blocks|key|3800662|text|标准是一般的，由高层次的原则组成。指南的重点是实用安全。核对表是最详细的文档。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3800663|有多个机构制定安全标准。ISO/IEC+27002是当今应用最广泛的安全标准之一，它始于1995年。本标准由三个基本部分组成，BS+7799第1部分、第2部分和第3部分。最近该标准已成为ISO+27001。但这是一个非常高级别的标准，不涉及配置细节。讨论了建立信息安全基础设施(BS+7799+part+1)、信息安全管理系统(BS+7799+part+2)和风险分析与管理(BS+7799+part+3)。|offset|length|3800664|您正在询问指南，美国国家标准和技术研究所(NIST)已经发布了一些关于网络安全的专门出版物。这是来自NIST的通用服务器安全指南。本一般文档讨论了保护服务器的必要性，并为选择、实现和维护必要的安全控制提供了建议。|3800665|NSA为各种软件开发和分发安全配置指南，包括开源软件和专有软件。|3800666|应用程序|unordered-list-item|3800667|数据库服务器|3800668|操作系统|3800669|脆弱性技术报告|3800670|有关保护某些安装的更多详细文档，请参阅NIST的国家核对清单方案储存库。NCP安全检查表(或基准)为设置操作系统和应用程序的安全配置提供了详细的低级别指导。例如，有用于保护以下内容的检查列表：|3800671|网络服务器|3800672|电子邮件服务器|3800673|应用服务器|3800674|entityMap|0|LINK|mutability|MUTABLE|url|https://en.wikipedia.org/wiki/ISO/IEC_27002|1|https://en.wikipedia.org/wiki/ISO/IEC_27001|2|http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf|3|https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/applications.shtml|4|https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/database_servers.shtml|5|https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml|6|https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/vulnerability_technical_reports.shtml|7|http://web.nvd.nist.gov/view/ncp/repository|8|http://web.nvd.nist.gov/view/ncp/repository?tier=&product=&category=Web%2520Server|9|http://web.nvd.nist.gov/view/ncp/repository?tier=&product=&category=Email%2520Server&authority=&keyword=|10|http://web.nvd.nist.gov/view/ncp/repository?tier=&product=&category=Application%2520Server&authority=&keyword=|11|http://web.nvd.nist.gov/view/ncp/repository?tier=&product=&category=Operating%2520System&authority=&keyword=^0|0|C|D|0|2L|9|1|0|1J|9|2|0|0|0|4|3|0|0|6|4|0|0|4|5|0|0|7|6|0|O|B|7|0|0|5|8|0|0|7|9|0|0|5|A|0|0|4|B^^$0|@$1|2|3|4|5|6|7|1U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1V|8|@]|9|@$D|1W|E|1X|1|1Y]|$D|1Z|E|20|1|21]]|A|$]]|$1|F|3|G|5|6|7|22|8|@]|9|@$D|23|E|24|1|25]]|A|$]]|$1|H|3|I|5|6|7|26|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|27|8|@]|9|@$D|28|E|29|1|2A]]|A|$]]|$1|M|3|N|5|L|7|2B|8|@]|9|@$D|2C|E|2D|1|2E]]|A|$]]|$1|O|3|P|5|L|7|2F|8|@]|9|@$D|2G|E|2H|1|2I]]|A|$]]|$1|Q|3|R|5|L|7|2J|8|@]|9|@$D|2K|E|2L|1|2M]]|A|$]]|$1|S|3|T|5|6|7|2N|8|@]|9|@$D|2O|E|2P|1|2Q]]|A|$]]|$1|U|3|V|5|L|7|2R|8|@]|9|@$D|2S|E|2T|1|2U]]|A|$]]|$1|W|3|X|5|L|7|2V|8|@]|9|@$D|2W|E|2X|1|2Y]]|A|$]]|$1|Y|3|Z|5|L|7|2Z|8|@]|9|@$D|30|E|31|1|32]]|A|$]]|$1|10|3|P|5|L|7|33|8|@]|9|@$D|34|E|35|1|36]]|A|$]]]|11|$12|$5|13|14|15|A|$16|17]]|18|$5|13|14|15|A|$16|19]]|1A|$5|13|14|15|A|$16|1B]]|1C|$5|13|14|15|A|$16|1D]]|1E|$5|13|14|15|A|$16|1F]]|1G|$5|13|14|15|A|$16|1H]]|1I|$5|13|14|15|A|$16|1J]]|1K|$5|13|14|15|A|$16|1L]]|1M|$5|13|14|15|A|$16|1N]]|1O|$5|13|14|15|A|$16|1P]]|1Q|$5|13|14|15|A|$16|1R]]|1S|$5|13|14|15|A|$16|1T]]]]

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. 

There are multiple agencies that produce security standards. One of the most widely used security standards today is <a href="https://en.wikipedia.org/wiki/ISO/IEC_27002" rel="nofollow">ISO/IEC 27002</a> which started in 1995. This standard consists of three basic parts, BS 7799 part 1, part 2 and 3. Recently this standard has become <a href="https://en.wikipedia.org/wiki/ISO/IEC_27001" rel="nofollow">ISO 27001</a>. But it is a very high level standard that doesn't go into configuration specifics. It talks about building an information security infrastructure (BS 7799 part 1), an information security management system (BS 7799 part 2) and risk analysis and management (BS 7799 part 3).

You are asking about guides and the National Institute of Standards and Technology (NIST) has released several special publications addressing cyber security. Here is the <a href="http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf" rel="nofollow">Guide to General Server Security</a> from NIST. This general document discusses the need to secure servers and provides recommendations for selecting, implementing, and maintaining the necessary security controls.

NSA develops and distributes security configuration guides for a wide variety of software, both open source and proprietary.

<ul>
<li><a href="https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/applications.shtml" rel="nofollow">Applications</a></li>
<li><a href="https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/database_servers.shtml" rel="nofollow">Database Servers</a></li>
<li><a href="https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml" rel="nofollow">Operating Systems</a></li>
<li><a href="https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/vulnerability_technical_reports.shtml" rel="nofollow">Vulnerability Technical Reports</a></li>
</ul>

For more detailed documents about securing certain installations follow NIST's <a href="http://web.nvd.nist.gov/view/ncp/repository" rel="nofollow">National Checklist Program Repository</a>. NCP security checklists (or benchmarks) provide detailed low level guidance on setting the security configuration of operating systems and applications. For example there are checklists for securing:

<ul>
<li><a href="http://web.nvd.nist.gov/view/ncp/repository?tier=&amp;product=&amp;category=Web%20Server" rel="nofollow">Web Servers</a></li>
<li><a href="http://web.nvd.nist.gov/view/ncp/repository?tier=&amp;product=&amp;category=Email%20Server&amp;authority=&amp;keyword=" rel="nofollow">Email Servers</a></li>
<li><a href="http://web.nvd.nist.gov/view/ncp/repository?tier=&amp;product=&amp;category=Application%20Server&amp;authority=&amp;keyword=" rel="nofollow">Applications Servers</a></li>
<li><a href="http://web.nvd.nist.gov/view/ncp/repository?tier=&amp;product=&amp;category=Operating%20System&amp;authority=&amp;keyword=" rel="nofollow">Operating Systems</a></li>
</ul>

This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, password length, iptables, /etc/hosts, routes, packets securing, security patches etc.. 

I would like to know if there is a standard in the industry, doesn't matter if it's public or private sector that I could benchmark my steps against. I know there are few out there, but what could be considered THE standard.

Enterprise standard for securing servers.

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

这一定是要问的最广泛的问题，但多年来，我已经想出了我自己的事情清单--为了保护我的服务器，我遵循我可以在网上收集的明显步骤，例如密码长度，iptables，/etc/主机，路由，数据包安全，安全补丁等等。我想知道这个行业是否有一个标准，不管是公共部门还是私营部门，我都可以用它来衡量我的步调。我知道外面很少，但是标准是什么呢？

问保护服务器的企业标准。
EN

回答 1

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问保护服务器的企业标准。EN