Information System Security Assurance Evaluation Based On Capability Maturity Model

With the highly developing of information system, information security problems become more serious and information system security evaluation become more important than before. In order to solve information system security assurance evaluation, China Information Technology Security Evaluation Center provided an Information System Security Assurance Evaluation Framework. But these standards have some problem on enforceability, on this paper research evaluation method based on those standards, in order to solve the problems. At last, designs and implements the platform about information system security assurance evaluation based on capability maturity model.First, this paper under the guidance of Information System Security Assurance Evaluation Framework combined with Evaluation criteria for IT security and other related contents, provided information system safety architecture class, capability maturity class about management assurance and engineering assurance.Second, based on research, built the safety cases, about Information System Security Assurance Evaluation Framework, like assurance cases and testing cases, in order to evaluate capability maturity about information system security assurance.Finally, address information system security capability maturity assessment, this paper particularly analyzes the ideas and basic principles, building the platform about information system security assurance evaluation based on capability maturity.This paper aimed to improve the information system security assessment process operability, and the establishment of evaluation platform to improve the assessment of the normative and efficiency.