论坛 › 上海 › 美国网络安全框架更新内容分析

lbk60ox 发表于 2024-8-31 01:19:33

美国网络安全框架更新内容分析

<img src="http://mmbiz.qpic.cn/mmbiz_png/Z461zsU9BNFRfsNux5T0ib5E6jhqW4b9icfzwwCnOvQObTJolF3geAx333EIn6StC9uvZPmhw1SKjGbtib0ws9oHQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">2014年<span style="color: black;">2</span>月，<span style="color: black;">NIST</span>发布了《<span style="color: black;">提高</span>关键<span style="color: black;">基本</span><span style="color: black;">设备</span>网络安全的框架》（以下简<span style="color: black;">叫作</span>“框架”）<span style="color: black;">V1.0</span>正式版本。本安全框架的起源是美国前总统奥巴马发布的《关于<span style="color: black;">加强</span>关键<span style="color: black;">基本</span><span style="color: black;">设备</span>网络安全的行政命令》，<span style="color: black;">需求</span><span style="color: black;">NIST</span>制定安全框架，应<span style="color: black;">包含</span>一系列与标准、<span style="color: black;">办法</span>、程序和过程相匹配的<span style="color: black;">处理</span>网络<span style="color: black;">危害</span>的政策、业务和技术<span style="color: black;">办法</span>。<span style="color: black;">2017</span>年<span style="color: black;">1</span>月，<span style="color: black;">NIST</span>发布了框架<span style="color: black;">V1.1</span>的草稿，预计今年<span style="color: black;">10</span>月份会出正式版本。<span style="color: black;">评定</span>中心技术部基于框架更新的内容进行了<span style="color: black;">科研</span>分析和部分内容的翻译，该框架<span style="color: black;">针对</span>等级<span style="color: black;">守护</span>测评<span style="color: black;">亦</span><span style="color: black;">拥有</span><span style="color: black;">必定</span>的<span style="color: black;">科研</span>和参考价值，现将<span style="color: black;">科研</span>总结的内容<span style="color: black;">供给</span>给<span style="color: black;">大众</span><span style="color: black;">科研</span>学习。</span></p><img src="http://mmbiz.qpic.cn/mmbiz_png/Z461zsU9BNFRfsNux5T0ib5E6jhqW4b9icfzwwCnOvQObTJolF3geAx333EIn6StC9uvZPmhw1SKjGbtib0ws9oHQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">框架V1.1<span style="color: black;">重点</span>是从以下<span style="color: black;">4</span>个方面对<span style="color: black;">V1.0</span>做了改进、澄清和<span style="color: black;">加强</span>：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">表一 框架更新内容</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">更新</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">更新的描述</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">1、</span>增添了“网络安全<span style="color: black;">测绘</span>”小节</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">增多</span>了第<span style="color: black;">4</span>章 <span style="color: black;">测绘</span>和展示网络安全，讨论业务成果与网络安全<span style="color: black;">危害</span>管理指标和<span style="color: black;">办法</span>的<span style="color: black;">关联</span>性。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">2、</span>对网络供应链<span style="color: black;">危害</span>管理<span style="color: black;">运用</span>框架的目的进行了大篇幅的解释</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在<span style="color: black;">全部</span>文档中<span style="color: black;">增多</span>了网络供应链<span style="color: black;">危害</span>管理（<span style="color: black;">SCRM</span>）的<span style="color: black;">思虑</span>。扩展的<span style="color: black;">3.3</span>节（与利益<span style="color: black;">关联</span>人沟通网络安全<span style="color: black;">需求</span>）有助于用户更好地理解网络<span style="color: black;">SCRM</span>。网络<span style="color: black;">SCRM</span><span style="color: black;">亦</span>被添加进执行等级。最后，</span><span style="color: black;">框架核心中<span style="color: black;">增多</span>了“供应链<span style="color: black;">危害</span>管理”类别</span><span style="color: black;">。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">3、</span>对鉴别、授权和身份证明的优化</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">优化<span style="color: black;">拜访</span><span style="color: black;">掌控</span>类，更好地<span style="color: black;">思虑</span>了鉴别、授权和身份证明。该类别添加了一个子类。最后，该类已更名为身份管理和<span style="color: black;">拜访</span><span style="color: black;">掌控</span>（<span style="color: black;">PR.AC</span>）更好地<span style="color: black;">暗示</span>了类别和相应的子类别的范围。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">4、</span>更好地解释了执行等级和轮廓之间的关系</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在第<span style="color: black;">3.2</span>节（<span style="color: black;">创立</span>或改进网络安全<span style="color: black;">方法</span>）中<span style="color: black;">增多</span>了在框架实施过程中<span style="color: black;">运用</span>框架执行等级的描述。为框架的执行等级<span style="color: black;">增多</span>描述以反映<span style="color: black;">公司</span>在安全框架中整合<span style="color: black;">危害</span>管理的<span style="color: black;">方法</span>。更新了图<span style="color: black;">2.0</span>，<span style="color: black;">包括</span>来自框架的执行等级的<span style="color: black;">有些</span><span style="color: black;">行径</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">下面<span style="color: black;">咱们</span>将从以上4个方面对框架更新的内容进行<span style="color: black;">仔细</span>分析。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">1、</span>网络安全<span style="color: black;">测绘</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">框架最大的变化是在原来的<span style="color: black;">基本</span>上<span style="color: black;">增多</span>了第4章节“<span style="color: black;">测绘</span>和展示网络安全”，该章节<span style="color: black;">重点</span>讨论了网络安全<span style="color: black;">测绘</span>的<span style="color: black;">关联</span>概念以及业务成果与网络安全<span style="color: black;">危害</span>管理指标和<span style="color: black;">办法</span>的<span style="color: black;">关联</span>性，第<span style="color: black;">4</span>章的<span style="color: black;">仔细</span>内容如下：</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">框架<span style="color: black;">测绘</span>（Measurement）为<span style="color: black;">公司</span>内部和<span style="color: black;">外边</span>的强信任关系<span style="color: black;">供给</span>了<span style="color: black;">基本</span>。随着时间的推移，<span style="color: black;">经过</span><span style="color: black;">外边</span>审计和合规性<span style="color: black;">评定</span>来衡量状态和趋势，使<span style="color: black;">公司</span>能够理解并向第三方、合作伙伴和客户传达有<span style="color: black;">道理</span>的<span style="color: black;">危害</span>信息。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">结合参考文献，框架可用作综合<span style="color: black;">测绘</span>的<span style="color: black;">基本</span>。<span style="color: black;">运用</span>框架<span style="color: black;">测绘</span>的关键术语是“指标”（<span style="color: black;">Metrics</span>）和“<span style="color: black;">办法</span>”（<span style="color: black;">Measures</span>）。<span style="color: black;">测绘</span>指标用于促进决策，<span style="color: black;">加强</span>绩效和职责。执行等级、子类别和类别是<span style="color: black;">测绘</span>指标的示例。<span style="color: black;">测绘</span>指标<span style="color: black;">经过</span>聚合和关联<span style="color: black;">办法</span>来创建组织安全态势的<span style="color: black;">道理</span>和<span style="color: black;">认识</span>。<span style="color: black;">办法</span>是“可量化、可观察、客观的支持<span style="color: black;">测绘</span>指标的数据”。<span style="color: black;">办法</span>与技术<span style="color: black;">掌控</span>最密切<span style="color: black;">关联</span>，例如参考文献。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">从安全<span style="color: black;">测绘</span>指标收集的信息<span style="color: black;">表示</span>了<span style="color: black;">公司</span><span style="color: black;">区别</span>方面的网络<span style="color: black;">危害</span>状态。<span style="color: black;">因此呢</span>，跟踪安全指标和业务成果<span style="color: black;">能够</span><span style="color: black;">供给</span>有<span style="color: black;">道理</span>的视角，展示了安全<span style="color: black;">掌控</span>的变化<span style="color: black;">怎样</span>影响业务<span style="color: black;">目的</span>的完成。虽然<span style="color: black;">经过</span>滞后<span style="color: black;">测绘</span>来<span style="color: black;">测绘</span>业务<span style="color: black;">目的</span><span style="color: black;">是不是</span>达到是很重要的，但<span style="color: black;">一般</span><span style="color: black;">经过</span>领先<span style="color: black;">测绘</span>的方式，来<span style="color: black;">认识</span>实现<span style="color: black;">将来</span><span style="color: black;">目的</span>的可能性<span style="color: black;">一般</span>更为重要。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">公司</span>确定网络安全和业务成果之间因果关系的能力取决于<span style="color: black;">测绘</span>系统的准确性和精度（即由ID.AM-5中强调的“资源”<span style="color: black;">构成</span>）。<span style="color: black;">因此呢</span>，在设计<span style="color: black;">测绘</span>系统时应<span style="color: black;">思虑</span>业务<span style="color: black;">需求</span>和操作<span style="color: black;">花费</span>。<span style="color: black;">测绘</span>系统的<span style="color: black;">花费</span>可随着<span style="color: black;">测绘</span>精度的<span style="color: black;">增多</span>而增加。为了减轻<span style="color: black;">测绘</span>系统对<span style="color: black;">公司</span>的<span style="color: black;">欠妥</span>成本，<span style="color: black;">测绘</span>系统的准确性和花费需要和相应业务<span style="color: black;">目的</span>所需的<span style="color: black;">测绘</span>精度相匹配。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">4.1节 与业务成果的<span style="color: black;">关联</span>性</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">测绘</span>网络安全的<span style="color: black;">目的</span>是将网络安全与业务<span style="color: black;">目的</span>（ID.BE-3）<span style="color: black;">关联</span>联，以便理解和量化因果关系。<span style="color: black;">平常</span>的业务<span style="color: black;">目的</span><span style="color: black;">包含</span>：推动业务<span style="color: black;">/</span>使命结果、<span style="color: black;">加强</span>成本效益、降低企业<span style="color: black;">危害</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">将网络安全指标与业务<span style="color: black;">目的</span><span style="color: black;">关联</span>联，<span style="color: black;">常常</span>比简单地<span style="color: black;">测绘</span>网络安全结果更为<span style="color: black;">繁杂</span>。<span style="color: black;">针对</span>给定的业务<span style="color: black;">目的</span>，存在<span style="color: black;">海量</span>且多样化的驱动<span style="color: black;">原因</span>。例如，<span style="color: black;">针对</span>想要<span style="color: black;">增多</span>在线银行客户数量的零售银行，<span style="color: black;">能够</span><span style="color: black;">经过</span>实施更强的鉴别来实现。然而，实<span style="color: black;">此刻</span>线银行客户的<span style="color: black;">增多</span>还取决于发展关于可信的在线交易<span style="color: black;">信息</span>、针对特定群体的消费者，<span style="color: black;">选取</span>对特定群体最有<span style="color: black;">道理</span>的通信信道，以及在实现<span style="color: black;">目的</span>所需的<span style="color: black;">连续</span>时间上营销<span style="color: black;">哪些</span>通信信道。总之，实现客户增长取决于信息、营销、<span style="color: black;">宣传</span>网络安全和其他<span style="color: black;">原因</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">区别</span>网络安全活动的相对成本效益是一个重要的<span style="color: black;">思虑</span><span style="color: black;">原因</span>。成本效益<span style="color: black;">寓意</span>着<span style="color: black;">运用</span>最低的网络安全时间和<span style="color: black;">花费</span>实现特定的业务<span style="color: black;">目的</span>。为了<span style="color: black;">检测</span>成本效益，<span style="color: black;">公司</span>必须<span style="color: black;">首要</span>清楚地<span style="color: black;">认识</span>业务<span style="color: black;">目的</span>，<span style="color: black;">认识</span>业务<span style="color: black;">目的</span>和网络安全指标之间的关系，以及<span style="color: black;">认识</span>业务<span style="color: black;">目的</span>和非网络安全<span style="color: black;">原因</span>之间的关系。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">网络安全结果对业务<span style="color: black;">目的</span>的影响<span style="color: black;">一般</span>是不清楚的。网络安全的<span style="color: black;">重点</span><span style="color: black;">功效</span>是<span style="color: black;">守护</span>业务价值，是<span style="color: black;">经过</span><span style="color: black;">守护</span><span style="color: black;">公司</span>的信息、操作和过程的保密性、完整性和可用性（以下简<span style="color: black;">叫作</span>为“<span style="color: black;">CIA</span>”）实现的。<span style="color: black;">因此呢</span>，即使当成本效益或网络安全结果对业务<span style="color: black;">目的</span>的影响不清楚，<span style="color: black;">公司</span>应在修改其网络安全计划时<span style="color: black;">小心</span>行事。<span style="color: black;">一般</span>，网络安全结果<span style="color: black;">能够</span>防止<span style="color: black;">卑劣</span>的业务环境，例如数据<span style="color: black;">泄密</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">企业<span style="color: black;">危害</span>管理是<span style="color: black;">思虑</span>到实现既定业务<span style="color: black;">目的</span>的所有<span style="color: black;">危害</span>。<span style="color: black;">保证</span>将网络安全<span style="color: black;">原因</span>引入到企业<span style="color: black;">危害</span><span style="color: black;">思虑</span>中是实现业务<span style="color: black;">目的</span>所必需的。这<span style="color: black;">包含</span>网络安全的积极影响以及网络安全被破坏的<span style="color: black;">消极</span>影响。下面强调的管理<span style="color: black;">测绘</span>指标是<span style="color: black;">运用</span>框架核心来聚合网络安全<span style="color: black;">危害</span>的一种方式，使网络安全<span style="color: black;">作为</span>企业<span style="color: black;">危害</span>管理的<span style="color: black;">思虑</span><span style="color: black;">原因</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">公司</span>决定网络安全结果和业务<span style="color: black;">目的</span>之间的因果关系的能力还取决于充分隔离这些网络安全结果和业务<span style="color: black;">目的</span>的能力。这是影响网络安全<span style="color: black;">测绘</span>的最大挑战之一。必须<span style="color: black;">尤其</span><span style="color: black;">重视</span>，<span style="color: black;">保证</span>给定的网络安全结果和业务<span style="color: black;">目的</span>真正<span style="color: black;">关联</span>。<span style="color: black;">通常</span><span style="color: black;">来讲</span>，将网络安全<span style="color: black;">办法</span>与更高级别的网络安全指标<span style="color: black;">关联</span>联，比将网络安全指标与业务指标<span style="color: black;">关联</span>联更为容易。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">4.2节 网络安全<span style="color: black;">测绘</span>的种类</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">表二中总结了<span style="color: black;">相关</span>框架的指标和<span style="color: black;">办法</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">表二 框架的指标和<span style="color: black;">办法</span></span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">测绘</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">测绘</span>什么</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">相应的框架组件</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">测绘</span>类型</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">实践</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">通常</span><span style="color: black;">危害</span>管理<span style="color: black;">行径</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">执行等级</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">指标</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">处理</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">特殊<span style="color: black;">危害</span>管理活动</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">框架的编写<span style="color: black;">包含</span>七步过程（第<span style="color: black;">3.2</span>节）和用例<span style="color: black;">详细</span>的过程（如第<span style="color: black;">3.3</span>和第<span style="color: black;">3.6</span>节）。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">办法</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">管理</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">满足<span style="color: black;">通常</span>网络安全结果</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">核心<span style="color: black;">/</span>轮廓功能，类和子类</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">指标</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">技术上的</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">实现特殊网络安全结果</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">参考文献</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">办法</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">框架执行等级是网络安全<span style="color: black;">危害</span>管理全面实践的一个定性指标。除了首要的1 - 4定性指标外，<span style="color: black;">危害</span>管理流程、综合<span style="color: black;">危害</span>管理<span style="color: black;">方法</span>、对外参与和网络供应链<span style="color: black;">危害</span>管理独特的执行等级属性<span style="color: black;">亦</span><span style="color: black;">包含</span>实践指标。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">而执行等级中的实践是高层组织<span style="color: black;">行径</span>的<span style="color: black;">通常</span>趋势，这些实践<span style="color: black;">是由于</span><span style="color: black;">表率</span>特定<span style="color: black;">危害</span>管理活动的离散过程<span style="color: black;">构成</span>的。例如，更新框架轮廓过程的周期（<span style="color: black;">过程</span>3）是在<span style="color: black;">危害</span>管理过程中这个指标给出的<span style="color: black;">办法</span>。<span style="color: black;">一样</span>，<span style="color: black;">处理</span>网络安全<span style="color: black;">危害</span>（ID.GV-4）的治理和<span style="color: black;">危害</span>管理流程在整合<span style="color: black;">危害</span>管理程序这个指标中给出的<span style="color: black;">办法</span>。最后，从信息共享论坛和<span style="color: black;">源自</span>（<span style="color: black;">ID.RA-2</span>）接收到的威胁和脆弱性信息量是在对外参与这个指标中给出的。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">框架核心的网络安全结果是全套网络安全管理指标的<span style="color: black;">基本</span>。这些指标的总和等同于网络安全<span style="color: black;">危害</span>的减少或消失。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">例如，<span style="color: black;">守护</span>功能的结果是“制定和实施相应的<span style="color: black;">保证</span><span style="color: black;">办法</span>，<span style="color: black;">保证</span>交付…” 对这一结果负责的高级管理人员<span style="color: black;">能够</span><span style="color: black;">运用</span>系统的正常运行时间（即<span style="color: black;">保证</span>交付）的滞后指标来<span style="color: black;">测绘</span>，以及用于<span style="color: black;">研发</span>和实施数据安全制定和传达策略的<span style="color: black;">重点</span>指标。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">相应地，业务流程人员可能对<span style="color: black;">守护</span>功能（PR.DS）的数据安全类别及其子类别负责。 数据安全指“<span style="color: black;">按照</span>组织的<span style="color: black;">危害</span>策略管理信息和记录（数据），以<span style="color: black;">守护</span>信息的<span style="color: black;">CIA</span>。”对所有数据安全负责的业务流程人员<span style="color: black;">能够</span><span style="color: black;">运用</span>政策的发布和传播与组织的<span style="color: black;">危害</span>策略和<span style="color: black;">CIA</span>的<span style="color: black;">目的</span><span style="color: black;">是不是</span>相符这一<span style="color: black;">重点</span>指标来<span style="color: black;">测绘</span>。此业务流程人员的滞后指标可能是数据安全子类别负责人<span style="color: black;">怎样</span>管理<span style="color: black;">CIA</span>的复合滞后指标。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">一样</span>，负责<span style="color: black;">守护</span>静态数据（PR.DS-1）的执行<span style="color: black;">/</span>操作人员可能会<span style="color: black;">按照</span>执行<span style="color: black;">守护</span>机制的<span style="color: black;">重点</span>指标来<span style="color: black;">测绘</span>，其中滞后指标<span style="color: black;">指的是</span>数据<span style="color: black;">是不是</span>得到<span style="color: black;">守护</span>，这<span style="color: black;">是由于</span>缺乏未经授权的修改、删除或盗窃组织数据来证明的。执行<span style="color: black;">/</span>操作人员<span style="color: black;">能够</span><span style="color: black;">运用</span>适用的参考文献和相应的<span style="color: black;">办法</span>来实现<span style="color: black;">PR.DS-1</span>的<span style="color: black;">目的</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">参考文献，如<span style="color: black;">掌控</span>目录，<span style="color: black;">供给</span><span style="color: black;">仔细</span>的技术<span style="color: black;">办法</span>，以模块化的方式对框架进行<span style="color: black;">弥补</span>。例如，<span style="color: black;">公司</span><span style="color: black;">运用</span>NIST SP 800-53</span><span style="color: black;">14</span><span style="color: black;">安全<span style="color: black;">掌控</span>SP-28实施<span style="color: black;">PR.DS-1</span>子类别可能对设计，<span style="color: black;">研发</span><span style="color: black;">/</span>购买，实施，管理，演变和终止的<span style="color: black;">办法</span>负责：</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;"><span style="color: black;">经过</span><span style="color: black;">各样</span><span style="color: black;">媒介</span>存储（内部托管硬盘，云硬盘，便携式存储设备，移动设备）的<span style="color: black;">秘码</span>机制</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">针对特定数据结构的全磁盘加密（例如文件，记录或字段），</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">文件共享扫描，</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">可多次读一次写的技术，以及</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">安全的离线存储代替在线存储。</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">2、</span>网络供应链<span style="color: black;">危害</span>管理</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">在框架中的第二大变化<span style="color: black;">便是</span>将网络供应链<span style="color: black;">危害</span>管理方面的内容贯穿在<span style="color: black;">全部</span>框架<span style="color: black;">其中</span>，在框架的“<span style="color: black;">2.2</span>框架执行等级”、“<span style="color: black;">3.3</span>与利益<span style="color: black;">关联</span>人沟通网络安全<span style="color: black;">需求</span>”以及附件表<span style="color: black;">2</span>中都<span style="color: black;">增多</span>了与网络供应链<span style="color: black;">危害</span>管理的<span style="color: black;">关联</span>内容，更新内容<span style="color: black;">详细</span>的翻译如下：</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">2.2节 框架执行等级</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">第1级：局部的</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">网络供应链<span style="color: black;">危害</span>管理—<span style="color: black;">公司</span>可能不<span style="color: black;">认识</span>网络供应链<span style="color: black;">危害</span>的所有含义，<span style="color: black;">或</span><span style="color: black;">无</span>识别、<span style="color: black;">评定</span>和缓解其网络供应链<span style="color: black;">危害</span>的流程。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">第2级：依据<span style="color: black;">危害</span>的</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">一体化<span style="color: black;">危害</span>管理<span style="color: black;">方法</span>—<span style="color: black;">公司</span>的某些级别会在使命<span style="color: black;">/</span>业务<span style="color: black;">目的</span>中<span style="color: black;">思虑</span>网络安全。<span style="color: black;">公司</span>资产的网络<span style="color: black;">危害</span><span style="color: black;">评定</span><span style="color: black;">一般</span>是不可重复的。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">网络供应链<span style="color: black;">危害</span>管理—<span style="color: black;">公司</span>理解与<span style="color: black;">制品</span>或服务<span style="color: black;">关联</span>的网络供应链<span style="color: black;">危害</span>，这些<span style="color: black;">制品</span>和服务既支持组织的业务使命功能，<span style="color: black;">亦</span>可用于组织的<span style="color: black;">制品</span>或服务。该<span style="color: black;">公司</span>在内部或与其供应商和合作伙伴之间<span style="color: black;">无</span>管理网络供应链<span style="color: black;">危害</span>的正式能力，执行这些活动存在不一致性。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">第3级：可重复的</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">一体化<span style="color: black;">危害</span>管理<span style="color: black;">方法</span>—<span style="color: black;">公司</span><span style="color: black;">连续</span>准确地监测<span style="color: black;">公司</span>资产的网络安全<span style="color: black;">危害</span>。高级网络安全和非网络安全主管<span style="color: black;">定时</span>沟通网络安全<span style="color: black;">危害</span>。 高级主管<span style="color: black;">经过</span><span style="color: black;">公司</span>中的所有业务线<span style="color: black;">思虑</span>网络安全。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">网络供应链<span style="color: black;">危害</span>管理—<span style="color: black;">经过</span>企业<span style="color: black;">危害</span>管理政策、流程和程序执行全<span style="color: black;">公司</span>的网络供应链<span style="color: black;">危害</span>管理办法。这可能<span style="color: black;">包含</span>治理结构（例如<span style="color: black;">危害</span>委员会），管理网络供应链<span style="color: black;">危害</span>与管理其他的<span style="color: black;">危害</span>相平衡。政策，过程和程序<span style="color: black;">根据</span>预期一致地实施，并<span style="color: black;">连续</span>监测和审查。人员<span style="color: black;">拥有</span>执行其指定的网络供应链<span style="color: black;">危害</span>管理职责的知识和技能。<span style="color: black;">公司</span>制定了正式合同，向其供应商和合作伙伴传达基本<span style="color: black;">需求</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">第4级：适应性的</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">一体化<span style="color: black;">危害</span>管理<span style="color: black;">方法</span>—当作出决策时应清楚地<span style="color: black;">认识</span>和<span style="color: black;">思虑</span>网络安全<span style="color: black;">危害</span>和使命<span style="color: black;">/</span>业务<span style="color: black;">目的</span>之间的关系。高级管理人员监控网络安全<span style="color: black;">危害</span>与监控金融<span style="color: black;">危害</span>和其他<span style="color: black;">公司</span><span style="color: black;">危害</span><span style="color: black;">同样</span>。<span style="color: black;">公司</span>基于对当前和预测的<span style="color: black;">危害</span>环境和<span style="color: black;">将来</span><span style="color: black;">危害</span>的<span style="color: black;">认识</span>进行预算。业务<span style="color: black;">分部</span>实现业务前景和分析系统级<span style="color: black;">危害</span>时应<span style="color: black;">思虑</span>到<span style="color: black;">公司</span>的<span style="color: black;">危害</span>偏好和<span style="color: black;">危害</span>容忍度。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">所有阶层都清楚地表达和理解网络安全<span style="color: black;">危害</span>。该<span style="color: black;">公司</span><span style="color: black;">能够</span>快速有效地解释业务/使命<span style="color: black;">目的</span>、威胁和技术的变化，以<span style="color: black;">认识</span><span style="color: black;">危害</span>是<span style="color: black;">怎样</span>传达和接近的。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">网络供应链<span style="color: black;">危害</span>管理—<span style="color: black;">公司</span><span style="color: black;">能够</span><span style="color: black;">运用</span>实时或接近实时的信息，快速<span style="color: black;">有效</span>地<span style="color: black;">处理</span>新兴的网络供应链<span style="color: black;">危害</span>，并利用供应链<span style="color: black;">危害</span>管理的制度化知识管理<span style="color: black;">外边</span>供应商、合作伙伴以及内部网络<span style="color: black;">关联</span>职能<span style="color: black;">分部</span>。<span style="color: black;">公司</span>主动沟通、并<span style="color: black;">运用</span>正式（例如协议）和非正式机制来发展和保持与供应商、合作伙伴、个人和<span style="color: black;">公司</span>买家的<span style="color: black;">牢靠</span>关系。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">3.3节 与利益<span style="color: black;">关联</span>人沟通网络安全<span style="color: black;">需求</span></span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">另外</span>，执行等级使得<span style="color: black;">公司</span><span style="color: black;">认识</span>它们<span style="color: black;">怎样</span>适应更大的网络安全生态系统。<span style="color: black;">公司</span><span style="color: black;">能够</span><span style="color: black;">经过</span><span style="color: black;">评定</span>其在关键<span style="color: black;">基本</span><span style="color: black;">设备</span>和更广泛的数字经济中的地位，更好地管理利益<span style="color: black;">关联</span>者之间的网络安全<span style="color: black;">危害</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在利益<span style="color: black;">关联</span>者之间沟通和验证网络安全<span style="color: black;">需求</span>的做法是网络SCRM的一个方面。网络<span style="color: black;">SCRM</span>的<span style="color: black;">重点</span>目标是识别、<span style="color: black;">评定</span>和缓解可能<span style="color: black;">包括</span>潜在恶意功能的<span style="color: black;">制品</span>和服务，<span style="color: black;">或</span><span style="color: black;">因为</span>网络供应链中不良的制造和<span style="color: black;">研发</span>实践<span style="color: black;">导致</span>的脆弱性。网络<span style="color: black;">SCRM</span>活动可能<span style="color: black;">包含</span>：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">确定供应商以及信息技术（IT）和运营技术（<span style="color: black;">OT</span>）合作伙伴的网络安全<span style="color: black;">需求</span>，</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;"><span style="color: black;">经过</span>正式协议（如合同）制定网络安全<span style="color: black;">需求</span>，</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;">与供应商和合作伙伴沟通<span style="color: black;">怎样</span>验证和确认这些网络安全<span style="color: black;">需求</span>，</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;"><span style="color: black;">经过</span><span style="color: black;">各样</span><span style="color: black;">评定</span><span style="color: black;">办法</span>验证网络安全<span style="color: black;">需求</span><span style="color: black;">是不是</span>满足，</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">l&nbsp;</span><span style="color: black;"><span style="color: black;">调节</span>和管理<span style="color: black;">以上</span>活动。</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">如下图</span><span style="color: black;"><span style="color: black;">所示，网络</span>SCRM<span style="color: black;"><span style="color: black;">包含</span></span>IT<span style="color: black;">和</span>OT<span style="color: black;">供应商</span></span><span style="color: black;">和</span><span style="color: black;"><span style="color: black;">买方，以及非</span>IT<span style="color: black;">和</span>OT<span style="color: black;">合作伙伴。这些关系<span style="color: black;">明显</span>了网络</span>SCRM<span style="color: black;">在</span></span><span style="color: black;">关键<span style="color: black;">基本</span><span style="color: black;">设备</span>和更广泛的数字经济中处理网络安全<span style="color: black;">危害</span>的关键<span style="color: black;">功效</span>。它们应该被识别并纳入到<span style="color: black;">公司</span>的<span style="color: black;">守护</span>和检测能力以及组织的响应和恢复协议中去。</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="http://mmbiz.qpic.cn/mmbiz_png/Z461zsU9BNFRfsNux5T0ib5E6jhqW4b9icC2tvxsQpHBFE3phicBMpItHmSpHljssCb9xJqd6BMYb49grCXUGWbSA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">图1 网络供应链关系</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">买方<span style="color: black;">指的是</span><span style="color: black;">有些</span>人员或<span style="color: black;">公司</span>，<span style="color: black;">她们</span>从一个<span style="color: black;">公司</span>中购买一个指定的<span style="color: black;">制品</span>或服务。供应商<span style="color: black;">包括</span></span><span style="color: black;"><span style="color: black;"><span style="color: black;">制品</span>和服务<span style="color: black;">供给</span>商，是用于<span style="color: black;">公司</span>内部目的（例如</span>IT<span style="color: black;"><span style="color: black;">基本</span><span style="color: black;">设备</span>）或集成到<span style="color: black;">供给</span>给买方的<span style="color: black;">制品</span>或服务</span></span><span style="color: black;">中去</span><span style="color: black;"><span style="color: black;">。最后，非</span>IT<span style="color: black;">和</span>OT<span style="color: black;">合作伙伴可能会对<span style="color: black;">公司</span>的安全状态<span style="color: black;">形成</span><span style="color: black;">危害</span>。</span></span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">无论<span style="color: black;">思虑</span>核心的个别子类别，还是综合<span style="color: black;">思虑</span>轮廓，框架为<span style="color: black;">公司</span>及其合作伙伴<span style="color: black;">供给</span>一种<span style="color: black;">保证</span>新<span style="color: black;">制品</span>或服务符合<span style="color: black;">根据</span>优先<span style="color: black;">次序</span><span style="color: black;">思虑</span>的安全性结果的<span style="color: black;">办法</span>。<span style="color: black;">经过</span><span style="color: black;">首要</span><span style="color: black;">选取</span>与上下文<span style="color: black;">关联</span>（PII传输，业务关键服务交付，数据验证服务，<span style="color: black;">制品</span>或服务完整性等）的结果，<span style="color: black;">公司</span><span style="color: black;">能够</span><span style="color: black;">按照</span>这些标准<span style="color: black;">评定</span>合作伙伴。例如，<span style="color: black;">倘若</span>正在购买将要监控<span style="color: black;">OT</span>的特定系统，则可用性可能是要实现的<span style="color: black;">尤其</span>重要的网络安全<span style="color: black;">目的</span>，<span style="color: black;">因此呢</span>可用性将驱动子类别的<span style="color: black;">选取</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">附件表2：功能和类别<span style="color: black;">独一</span>标识符 </span></strong><strong style="color: blue;"><span style="color: black;"><span style="color: black;">类里面<span style="color: black;">增多</span>了</span>“<span style="color: black;">供应链<span style="color: black;">危害</span>管理</span>”</span></strong><strong style="color: blue;"><span style="color: black;">，本类<span style="color: black;">包含</span>5个子类</span></strong><span style="color: black;">：</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">ID.SC-1：网络供应链<span style="color: black;">危害</span>管理流程由组织利益<span style="color: black;">关联</span>者确定、<span style="color: black;">创立</span>、<span style="color: black;">评定</span>、管理和<span style="color: black;">准许</span></span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">ID.SC-2：<span style="color: black;">运用</span>网络供应链<span style="color: black;">危害</span><span style="color: black;">评定</span>过程来识别、优先排序和<span style="color: black;">评定</span>关键信息系统、组件和服务的供应商和合作伙伴</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">ID.SC-3：合同<span style="color: black;">需求</span>供应商和合作伙伴实施适当<span style="color: black;">办法</span>，旨在实现信息安全计划或网络供应链<span style="color: black;">危害</span>管理计划<span style="color: black;">目的</span>。</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">ID.SC-4：监测供应商和合作伙伴，以确认<span style="color: black;">她们</span>履行了所需的义务。对审查的记录，测试结果摘要或对供应商<span style="color: black;">/</span><span style="color: black;">供给</span>商的其他同等材料进行审核。</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">ID.SC-5：对关键供应商<span style="color: black;">/</span><span style="color: black;">供给</span>商进行响应和恢复计划和测试。</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">3、</span>对鉴别、授权和身份证明的优化</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">本框架中第三大变化<span style="color: black;">便是</span>对“附录<span style="color: black;">A</span>框架核心”的<span style="color: black;">拜访</span><span style="color: black;">掌控</span>类进行了细化和<span style="color: black;">增多</span>，将资产<span style="color: black;">知道</span>为了<span style="color: black;">理学</span>和<span style="color: black;">规律</span>资产，并且<span style="color: black;">需求</span>与未经授权<span style="color: black;">拜访</span>授权活动和交易的<span style="color: black;">评定</span><span style="color: black;">危害</span>相一致进行管理。除此之外还<span style="color: black;">增多</span>了<span style="color: black;">PR.AC-6</span>身份证明的内容。表三中总结出了<span style="color: black;">V1.0</span>版本和<span style="color: black;">V1.1</span>版本中<span style="color: black;">拜访</span><span style="color: black;">掌控</span>类的<span style="color: black;">关联</span>内容，表中标黑的内容为<span style="color: black;">V1.1</span>较<span style="color: black;">V1.0</span>更新的内容，<span style="color: black;">仔细</span>内容如下表所示：</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">表三 框架核心中的<span style="color: black;">拜访</span><span style="color: black;">掌控</span>类</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">功能</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">类</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">子类</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">守护</span>（<span style="color: black;">PR</span>）</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">V1.0</span></strong><span style="color: black;">&nbsp;<span style="color: black;">拜访</span><span style="color: black;">掌控</span>（<span style="color: black;">PR.AC</span>）：对资产和<span style="color: black;">关联</span><span style="color: black;">设备</span>的<span style="color: black;">拜访</span>仅限于授权用户、过程或设备以及授权的活动和交易。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">V1.1</span></strong><span style="color: black;">&nbsp;身份管理<span style="color: black;">.</span>鉴别和<span style="color: black;">拜访</span><span style="color: black;">掌控</span>（<span style="color: black;">PR.AC</span>）<span style="color: black;">: </span>对</span><strong style="color: blue;"><span style="color: black;"><span style="color: black;">理学</span>和<span style="color: black;">规律</span></span></strong><span style="color: black;">资产和<span style="color: black;">关联</span>设施的<span style="color: black;">拜访</span>仅限于授权用户、过程和设备，并且</span><strong style="color: blue;"><span style="color: black;">与未经授权<span style="color: black;">拜访</span>授权活动和交易的<span style="color: black;">评定</span><span style="color: black;">危害</span>相一致进行管理</span></strong><span style="color: black;">。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">V1.0</span></strong><span style="color: black;">&nbsp;PR.AC-1:为授权的设备和用户管理身份和证书。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">V1.1 </span></strong><span style="color: black;">PR.AC-1:为授权的设备、用户和</span><strong style="color: blue;"><span style="color: black;">过程发布、</span></strong><span style="color: black;">管理、</span><strong style="color: blue;"><span style="color: black;">验证、撤销和审计</span></strong><span style="color: black;">身份和证书。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0 PR.AC-2:对资产的<span style="color: black;">理学</span><span style="color: black;">拜访</span>进行管理和<span style="color: black;">守护</span>。 </span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.1 <span style="color: black;">无</span>变化</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0 PR.AC-3:管理远程<span style="color: black;">拜访</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.1 <span style="color: black;">无</span>变化</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0 PR.AC-4:结合最小特权和职责分离的原则管理<span style="color: black;">拜访</span>许可。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.1 PR.AC-4: 结合最小特权和职责分离的原则管理<span style="color: black;">拜访</span>许可和</span><strong style="color: blue;"><span style="color: black;">授权</span></strong><span style="color: black;">。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0 PR.AC-5: <span style="color: black;">守护</span>网络完整性，在适当<span style="color: black;">状况</span>下<span style="color: black;">包含</span>网络隔离。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.1 <span style="color: black;">无</span>变化</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.1 </span><strong style="color: blue;"><span style="color: black;">新增</span></strong><span style="color: black;">PR.AC-6: 证明身份并将身份绑定到证书上，并在适当的交互中声<span style="color: black;">叫作</span>身份。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">4、</span>更好地解释了执行等级和轮廓之间的关系</strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">框架的第四大变化<span style="color: black;">便是</span>在“<span style="color: black;">3.2</span><span style="color: black;">创立</span>或改进网络安全<span style="color: black;">方法</span>”中<span style="color: black;">增多</span>了在框架实施过程中<span style="color: black;">运用</span>框架的执行等级的描述。为框架的执行等级<span style="color: black;">增多</span>描述以反映<span style="color: black;">公司</span>在安全框架中整合<span style="color: black;">危害</span>管理的<span style="color: black;">方法</span>。下文标黑的部分是<span style="color: black;">创立</span>或改进网络安全<span style="color: black;">方法</span>的<span style="color: black;">7</span>个<span style="color: black;">过程</span>中更新的内容：</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>1：确定优先级和范围</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">增添的内容：执行等级可用于<span style="color: black;">暗示</span><span style="color: black;">区别</span>的<span style="color: black;">危害</span>界值。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>2：确定方向</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0：接下来，<span style="color: black;">公司</span>识别这些系统和资产面临的威胁和所存在的脆弱性。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">V1.1：接下来，<span style="color: black;">公司</span></span><strong style="color: blue;"><span style="color: black;">咨询<span style="color: black;">源自</span>用来确定<span style="color: black;">针对</span></span></strong><span style="color: black;">这些系统和资产可被利用的威胁和漏洞。</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>3：创建当前轮廓</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">增添的内容：<span style="color: black;">倘若</span>实现了部分地结果，<span style="color: black;">重视</span>到这一事实将有助于支持后续<span style="color: black;">过程</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>4：进行一次<span style="color: black;">危害</span><span style="color: black;">评估</span></span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">V1.0：重要的是，<span style="color: black;">公司</span>应该寻求用最新<span style="color: black;">危害</span>、威胁和脆弱性数据来促进对网络安全事件<span style="color: black;">出现</span>可能性和影响的透彻<span style="color: black;">认识</span>。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">V1.1：</span><span style="color: black;">重要的是，<span style="color: black;">公司</span></span><strong style="color: blue;"><span style="color: black;">识别</span></strong><span style="color: black;">新兴<span style="color: black;">危害</span>，</span><strong style="color: blue;"><span style="color: black;">并<span style="color: black;">运用</span>来自内部和<span style="color: black;">外边</span><span style="color: black;">源自</span>的网络威胁信息，以便更好地<span style="color: black;">认识</span>网络安全事件的可能性和影响。</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>5：创建一个<span style="color: black;">目的</span>轮廓</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">增添的内容：当与执行等级<span style="color: black;">一块</span><span style="color: black;">运用</span>时，等级水平的特征应反映在所需的网络安全结果中。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">过程</span>6：确定、分析和按优先级<span style="color: black;">摆列</span>差距</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">增添的内容：利用任务驱动程序，成本/收益分析和<span style="color: black;">危害</span>理解 <span style="color: black;">- </span>实现<span style="color: black;">目的</span>轮廓中的结果。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">以上内容是<span style="color: black;">评定</span>中心技术部对框架V1.1草案更新内容的总结以及翻译，供<span style="color: black;">大众</span>参考，如若想阅读框架英文原文，请参考链接：</span></strong><strong style="color: blue;"><span style="color: black;">https://www.nist.gov/sites/default/files/documents////draft-cybersecurity-framework-v1.11.pdf</span></strong><strong style="color: blue;"><span style="color: black;">。</span></strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;">译者：公安部信息安全等级<span style="color: black;">守护</span><span style="color: black;">评定</span>中心 &nbsp;王然</strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">▲向上滑动</p>
    <img src="http://mmbiz.qpic.cn/mmbiz_png/Z461zsU9BNFRfsNux5T0ib5E6jhqW4b9ic8rNxHheCZov77XKkPG22wybHwbffuObZe9rIo7uBHKUyA6ZiaT1WFzg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">安全测评联盟</p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">更加多</span>关于安全测评<span style="color: black;">新闻</span></p>

    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;">长按右方二维码</strong></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;">关注<span style="color: black;">咱们</span>ˉ►</strong></p><img src="http://mmbiz.qpic.cn/mmbiz_jpg/Z461zsU9BNFRfsNux5T0ib5E6jhqW4b9icVTlic3Aq6eCkUSNBSrq5QTIcHvx4MBRMZ6I2Oky3akvXbrJ9fRiaP0ibw/640?wx_fmt=jpeg&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">

18128071341 发表于 2024-9-8 01:42:37

论坛的成功是建立在我们诚恳、务实、高效、创新和团结合作基础上，我们要把这种精神传递下去。

流星的美 发表于 2024-9-10 12:49:16

我完全同意你的看法，期待我们能深入探讨这个问题。

qzmjef 发表于 4 天前

这夸赞甜到心里，让我感觉温暖无比。

7wu1wm0 发表于 4 天前

这篇文章真的让我受益匪浅，外链发布感谢分享！

查看完整版本: 美国网络安全框架更新内容分析