Tamper-evident record history
Each version of a record is hashed and the hashes are chained or anchored in an append-only log, so any later change to history is detectable by anyone holding an earlier hash.
GCRI · 登记册
面向登记册的网络安全
Cybersecurity and cryptography protect a registry’s integrity: that records are not altered without trace, that only authorised people change them, and that what a reader receives is what the issuer published. In registries the main threat is often quiet tampering rather than outage, so integrity and audit matter as much as availability.
01目录
Cybersecurity for registries in five parts.
02申请
What cybersecurity and cryptography does here.
Cybersecurity and cryptography protect information 系统 and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. In governance and institutions and research and evidence, cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance. The canonical description is on STEM Commons.
Signed exports and releases
Exports and data releases are signed with keys whose public halves are published, so consumers can verify origin and integrity before ingesting, and a compromised mirror cannot pass off altered content.
Threat modelling of edit paths
Every route by which a record can change, from the interface and bulk import to administrator tools and pipelines, is modelled for abuse, including insiders and stolen credentials, and each route is logged.
03监测
Security assessment.
团队遵循该方法时会使用的界面：其指标、状态与决策。名称为示例，数值仅作示意。
Security assessment
Registry · Cybersecurity for registries · Run R-3129
Two high findingsGCRI · 登记册
发现
| Weak key rotation | Identity service | 高 | PR.AA | 打开 |
| Unpatched gateway | Edge | 高 | PR.PS | Fixing |
| Logging gap | 支付 API | 中 | DE.CM | 打开 |
| Stale accounts | 名录 | 低 | PR.AA | 已关闭 |
方法卡
- 方法
- 网络安全与密码学
- 框架
- CSF 2.0 功能
- 范围
- 37 assets
- 标签
- 模型生成
Control coverage by function
04数据
该方法使用的输入。
Datasets and records used by cybersecurity and cryptography on this platform, with the role each plays and the label its values carry. Sources are listed in 来源登记册.
| 数据 | 角色 | 标签 |
|---|---|---|
| Security event and audit logs | Detection and reconstruction of changes | 观测 |
| Content hashes and transparency logs | Integrity verification of records and releases | 观测 |
| Vulnerability databases such as CVE and OSV | Known weaknesses in registry software dependencies | 已报告 |
| Incident reports | Lessons from past compromises and near misses | 已报告 |
05模拟器
在相互依存的网络中的一次级联。
A 危害足迹 会摧毁每一层中位于同处的资产；随后，碎片化、层间依赖和幸存资产的过载使失效扩散开来。3D 视图按深度分开各层。这是带有说明性取值的教学模型，不是预测。
控制措施
- 每个图层的资产
- 18
- 危害足迹
- 占面积的 8%
- 依赖其他图层的资产
- 60%
- 备用容量（容差）
- 30%
读数
- 受危害冲击的资产
- 6%
- 仍在运行的资产
- 48%
- 初始损害的放大
- 9.3 times
- 结算步数
- 3
数字、方法与来源
| 步骤 | 电力运行（%） | Water working (%) | 电信运行（%） |
|---|---|---|---|
| 0 | 100 | 100 | 83 |
| 1 | 61 | 100 | 56 |
| 2 | 61 | 56 | 39 |
| 3 | 61 | 44 | 39 |
方法
- 相互依存网络 Buldyrev 等（2010），Catastrophic cascade of failures in interdependent networks，Nature 464
- 过载级联 Motter and Lai (2002), Physical Review E 66
- 介数负载 Brandes (2001), Journal of Mathematical Sociology 25
- 多层网络 Kivela and others (2014), Journal of Complex Networks 2
- 基础设施相互依赖 Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
- 不确定性扇形图（参数蒙特卡罗） Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- 单因素敏感性（龙卷风图） Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
数据
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page’s map can draw:
- 主要道路 Natural Earth
- 铁路 Natural Earth
- 海港 Natural Earth
- 机场 Natural Earth
- 城市范围 Natural Earth
- 今晚的夜间灯光、停电（VIIRS 昼夜波段） NASA/NOAA VIIRS（Suomi NPP）· 登记 nasa.gibs.context-live-layers
- 自然事件（NASA EONET） NASA EONET · 登记 nasa.eonet.events
贯穿六大支柱，由 Nexus Consortium 牵头
- 实验 实验室
- 构建于 Foundry 中的登记册
- 检验地点 Universe 中的登记册
- 编入 Standards 中的基础与治理
- 发表于 Reports 中的登记册
- 授课于 Academy 中的治理、政策与国际事务学院
06验证
结果如何核查。
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
| 核查 | 如何开展 |
|---|---|
| Hash verification | Published records and exports are re-hashed on a schedule and compared with the logged values |
| Access review | Accounts with edit and administrator rights are reviewed against current roles, and stale access is removed |
| Penetration testing | Edit paths and interfaces are tested by an independent team against the threat model |
| Restore drills | Backups are restored to a clean environment and compared with the live registry |
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
07方法与证据
How cybersecurity for registries is modelled, measured and tested.
模型、其假设、数据和不确定性，以科学家或工程师会核查的形式呈现。结构遵循已发表的方法。所取数值仅为示意，不是研究发现。
数据集与来源追溯
The data classes behind cybersecurity for registries and what is recorded about each before it is used.
| 数据类别 | 已记录溯源 | 已说明分辨率 | 许可已核查 |
|---|---|---|---|
| 卫星影像，光学与雷达 | 传感器、处理级别、获取日期 | 像元大小和重访周期 | 每景 |
| 再分析与气候模式输出 | 模型、实验、成员、版本 | 格网与时间步长 | 每次发布 |
| 原位传感器和测量站 | 测站、仪器、校准记录 | 点位与采样率 | 每个网络 |
| 人口与资产暴露 | 方法、版本年份、输入来源 | 单元大小和单位 | 每次发布 |
| 边界与参考地理 | 制作者、版本、日期 | 比例尺 | 每个版本 |
- 沿袭
- 从来源到图表的 W3C PROV 记录
- 原则
- FAIR：可查找、可访问、可互操作、可复用
- 缺口
- 显示为缺失，绝不悄然填充
FAIR 指导原则 · GO FAIR 和 FORCE11W3C PROV · 万维网联盟关于一致处理不确定性的指南 · IPCCCEOS 分析就绪数据 · 地球观测卫星委员会
09管理责任
由谁维护该方法。
网络安全与数字韧性 stewards cybersecurity and cryptography for the Consortium and reviews how it is applied across platforms.
10已关联
本页在整个联合体中通向何处。
11问题
问题与解答。
What are the limits of cybersecurity and cryptography in this field?
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
结果如何核查？
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
本页面上的数值是真实的吗？
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method’s use, not a run; no result is reported here.
该方法还应用于何处？
维持社会运转的 规范方法页面 列出应用该方法的每个平台。
报告贡献
从本页贡献证据。
报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRI登记册方法与技术
- 电子邮件网关 GW-GCRI从本页发送证据、更正、案例、方法、审查、翻译或概况投稿。它会带上本页标签送达，由负责的编辑接收。
- Zenodo开放存缴存缴并提交到社区用您的 ORCID iD 在 Zenodo 上发布您自己的记录，然后提交到那里的 Reports 社区。由策展人审核；DOI 仍归您所有。
- 报告GCRI查看所有贡献方式贡献类型、各自的评审方式、您获得的署名、许可协议，以及绝不接受的内容。
切勿发送个人数据、敏感基础设施细节或您无权分享的任何内容。贡献在使用前会经过审查；发送贡献不赋予署名权或编辑权，赞助也绝不能换取研究结论。
法律
法律文件。
本网站上的地图、数据和图表仅作为背景和一般信息展示。它们不是建议、预测或预警；信息的局限见免责声明和数据说明。