某涉密企业内网安全管理策略的研究

【作者】 向波；

【导师】 郝玉洁；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2010， 硕士

【摘要】 在企业加速其信息化建设的进程中,其网络面临的新安全威胁和网络管理的复杂性也不断增长。在这种形势下,很多企业部署了防火墙,入侵检测系统等网络安全产品来保障其网络的边界安全。然而,据有关权威组织统计,约有80%的安全威胁来自内部网络中众多的桌面终端.由于网络犯罪的更加智能化和防范意识不足,桌面终端已经成为网络安全管理的瓶颈和网络攻击的弱点。攻击还包括员工的故意或非故意的上网行为使得敏感信息在存储,传输和访问控制过程中承受巨大的外泄风险。为应对这些威胁带来无法预测的后果的挑战,我们应该对内网管理策略加以重视。为了对企业的内网安全进行管理,应该从网络准入控制,对桌面终端加固,规范员工上网行为和防止敏感信息外泄等方面着手。本文作者结合该涉密企业的网络安全现状及需求分析,为了实现对该企业内部网络中员工的上网行为进行实时监控和规范,设计并实现了C/S和B/S架构的网络行为监控系统,并对这两个监控系统的系统设计和各个功能模块的实现技术加以分析。在该企业内网中部署以上两个监控系统的基础上,本文提出了集中式安全管理策略以帮助企业内网系统的实现和管理。该策略从以下方面着手,对终端实施准入控制,对终端进行加固,对员工上网行为实施实时监控和审计,以及对内网资源和员工上网行为进行集中管理。在该企业现有网络系统的基础上,我们有选择性的部署了一些应对新威胁的安全设备。集中式安全管理策略以对员工的管理为核心,从员工进入网络开始,进而对其在内部网络中的行为进行监控和审计,以及事后对有违规使用终端的员工的进行定位和处理,实现了流程式的管理。经检验,这两个监控系统在该企业网络中运行良好。保证了对敏感信息的使用者身份的鉴别,以及对敏感信息的存储和传输过程中的访问控制。同时,减轻了网络安全管理人员的工作负担,帮助企业上网的规章制度的实施。更多还原

【Abstract】 Along with the enterprise informationization construction acceleration, the new security threat and the complexity of network management also continue to increase. In this circumstance, firewall, IDS and other network security products have been deployed in enterprises, border security is assured. However,according to statistics about 80% security threat comes from intarnet,especially from local desktops.Due to shortage of precaution sense and enhanced intelligent of network crime,staff’s desktops have already been a bottleneck of network security, weakness point of guarding against network attack. The attack and staff’s online behaviors deliberately or not bring an unparalleled threat to information’s storage,transmission and access control.Therefore intranet security management policies should be emphasized, so that such challenges, together with their undesired consequences can be avoided. In order to protect the enterprise intranet security, network admission control, intranet behavior standardizing,desktop consolidation, and the sensitivity of the information revelation preventing need to be enforced.In the light of the security demand analysis of the enterprise intranet, to standardize the intranet online behaviors,the C/S and B/S architecture network behavior supervision systems were proposed,and the designing and compositions of these two systems were introduced. On the ground of the deployment of these two monitoring systems, centralized security management strategy is proposed in this thesis; this strategy helps the enterprise’s intranet implementation and management.This strategy emphasizes on network admission controlling,desktop consolidation,behaviors monitoring and audit,as well as intranet resources and staff’s online behaviors centrally-managing. Suitable security protection tools from the available tools are chosen and deployed,they are an addition to the existing system. Therefor, the network security system is more effective when facing new security challenges. Centralized security management strategy emphasize on the staff’s online behaviors. First of all, network accession control is enforced, secondly online behaviors is real-time monitored and audited,finally the desktop is positioned and handled when the staff’s illegal operations occur.The tests prove that those two prototype systems have been applied to network security monitoring successfully. The privilege for accessing confidential device and information, the information storage and transmitting are guaranteed. At the same time,the workload of network security management staff is lowered and regulatory compliance of this enterprise is maintained.更多还原