网络与信息安全学报 ›› 2023, Vol. 9 ›› Issue (1): 92-102.doi: 10.11959/j.issn.2096-109x.2023010

• 学术论文 • 上一篇    下一篇

内禀安全：网络安全能力体系化构建方法

陈训逊1, 李明哲1,2, 吕宁2, 黄亮1   

  1. 1 国家计算机网络应急技术处理协调中心，北京100094
    2 长安通信科技有限责任公司，北京102209
  • 修回日期:2022-12-04 出版日期:2023-02-25 发布日期:2023-02-01
  • 作者简介:陈训逊（1972- ），男，黑龙江哈尔滨人，博士，国家计算机网络应急技术处理协调中心正高级工程师，主要研究方向为网络空间安全、计算机网络与信息安全
    李明哲（1988- ），男，山东临沂人，博士，国家计算机网络应急技术处理协调中心工程师，主要研究方向为网络信息安全
    吕宁（1988- ），女，山东淄博人，硕士，长安通信科技有限责任公司工程师，主要研究方向为网络安全
    黄亮（1982- ），男，湖南邵阳人，博士，国家计算机网络应急技术处理协调中心正高级工程师，主要研究方向为网络信息安全
  • 基金资助:
    国家重点研发计划(2022YFB3102905)

Intrinsic assurance: a systematic approach towards extensible cybersecurity

Xunxun CHEN1, Mingzhe LI1,2, Ning LYU2, Liang HUANG1   

  1. 1 National Computer Network Emergency Response Technical Team/Coordination Center of China, Beijing 100094, China
    2 Chang'an Communication Technology Co., Ltd., Beijing 102209, China
  • Revised:2022-12-04 Online:2023-02-25 Published:2023-02-01
  • Supported by:
    The National Key R＆D Program of China(2022YFB3102905)

在线阅读

116

pdf下载

505

摘要：

目前主流的网络安全防护体系是外嵌的，安全体系与业务体系分离，安全产品相互孤立，在防护能力上难以高效应对越来越复杂的网络安全挑战。网络安全从外向内进行强基，势在必行。将网络安全的业务场景归纳为组织、厂商、监管和威胁四方视角，各视角具有不同的业务目标。从四方视角的共性和个性出发，系统性归纳网络安全生态的能力需求，提出内禀安全方法论。内禀安全能力是指ICT组件原生支撑监测、防护和溯源等安全功能的能力。内禀安全能力对网络安全具有基础支撑作用，本身不是最终的安全功能实现，与现有的“内生安全”“内设安全”等方法论所针对的问题不同。内禀安全强调网络组件内在的安全赋能禀赋，有两种方式可以发掘这种禀赋，一是通过先天安全能力激活，二是外嵌能力内化，对外在逻辑上表现出自体免疫。此类组件的优势之一在于业务与安全的内聚，能够透明化感知安全态势、定制化配置安全策略、贴身化执行安全保护；优势之二在于将业务功能与安全功能进行合并封装，简化整体工程架构，降低网络管理复杂度。进一步提出了内禀安全支撑能力框架，对符合内禀安全理念的安全能力进行归纳和枚举，将安全支撑能力分为采集、认知、执行、协同和弹复5类，并进一步介绍各类能力的子类型和基础ICT技术。基于该框架，介绍了典型安全业务场景在内禀安全理念下的增强实现。

关键词: 内禀安全, 网络安全框架, 内生安全, 安全能力

Abstract:

At present, the mainstream cyber security systems are laid out in an alienated style, where security functions are separated from business processes, and security products are isolated from each other.It is difficult to effectively cope with increasingly complicated cyber threats in this architecture.Therefore, it is imperative to move security inward for more resilient and secure network infrastructures.Business scenarios of the cybersecurity sector can be categorized into four perspectives: organization, vendor, regulatory and threat, each of which has different business objectives.Starting from the commonness and individuality of the four perspectives, the needs of this sector was systematically summarized and then the goal of building an extensible cybersecurity capability ecosystem was recognized.As the key to this goal, the intrinsic assurance methodology was proposed.Intrinsic assurance capabilities referred to the abilities of ICT components to natively support security functions such as monitoring, protection and traceability.But intrinsic assurance is not the ultimate security implementation itself, which is a key difference from the existing “endogenous security” or “designed-in security” methodologies.Intrinsic assurance emphasizes the inherent security enabling endowment of network components, whether by activating an innate gift or by encapsulating a given one, both of which logically exhibit autoimmunity from an external viewpoint.One advantage of such a component is the cohesion of business and security, which leads to transparent security posture awareness, customized security policies, and close-fitting security protection.It also simplifies the overall engineering architecture and reduces management complexity through encapsulation of multiple functions into a singleton.Additionally, the Intrinsic Assurance Support Capability Framework was put forward, which summarized and enumerated the security capabilities that conformed to the intrinsic assurance concept.This framework classified the security capabilities into five categories, namely collection, cognition, execution, syndication and resilience respectively, together with their sub-types and underlying ICT technologies.Based on this framework, the enhanced implementations of typical security business scenarios was further introduced in light of intrinsic assurance.

Key words: intrinsic assurance, cybersecurity framework, endogenous security, security capabilities

中图分类号: 

No Suggested Reading articles found!