NSTISSC: National Security Telecommunications and Information System Security Committee 2. NSTISSI: National Security Telecommunications and In

Size: px

Start display at page:

Download "NSTISSC: National Security Telecommunications and Information System Security Committee 2. NSTISSI: National Security Telecommunications and In"

病施
7 years ago
Views:

1 (Office of Management and Budget OMB)2000 (National Institute of Standards and Technology NIST) OMB 1. (Audit) 2. (Certification and Accreditation) 3. (Common Criteria) 4. (Framework) 5. (Information Assurance) 6. (Standard) Information Technology IT Certification and Accreditation C&A National Institute of Standards and Technology NIST 4 IT C&A IT IT 够 1 1. IT 2. IT 3. 够决 C&A 够 IT IT Federal Information Process Standard FIPS NIST C&A SP International Organization for Standardization ISO ISO/IEC TR

(Standard) Information Technology IT Certification and Accreditation C&A National Institute of Standards and Technology NIST 4 IT C&A IT IT 够

2 NSTISSC: National Security Telecommunications and Information System Security Committee 2. NSTISSI: National Security Telecommunications and Information System Security Instruction 3. NSTISS NSTISSI No

3 1.3 IT ~ Office of Management and Budget OMB 3~5 C&A 够 OMB 够 1. IT 2. IT 够决减 IT 撑 - 37-

4 况 IT 5 NIST 6 NIST IT IT 63 7 (National Security Agency NSA) OMB 减 OMB M IT IT 4 5 够强决 OMB OMB2000~ ~2.6 IT 2.2 (Information Technology IT) (Federal Information Security Management Act FISMA) IT - 38-

4 2000 2 28 OMB M00-07 1 2 3 4 5 2.1 IT IT 4 5 够强决 OMB 2000 1.

5 2.3 (Information Technology IT) (Security Cost) 1 ( ) (Inspector General IG) (Office of Management and Budget OMB) (Review) (Check) 2 IT (Privacy) (Program) (Security Program ) 1 1 (General Support System) (Major Application) 2 OMB DoC(NIST) GSA OPM IT DoC: Department of Commerce 3.2 GSACeneral Services Administration 3.3 OMBOffice of Management and Budget 3.4 OPMOffice of Personal Management 3.5 NISTNational Institute of Standards and Technology - 39-

4 (Security Program ) 1 1 (General Support System) (Major Application) 2 OMB DoC(NIST) GSA OPM 2.1 2.2 IT 2.3 2.4 3 3.

6 2.5 (Plam of Action and Milestone POA&M) (Plan of Action and Milestone POA&M) POA&M POA&M 2.6 (Program Review) (Federal Information Security Management Act FISMA) (Office of Management and Budget OMB) 撑 IT IT 够 OMB 够 1. IT 2. 够决减 IT 况 NIST SP IT NIST SP IT 4 3 OMBA-130 PDD-63 NIST SP ~

7 ~ F 36 F 31 F 56 F 70.5 C- 52 F 22 F 72 C C- 68 D+ 51 F 72 C- * 65.5 D 38 F 40 F 69 D+ 77 C+ 66 D 33 F 75 C 59.5 F 41 F 51 F 74.5 C 63 D- 69 D+ 64 D 65 D 64 D 66 D 61 D- 衆 54 F 61 D- 43 F 58 F 34 F F 48 F 66 D 73 C- 43 F 37 F 48 F 17 F 55.5 F 56 F 50 F 52 F 86.5 B 79 C+ 56 F 38 F 60.5 D- 68 D+ 70 C- 60 D A 74 C 34 F 90.5 A- 63 D- 87 B+ 80 B D- 52 F 39 F 59 F 71 C- 48 F 48 F 55 F 88 B+ 82 B- 79 C+ 86 B 39.5 F 54 F 69 D+ 75 C 69 D+ 28 F 48 F * 64 D 48 F 54 F 65 D * 76.5 C 50 F 44 F 65 D 65 D 55 F 53 F D- 1. (Office of Management and Budget OMB) 况 OMB 100OMB 0 29% 30%44%45%59% 90%100% A=90~ B=80~ C=70~ D=60~ E=0~ Clinger Cohen Act Government Information Security Reform Act OMB A Federal Information Security Management Act (Title III ) OMB M

5 A 74 C 34 F 90.5 A- 63 D- 87 B+ 80 B- 61.5 D- 52 F 39 F 59 F 71 C- 48 F 48 F 55 F 88 B+ 82 B- 79 C+ 86 B 39.5 F 54 F 69 D+ 75 C 69 D+ 28 F 48 F * 64 D 48 F 54 F 65 D * 76.

8 OMB IT Token IT IT (IT) (PP) PPs (CC) NIAP CCEVS NIST CMVP FIPS IT Katzke, S.(2003) Protecting Federal Information Systems and Networks, In resentation of the 4 th International Common Criteria Conference, Sept. 7~9, 2003, Stockholm, Sweden

11 - 45 -

12 - 46 -

13 - 47 -

14 IT IT 10 IT IT OMBA-130 幷决 OMB A-130 够够强 IT OMB A-130 IT NIST SP IT SP IT 11 IT 啓 IT IT 够 IT IT 2002 IT

15 IT NIST 啓 12~ IT 3. 够 C&A 1. IT 2. IT 决 3. IT IT NIST SP IT IT IA-CMM8 3 C&A IT NIST SP C&A IT C&A C&A NIST FIPS IT System Development Life Cycle SDLC NIST SP C&A IT IT 靭够 C&A IT C&A C&A IT IT Commercial off the shelf COST WEB IT C&A IT ISO/IEC

NIST FIPS IT System Development Life Cycle SDLC 1. 2. 3. 4. 5.

16 FIPS C&A 11 NIST C&A C&A IT IT C&A IT IT ommon eritera ISO C&A 3.6~ IT

17 NIST SP NIST SP ISO/IEC ISO/IEC ISO/IEC (ISO/IEC ) ISO/IEC ISO/IEC ISO/IEC ISO/IEC ISO/IEC

13335-1 ) ISO/IEC 13335-1 ISO/IEC 13335-1

18 - 52 -

19 (Flow Hypothesis) ISO/IEC 2nd WD 19791: ( ) (System Security Target, SST)

20 Target of Evaluation TOE Protection Profile PP / SST / SST \ / / SST C&A Outreach Katzke, S ~9 4 ISO/IEC C&A ~ C&A Simple and Smart C&A ISO/IEC

2003 9 7~9 4 ISO/IEC 19791 C&A 11 3.1~3.3 3.

21 U.S. $1,000,000 U.S. $10,000,000 U.S. $10,000,000 C&A ISO 2000 C&A 2005 C&A IT C&A C&A 1 12 C&A ISO

23 1NIST (2003) Standards for Security Categorization of Federal Information and Information Systems, PUB (Publication) 199, NIST 2ISO (2003) Text for ISO/IEC 2 nd WD 19791, Information technology-security techniques-security assessment for operational systems, ISO/IEC JTC1/SC27 N OMB (2000) OMB Circular No. A-130, Appendix III, Revised, November 30, NIST (2000) Federal Information Technology Security Assessment Framework, November 28, 2000, NIST 5OMB (2003) OMB M-03-19, August 6, Swanson, M. (2001) Security Self-Assessment Guide for Information Technology Systems, NIST Special Publication , NIST 7The White House (1998) The Clinton Administration s Policy on Critical Infrastructure Protection: Presidential Decision Directive 63(PPD-63), May 22, NSA (2003) INFOSEC Assurance Capability Maturity Model (IA-CMM), Version 3.0, October 2003, NSA 9The White House (2002) Federal Information Security Act, December 17, Swanson, M. (1998) Guide for Developing Security Plans for Information Technology Systems, NIST Special Publication , December 1998, NIST 11Stoneburner, G., A. Goguen and A. Feringa (2004) Risk Management Guide for Information Technology Systems (Draft), NIST Special Publication Revise A., January 2004, NIST 12Ross, R. and M. Swanson (2002) Guidelines for the Security Certification and Accreditation of Federal Information Technology System, (Initial Public Draft) NIST Special Publication , October 2002, NIST 13CNSS (Committee on National Security System) (2003) NSTISSP (National Security Telecommunications and Information Systems Security Policy) No.11, Revised Fact Sheet, July Katzke, S. (2003) Protection Federal Information Systems and Network, in Presentation of the 4 th International Common Criteria Conference, September 7~9, 2003, Stockholm, Sweden 15ISO (1999) Information technology- Security techniques- Evaluation criteria for IT security (all parts), ISO/IEC http:// (2004/04/02) 17 Hamilton, B.A. (2002) Depart of Defense Public Key Infrastructure and Key Management Infrastructure Token Protection Profile (Medium Robustness), NSA (National Security Agency)

24 - 58 -

資訊安全管理系統建置初始工作的研究

資訊安全管理系統建置初始工作的研究 43 * ** *** *** * ** *** ISO 9000 ISO 14000 A Study on the Implementation of Information Security Management Systems Abstract During the 90's, global civilization went through a great change. Quality of