国际

新版ISO／IEC27001：2013正式发布 备受关注的新版信息安全管理体系标准——ISO／IEC27001：2013（《信息安全——安全技术——信息安全管理体系一要求》已正式发布,     

2011版《职业健康安全管理体系要求》的换版背景和实施要求

新版GB／T28001—2011《职业健康安全管理体系要求》国家标准于2012年2月1日开始实施。根据国家认监委的要求,自2013年1月1日起,认证机构不再颁发原2001版标准认证证书。2014年1月1日前,已经获得的职业健康安全管理体系认证证书全部要转化到2011版。这意味着,今明两年“证书转换”将是职业健康安全管理体系认证工作的一个重点。本期特推出“新版职业健康安全管理体系国家标准的理解与实施”专题,从新版标准的背景、实施要求以及与上版标准的差异等方面进行了介绍,以便企业理解其中几个最重要的变化,顺利完成换版工作。     

质量、环境、职业健康安全管理体系整合培训课程

为帮助各企业及时掌握新版ISO9001:2008标准的内容,了解国际认证行业发展的最新趋势,方圆标志认证集团有限公司(CQM)推出2008版ISO 9000质量管理体系、ISO14000环境管理体系、OHSMS18000职业健康安全(新版)管理体系整合管代研讨暨内审员提高培训课程。     

信息安全管理体系标准化概述

信息安全管理体系简称(ISMS),ISMS认证所依据的ISO/IEC27001:2005现在已等同转化为国家标准。本文将介绍ISMS标准的发展历程、标准族的框架结构以及在我国各行业的实施情况。一、信息安全管理体系标准化发展过程     

质量管理体系文件如何向2000版标准转换

一、转换综述现有质量管理体系文件向新版标准过渡 ,可分三个步骤 :1.0　根据 2 0 0 0版ＩＳＯ90 0 1标准相关条款中新增或变化的要求 ,在现有程序中更新相关内容 ;2 .0　根据新版标准增加的条款 (要素 ) ,编制新的程序文件 ;3 .0　增设“管理职责 ,资源管理 ,产品实现 ,测量、分析和改进”四个“主程序” ,对上述程序文件未能涵盖的新版标准内容进行描述 ,同时给出查询所有现有程序文件的途径。四个主程序也可直接作为质量手册中质量体系要素描述部分的内容。 (即对质量管理体系所包括的过程顺序和相互作用的描述 )在以上三个步骤的基础上 …     

国际

新版ISO 27001预计10月公布现行的信息安全管理体系ISO 27001:2005标准已经使用了8年,日前ISO组织(国际标准化组织)发布了新版ISO 27001:2013 DIS版(国际标准草案Draft International Standard)草稿并征求意见,预计在今年6至7月发布DIS最终版。目前,ISO组织公     

ISO／IEC致力于强化信息安全管理体系

为了更好地指导ISO／IEC27001：2005《信息安全管理体系-基本要求》的设计和实施,新的标准ISO／IEC27003：2010《信息技术——安全技术——信息安全管理体系实施指南》于近日发布实施。该标准广泛适用于各类具有安全意识的组织机构,不论其规模、复杂程度和风险大小。     

一批行业标准有望今年陆续发布实施

<正>新版ISO9001标准今年9月推出伴随着日前在爱尔兰高威召开的第6次ISO9001修订工作会落下帷幕,全球应用范围最广的质量管理体系标准ISO9001的第4次"升级",完成对各成员国最后一次意见征集,开始形成最终国际标准草案(FDIS版)。按照计划,新版ISO9001国际标准将于2015年9月份正式发布。作为全球最具影响力的质量管理体系标准,ISO9001自1987年问世以来,先后在1994年、2000年、2008年经历了3次改版"升级"。根据ISO2013年11月发布的统计数据,     

ISO/CD 9001:2005 标准结构与章节要求简

描述新版ISO/CD 9001标准结构和章节特点,并着重分析依据过程模式编写的新版ISO/CD 9001的关注点,以及后续获证组织进行标准换版和管理体系整合时应重点关注的过程风险和过程绩效。     

浅谈企业如何应用ISO9001:2015标准中的新要求

随着ISO9001:2015版的正式发布,大部分公司和组织开始着手进行质量管理体系的转版,由于新版标准的架构完全不同于2008版,并且增加了"基于风险的思维"等新内容,如何进行转版才能符合ISO9001:2015标准,是每个企业面临的问题。笔者就在以本企业从事转版工作的经验浅谈一下个人对于企业质量管理体系转版方面的认识。     

Design of an Information Security Service for Medical Artificial Intelligence

The medical convergence industry has gradually adopted ICT devices, which has led to legacy security problems related to ICT devices. However, it has been difficult to solve these problems due to data resource issues. Such problems can cause a lack of reliability in medical artificial intelligence services that utilize medical information. Therefore, to provide reliable services focused on security internalization, it is necessary to establish a medical convergence environment-oriented security management system. This study proposes the use of system identification and countermeasures to secure system reliability when using medical convergence environment information in medical artificial intelligence. We checked the life cycle of medical information and the flow and location of information, analyzed the security threats that may arise during the life cycle, and proposed technical countermeasures to overcome such threats. We verified the proposed countermeasures through a survey of experts. Security requirements were defined based on the information life cycle in the medical convergence environment. We also designed technical countermeasures for use in the security management systems of hospitals of diverse sizes.     

基于开放性信息平台的能源管理信息系统研制

在介绍现代通信技术、智能测控技术、自动控制技术等领域最新成果的基础上,采用自主研发的基于SWCC协议的开放接入信息平台,运用ZigBee无线传感器网络实现信息的传递,有效解决了不同厂家、不同接口监测设备的信息接入问题.使用嵌入式系统数据存储方法,在提供Web互联网服务的同时,消除了系统数据存储过程的安全隐患.遵循实用性、可扩展性、开放性、标准性、规范性、专业性和经济性的系统设计原则,进行了卷烟企业动力能源信息管理系统的研制.     

蓝牙信息安全与密钥管理研究

从信号安全的角度出发，研究了蓝牙信息传输中的安全模式，对蓝牙技术的密钥管理方法等进行了分析，并提出了作者的评价意见。     

Comprehensive Information Security Evaluation Model Based on Multi-Level Decomposition Feedback for IoT

The development of the Internet of Things (IoT) calls for a comprehensive information security evaluation framework to quantitatively measure the safety score and risk (S&R) value of the network urgently. In this paper, we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback. The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection. Firstly, we establish an overall evaluation indicator system that includes four primary indicators of threat information, asset, vulnerability, and management, respectively. It also includes eleven secondary indicators of system protection rate, attack detection rate, confidentiality, availability, controllability, identifiability, number of vulnerabilities, vulnerability hazard level, staff organization, enterprise grading and service continuity, respectively. Then, we build the core algorithm to enable the evaluation model, wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value. Moreover, in order to better supervise the performance of the proposed evaluation model, we present four novel indicators includes residual risk, continuous conformity of residual risk, head-to-tail consistency and decrease ratio, respectively. Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.     

民用爆破器材有序化管理信息系统的研制

文章采用VB程序语言结合SQL Server2005数据库系统,开发研制出民爆器材有序化信息管理系统.本信息系统分为前台销售管理和后台库房管理两个子系统,实现了民爆器材的销售管理、入库管理、查询管理以及库存管理包括器材超期警告等诸多功能,并考虑到面向网络安全性问题.系统界面设计比较科学、操作便捷,适合于在民爆企业中推广.     

Blockchain Technology Based Information Classification Management Service

Hyper-connectivity in Industry 4.0 has resulted in not only a rapid increase in the amount of information, but also the expansion of areas and assets to be protected. In terms of information security, it has led to an enormous economic cost due to the various and numerous security solutions used in protecting the increased assets. Also, it has caused difficulties in managing those issues due to reasons such as mutual interference, countless security events and logs’ data, etc. Within this security environment, an organization should identify and classify assets based on the value of data and their security perspective, and then apply appropriate protection measures according to the assets’ security classification for effective security management. But there are still difficulties stemming from the need to manage numerous security solutions in order to protect the classified assets. In this paper, we propose an information classification management service based on blockchain, which presents and uses a model of the value of data and the security perspective. It records transactions of classifying assets and managing assets by each class in a distributed ledger of blockchain. The proposed service reduces assets to be protected and security solutions to be applied, and provides security measures at the platform level rather than individual security solutions, by using blockchain. In the rapidly changing security environment of Industry 4.0, this proposed service enables economic security, provides a new integrated security platform, and demonstrates service value.     

The Routine and Emergency Coordinated Management of Public Security

The paper presents a study based on the observation of public security programme situations.Nowadays, public security management is faced with challenges such as the increase in non-traditional safety threats, high occurrence probability, obvious complex chain reactions, high security demand, vulnerable bearing systems and world-wide influences. For the new adapted requirements of public security management, this paper puts forward the concept of the coordinated routine and emergency management, which combines the routine management at normal status and the emergency management at the abnormal status based on the whole process of public security management. This paper analyzes the coordinated management system and establishes the decision-making objectives, decision-making model and constraints. In addition, this paper proposes the basic strategy of achieving the coordinated management of public security.     

浅析湖北信息安全标准化战略实施

本文阐述了信息安全标准化战略的实施对社会发展的推进作用.通过分析湖北省信息安全与标准化战略的关系,初步探讨湖北信息安全的标准化体系建立与战略实施.旨在利用标准化手段促进湖北省信息安全与社会同步发展.     

浅谈保密管理体系标准化流程的建立——航天一院十四所保密管理体系的创建与应用

将GB／T19001质量管理体系与GB／T28001安全管理体系的管理理论、运行模式与武器装备科研生产单位保密资格标准有机结合,构建以适应十四所科研生产、经营开发、改革发展需要的科学、有效的保密管理体系的标准化流程,为十四所发展战略目标的实现提供坚实的保障。     

Internet/Intranet信息安全系统的设计及实现

介绍了Ｉｎｔｅｒｎｅｔ／Ｉｎｔｒａｎｅｔ信息安全系统的主要安全服务机制，分析了身份认证，数据加密，数字签名，信息认证的工作原理和安全性能，同时说明了该系统在Ｉｎｔｅｒｎｅｔ／Ｉｎｔｒａｎｅｔ网络环境中的适用性和技术特点。