurance Evidence collected information security, and access to the process and means of information security values.

3.3 Information security measures measuresforinformationsecurityassurance In order to achieve the purpose of the collection of information security used to protect instruments.

3.4 Information security capabilities capabilityofinformationsecurityassurance Physical security safeguards are reflected in defense, response, and recovery characteristics.

3.5 Information Security effect effectsofinformationsecurityassurance The level of protection is to achieve information security objectives and attributes of the entity.

4 Information Security Model

Information security model is established by using a process approach. Figure 1 illustrates an information security safeguards are established according to security needs of stakeholders, formed to protect the ability to achieve security Process effect. According to stakeholders, the protection effect of feedback, can be dynamically adjusted safeguards to better meet security needs.