Three power separation-based information security management system and information security management method

Abstract

The invention discloses a three power separation-based information security management system which comprises a system management subsystem, a security management subsystem and an auditing management subsystem, wherein the system management subsystem manages system subject resources and system object resources to generate and send a first auditing record to the auditing management subsystem, the security management subsystem uniformly marks the system subject / object resources and authorizes the system subject and manages the security policy and distributive security mechanism of the system to generate and send a second auditing record to the auditing management subsystem, the auditing management subsystem centrally manages the security auditing policy and mechanism distributed in all components of the system, and the auditing management subsystem receives and manages the first and second auditing record and generates the system auditing record. Therefore, the information security management system is distinguished as the decentralized management of the three subsystems, the management authority of the subsystems is distributed, mutual authority restriction relationship is formed among the subsystems, and the information security and management reliability can be improved.

Description

【Technical field】 [0001] The invention relates to the field of computer information security, in particular to an information security management system based on the separation of three powers and an information security management method based on the information security management system. 【Background technique】 [0002] The security management of information system in the construction of informatization has aroused great attention of the country. Information system security management is not just a matter of management system and technology, but an organic collection of strategy, management and technology. Comprehensively constructing and standardizing information security from the height of security management system will effectively guarantee the security of my country's information system. [0003] Strict information system security management is the basic guarantee for system security functions to achieve security goals during operation. However, in today's informati...

AI Technical Summary

Problems solved by technology

However, in today's information management operating system, the authority of administrators is paramount, so once their behavior is untrustworthy, or they make mistakes in system configuration or formulation of security policies, it is easy to form security holes and be exploited , leading to information security incidents

Images