TS. Chu Van Ve
NGHIEN CU\I - TRAO D 6 |May suy nghlve An toan thong tin
Trien khai Nghi flinh 132/NB-CP ngay 1 6 / 1 0 / 2 0 1 3 cua Chinh phO vg viec thanh lap Cue An toan Thong tin, ngay 9 / 9 / 2 0 1 4 Bp trudng Bp Thong tin va Truyen thong (Bp TT-TT) da l<y Quyet dinh so 1281/Qe-BTTTT quy djnh chCfc nang, nhiem vu, quyen han va co cau to chifc cija Cue An toan thong tin, chinh thiJc di/a Hnh vi/c An toan thong tin vao khuon khd quan ly nha nixdc mpt each chuyen nghiep, minh bach.
CRITICAL INFORMATION CHARACTERISTICS
INFORMATION STATES
t -
J>r to m^ h-z nl
SECURITY MEASURES
Hinh 1-Cosd cho mot mo hinh tong quat
An toan thong tin la gi?
Thdng tin luu trU (goi la dU lieu) tren cac san pham va he thdng thdng tin {goi la HTTT) la tai san dac biet cua mdt td chUe hay ca nhan, quyet dinh sU thanh bai trong hoat dpng cija ho. Vi vay "dU li&u" phai dUOc bao V? - giU bi mgt tuyet doi va khong bi thay ddi khi khdng duac phep. Trong khi cae san pham vS HTTT thuc hien eac chUc nang eua chiing, eac thong tin clin duoe kiem soat de dam bao chiing duoc bao ve ehdng lgi cae nguy CO, vi dy nhu viec phd bien va thay ddi thdng tin khdng mong mudn va trai phep, nguy cd mat mat thdng tin.
Theo Nghi dmh 64-2007/ND-CP: An toan thdng tin la an toan ky thugt cho cac hoat dpng cija cac co sd ha tang thong tin, trong do bao gom an toan phan cifng va ph^n mem theo eac tieu chuan ky thuat do nha nudc ban hanh; duy tri cac dgc tinh bi mat, toan ven, chinh xac, sin sang phuc vu cua thong tin trong luu trU, xi!f ly va fruyen tai tren mang. V^ thugt ngOan toan thong tin thUdng sijf dung di ehi viee ngan chgn va lam giam nhe cac mdi nguy hgi tuong tU ddi vdi cae san phim va HTTT.
Dam bao an toan thong tin la gi?
Muc tieu hudng tdi cua ngudi dung ia bao ve cac tai san noi tren. Tuy nhien, cac san phim va he thdng thudng ludn tdn tai nhUng diem ye'u dan den nhung riji ro co the xay ra, lam ton hgi den gia tn tai san thdng tin.
Cac ddi tuong tan cdng (tin tac) co ehu tam danh cap, loi dung hoae pha hoai tai san cila eae ehu s5 hUu, tim each khai ftiac cac diem yeu de tan cdng, tgo ra cac nguy cO va cae rui ro cho cac he thdng.
Vert eac bien phap an toan thdng hn ngUdi diing cd duoc cdng cu trong tay de nhgn thUe duoc cac diem yeu, giam thilu eae diem yeu, ngan chan cae nguy eO tan eong, lam giam cac yeu td rui ro. NhUvay, eae bien phap va ky thuat dam bao an toan thong tin chinh la mang Igi su tin eay eho cae san phim va he thdng. Dam bao an toan thong hn la dam bao an toan ky thuat cho hogt ddng cOa eac co s6 ha t^ng thong tin, trong dd bao gdm dam bao an toan cho ca phin cUng va ph^n mim hogt ddng theo cac Ijeu ehuan ky thuSt do nha nudc ban hanh;
ngan ngira kha nang loi dung mang va eac CO sd ha ting thdng tin de thuc hien cae hanh vi trai phep gay hai cho eong ddng.
phgm phap hay khung bd; dam bao cac tinh chat bi mat, toan vgn, chinh xac, sin sang phuc vu eiia thdng tin trong luu trU, -ds ly va truyin tai tren mang.
Nhu vay dam bao an toan thong tin bao gdm: dam bao an toan cho phan cifng (la bao dam hogt dpng cho co sd ha ting thdng tin) va phin mem (la hoat dpng quan ly, ky thuat nham bao ve he thdng thdng hn, dam bao dam cho cac he thdng tiiUc hien diing chUc nang, phuc vu diing ddi tUong mot each sin sang, chinh xac, hn cay). An toan eong nghe thdng tin la dam bao an toan ky ttiuat eho eac san pham, dich vu va HTTT.
Danh gia An toan thong tin la gi?
Oanh gia an toan thdng hn de biet cac san pham va HTTT: (1) eo tin eay hay khdng, mUc dp an toan nhu the nao?; (2) Cd ap dung bien phap, ky thuat an toan phii hop hay khdng?
Mue tieu danh gia miic dp an toan thdng tin la de dap Ung hai yeu eau noi tren, cung cap bang chUng ve dam bao an toan cho eae san pham va HTTT.
Nhidu ngudi diing khong dij kien thUc chuyen mon va tai nguyen can thiet de phan xet ve
TAP CHI TIN HOC NGAN HAfJG • s6 7(147) -10/2014 • 13
NGHIEN CUtJ • TRAO OOl
SU an toan cua cac san pham va HTTT cd phii hop hay khong, va eung khdng the chi dua vao cam ket cua cac nha cung cap (nha phat tnen he thdng). NgUdi diing e6 the nang eao dp tin cay trong cac bien phap an toan cua mpt san pham hoac HTTT bing each dat hang phan tich ve an toan cho chung, nghTa la danh gia an toan.
NhQng dac tinh cfl ban ciia Ihong tin
An toan thdng hn yeu clu dam bao 3 dae tinh quan trong nhat ciJa thdng hn, do la: Bi mat, Toan ven va Sin sang. Cac dae tinh nay bao trum toan bo pham trii an toan cac he thong thong tin. Cac 6$c dilm nay cung diing vdi moi to chUc, khdng le thupc vao viee chiing ehia se thdng hn nhu the nao.Tinh bi mat: Tinh bi mat la cdt ldi eua moi giai phap an toan eho mdt san pham/HTTT, mdt giai phap an toan la tap hop cac puy t i c xac dmh quyln dUpc truy cap den vdi thdng tin dang tim kiem, ddi vdi mdt sd lUOng ngUdi sCf dung thong hn nhat dmh va mdt sd lUOng thong hn la tai san nhit dmh. Trong trudng hop kiem soat truy cap cue bo, nhdm ngUdi truy cap se dUOc kilm soat xem la hp da truy cap nhung sd iieu nao. Tinh bi m^t la su dam bao eac chUc nang kiem soat truy cap ed hieu luc. Dam bao tinh bi mat la nham loai bo truy cap khdng dUOe phep vao cac khu vUc la ddc quyln cua cac td chifc, ca nhan.
Tinh toan ven
Tinh toan ven, khdng bi sijfa ddi la dac tinh phire hop nhit va d l bi hidu lim cua thdng hn. Mot dmh ngh[a khai quat hon dUOe sijr dung d trong tai lieu nay la van d l d p dd la chat lupng ciia sd lieu (thdng hn), chU khdng phai la con ngudi dupc/ hoae khdng duoe phep truy cap. Dac tinh toan ven dUOe hieu la chat luong cua thong hn duoc xac dinh can eU vao dd xac thuc khi phan anh thUc te. Sd lieu cang gin vdi thue te bao nhieu thi chit lUflng thdng hn cang ehuIn biy nhieu. Be dam bao tinh toan ven ciia thong tin la mot loat cac cac bien phap ddng bd nhim hd fro va dam bao tinh thdi su kip thdi va su diy dii trpn ven, cung nhu sU bao mat haply cho thdng hn.
Tinh sin sang
Tfnh san sang cua thdng hn cung la mpt dae tinh quan h-png, khdng khae gi cae dac tinh da d l cap den d. Dd la khia canh sdng eon cua an toan thdng hn, dam bao cho thdng tin den diing dia chi (ngudi dupc phep sif
dung) khi cd nhu cau, hogc duoc yeu cau.
Tinh san sang dam bao dp on dmh dang tin cay cua thong hn, cung nhu dam nhiem chUe nang la thudc do, xac dmh pham vi tdi hgn cua an toan mgt he thdng thdng hn.
Mo hinti fiam bao an toan thong tin
Bp ba cac dac tinh then chdt ciJa thong hn d l cap den d tren bao triim toan bd eac noi dung dam bao an toan thdng hn. Mdt ma fran duoc tao nen bdi 3 ydu td la 3 trang thai eua thdng tin (truyen dan, lUu giU, xCf II) dupe mmh hpa d true hoanh; ciing vdi 3 dae tinh then ehdt eua thdng tin (dd hn ciy, tinh toan ven, tinh san sang) difflc mmh hoa tren true tung ed thd dupe sCf dung lam nen tang eho md hinh the hien cac bien phap an toan thdng tin dUOc trinh bay trong pham vi tai lieu nay (xem hinh 1).Cac bien phap an toan he thong thdng tin phan loai thanh 3 ldp, tao thanh ehieu thU 3 cda khong gian ma tran nhu" sau:
a. Cae bien phap cdng nghe. bao ham tat ca cac bien phap thidt bi phin cUng, cac phin m i m , phin sun (firmware) cDng nhu cac ky thuat cdng nghe hen quan dupc ap dung nhim dam cac yeu c l u an toan eua thdng tin trong cae trang thai ciJa nd nhu da ke tren.
b. Cac bien phap v l td chifc: dua ra cac chinh sach, quy djnh, phuong thtfc thue thi.
Thue te eho thay, an toan thdng tin khdng chi don thuin la van d l thudc pham trii cdng nghe, ky thuat He thdng chinh saeh va kien ti-tic td chUc ddng mdt vai tro hOu hieu trong viec dam bao an toan thdng hn.
c. Cac bien phap v l dao tao, tap huin, nang eao nhan thUe: Cac bien phap cdng nghe hay eac bien phap v l td chUc thich hop phai dua tren cac bien phap dao tao, tap huan va tang cudng nhan thifc de cd the tnen khai dam bao an toan thdng tin tU nhilu hudng khac nhau. Cac nha nghien cUu va cac ky sU eung cin phai hieu rd cac nguyen ly an toan he thdng thdng tin, thi mdi mong eae san pham va he thdng do ho lam ra dap ifng duoc cac nhu c l u v l an toan thdng hn cua cupe sdng hien tgi dat ra.
Md hinh ma tran khdng gian 3 chilu ke tren cd the ap dung iam co sd cho danh gia an toan thdng tin mot each khai quat nhit. Vi du, ngudi danh gia an toan thdng hn eho mdt san phim la mdt he thdng thdng tin se phai xac dinh cac trang thai thdng hn trong he
thdng ein dUOC danh gia. Mo hinh tdng quat nay se cho phep xae dinh cae trang thai thdng tin khdng bi len thuoc vao bat ky cdng nghe cu t h i nao dang dupc ap dung.
An toan ihong tin: Nhu cau va ciic chi lieu flanh gia
Danh gia an toan thdng hn giiip ngudi diing xac dmh xem san pham hoac HTTT cd du an toan va tin cay ehua khi dUa vao sCf dgng, cac rui ro an toan tilm an khi siJ dung co chap nhan dUOC hay khdng, hoae cac san pham va HTTT cd ap dung cac bien phap va ky thuat an toan phii hop hay khdng, mifc do an toan nhu the nao. Ngoai ra, viec danh gta an toan thdng tin eon giup cae doanh nghiep phat trien cae san pham va HTTT dam bao cac yeu c l u v l an toan thong hn. Cin thiet phai xSy dung md hinh tdng the dimg de danh gia an toan thdng tin, mo hinh nay khong nhiing dap Ung nhu clu dam bao an toan eae HTTT, ma ddng thdi cdn 1^ mpt phuong hen hUu hieu de khao sat qui hoach, phat trien he thong va danh gia ket qua.
Md hinh tdng till phai diJ kha nang van hanh khdng phu thudc vao tinh trang phat tnen edng nghe. Cac phuong phap neu ra tiong md hinh phai la co sd chung cho moi ddi tuong va khdng bi hgn che do khac biet vl md hinh to chUc. Ngay ca khi chung ta chi de cap den nhifng khia canh it lien quan den ky tiiuat eiJa an toan cho cac he thdng ttiong hn, nhu la eac van d l v l chinh sach, mo hinh td chUe, va nhan sU hen quan den an tijan,...
md hinh tdng the cung hOli ich cho wee danti gia an toan thdng tin v l nhOng khia canh nay, Oe dat duoe su so sanh hieu qua giii'a cac k i t qua danh gia, eae danh gia cin dUpc thuc hien theo mdt khung eua md hinh chinh thUc trong dd cac tieu chi danh gia chung (Common Criteria), cac thanh phin giam sat chat luong cua qua trinh danh gia va cac to chUc cd tham quyln danh gia tUflng thich vdi nhau trong ciing mdt ngU eanh danh gia.
Si!f dung phuong phap danh gia ehung lam tang them ti'nh chinh xac va khach quan cua ket qua danh gia, song chi sil dung phifung phap danh gia chung vin ehUa du. Can cd nhOng tieu chi danh gia chung va lUOe do danh gia. Nhilu tieu chi danh gia ddi hoi co cac kmh nghiem ehuyen gia va kien thi/c cd ban, nham dat duoc su nhit quan va khach quan trong eac ket qua danh gia.
Oe tang cudng su nhat quan va khach quan
14 • TAP CHi TIN HOC NGAN HANG • s 6 7(147) -10/2014
NGHIEN CUtJ - TRAO DOI
cho cac ket qua danh gia, cin c6 mdt quy trinh edng nhan/phe chuln. Quy trinh nay xem xet ky cang mot each doc lap cac ket qua danh gia de dUa ra chUng nhan/ phe ehuan ve mUe dp an toan eho cac san pham/HTTT khi dUa vao sd dung.
Thay ldi k^t
Dam bao an toan an toan thong tin la mpt nhu clu thiet thuc de thiic day va phat trien Cong nghe Thdng hn (CNTT). Tieu chuan v l an toan thdng tin cho eae thiet bi va he thdng trong [[nh vUe CNTT vin con thilu nhilu To chifc ISO the gidi co tren 100 chuan v l an toan thdng hn, trong khi sd tieu chuan cua Viet Nam ban hanh cdn rit it. Viee thieu eae tieu chu^n nay din den viec ngUdi sCf dung, nha phat tridn va cae td chifc kiem dmh khdng cd co sd de thuc hien danh gia v l do
an toan cua san phim va he thdng CNTT.
Trudc tinh hinh nay, viec xay dung cac tieu chi thdng nhit de danh gia an toan eho cac san phim va he thdng CNTT la rat cin thiet.
Hien tai Viet Nam chUa cd mot tieu chuan nao v l viec thue hien danh gia an toan cho cac san pham va he thdng CNTT. Tieu chuan nay se giiip cac cO quan ehinh phiJ, cae doanh nghiep va dgc biet la cac td chUc danh gia (vi du eac phdng do kiem qudc gia) CO thi dua vao dd thuc hien eac danh gia an toan tren cac he thdng. Nd eung la mot hudng din giiip cho cac doanh nghiep trong viec phat trien cae san pham va he thdng CNTT dam bao eac yeu clu v l an toan thong tin.
Chinh phu da ban hanh Nghi dmh sd 72/2013/N&CP ngay 15/7/2013 quy dinh
v l ' Quan ly, cung cap, sd dung dich vu internet va thdng tin tren mang duoc gidi ehuyen mdn coi nhu la CO sd phap diu tien eho hoat ddng quan ly nha nUdc v l An toan thdng tin. Tuy rit chi tiet va chat che vdi 46 dilu v l : quan ly, eung cap, sif dung dich vu Internet va quan ly eung cip va sCf dung thong hn tren marg: trang thdng tin dien td va mang xa hoi; cung cap dieh vu ndi dung thdng hn tren mang thdng tin di ddng; trd choi dien td tren mang; dam bao an toan thong hn va an ninh thdng tin tren mang.
Hy vong ring Cue An toan thdng hn nhanh chdng va tUng budc dUa Nghi dinh 72 vao eudc sdng, khic phue nhffng han che noi tren mot each bai ban de dam bao an toan thdng tin tiudc gia va hdi nhap qude te trong rnh vuc naya
ATTT ha ting ICT quoc gia - Hien trang va thach thifc
Nguyin Trung Kien, Vien Cdng nghe Thdng hn va Truyen thdng CDIT ^ j . .
Hien nay, ha t i n g hpi tu, bang rpng, da djch vu (ggi chung la ha t i n g ICT) dang trd thanh nen tang ca sd ha t i n g cua n^n kinh te m5i qudc gia. Ha t i n g ICT m&\ sis dung giao thirc truyen tai IP, pht/ang thtfc truy nhap bang rong, di dpng va tren ha t i n g nay t i l m an nhieu nguy ca an toan thong tin (ATTT) mdi. Viet Nam n i m trong so cac quoc gia co sU phat trien nhanh ve ICT. Bai nay gidi thieu ha t i n g ICT mdi, cac nguy cd ATTT doi vdi ha t i n g , hien trang trien khai ha t i n g cung nht/ cac thach thtfc dat ra vdi van d l an ninh ATTT 6 Viet Nam hien nay. Bai bao tap trung vao ha t i n g ICT tao nen tCf cac mang vi6n thong cua cac nha khai thac (OP-Operator) va cac mang IP cua cac nha cung cap djch vu In- ternet {ISP- Internet Service Provider).
Hien Irang ha ting va cac nguy co mat ATTT
Hi0n trgng ATTT hg tSng ICT d Vi?t Nam NhUng nam gin day, ha ting ICT ciia Viet Nam da cd sU phat triln mgnh, nhung khdng ddng bd vdi nhilu cong nghe khac nhau, cae miln mang mdi tuong tac vdi eac mgng trudc do mdt each phdc tgp. Cac giai phap ATTT duoc trang bi theo ti:fng dU an cu thi, nhilu khi edn mang ti'nh eye bd, chua co
thiet ke tdng the Cac thiet bi an ninh dupe trang bi vdi nhilu chifc nang nhung ttiUc te ch? sd dung mdt phin trong sd dd din den hieu qua chua eao va vin tdn tgi cac nguy CO. Phin Idn OP/SP d Viet Nam chuyin tU cdng nghe TDM sang nen ddi ngu van hanh phin Idn eung la nhiMg ngudi chuyen sau v l TDM. Viec ehuyin ddi cap nhat kien thUc mcrt v l mang IP cung nhU cac kiln thifc v l ATTT
theo edng nghe mdi cdn chua bit kip. Cac OP/SP cung da lap td phan iftig nhanh (Cert) va phdng/ban ehUe nang ATTT nhung hoat ddng trong pham vi OP/SP. NhiJng nam gin day khi thi trudng canh tranh quyet het, cac OP/SP thudng tap trung vao da dang dieh vu, thdng lupng mang de dgt hieu xuat diu tu, v l Security thieu sU quan tam cin thiet Trong rnh vUc dao tao ngudn nhan lUc, tuy da cd su hdi tu sau gi0a IT va Telecom nhung trong dao tao d Viet Nam vin cdn tach biet kien thUc vien thong va cong nghe thdng tin nen smh vien ra trUdng tiiieu kiln thUe tdng thi de giai quyet cac van d l cua mang ICT mdi. Oen thdi diem hien tgi, Viet Nam vin ehua ed mdt thilt ke tdng the ATTT ha ting ICT qudc gia va cung ehUa xay dung he thdng chffc danh ATTT trong cac td ehUe, doanh nghiep dac biet la cac doanh nghiep tham gia cung d p ha ting ICT.
C^c nguy CO ATTT chung ciia hg ting ICT Cae nguy co ATTT da din xuat hien tren cac giao dien cua ha tang mang. 0 day, giao dien bao ham tff cac giao dien vat ly (giao dien vdi mdi trudng nhu bffc xa dien tff) den cac giao dien quan ly. Sd giao dien cang
iP Oil TIN HOC NGAN HANG • SO 7(147) - 1 0 / 2 0 1 4 • 1 5
