基于度量学的认证认可方法研究

IT系统在生命期中运行、应用和连接时一般要经历持续的改变。而很多变化只有在三年一度的C＆A过程中才能捕获到;这将增加系统风险的暴露。通过结构化、循序渐进的方法,提高安全度量标准,优化风险评估过程,改进认证认可方法。

A approach research to certification and accreditation metrics-based

IT systems typically undergo extensive changes in operating system, applications, and connectivity during a lifecycle. Many of these changes are not captured until the triennial C&A is accomplished; this may lead to increased system risk exposure. Improvements to the C&A process could be achieved through a structured, evolutionary approach and then improves security metrics standard, optimizes the risk assessment process and improves the methods of certification and accreditation.