网络安全与数据治理2025，Vol.44Issue(9)：15-21,7.DOI:10.19358/j.issn.2097-1788.2025.09.003
基于等保 2.0 验证测试与ATT&CK攻击矩阵的融合实践
Integrated practice based on Cybersecurity Classified Protection 2.0 validation testing and the ATT&CK matrix
摘要
Abstract
This research focuses on penetration testing methodologies within the Cybersecurity Classified Protection 2.0(CCP 2.0)framework,establishing a dynamic security validation system through integration with ATT&CK attack matrix.By conduc-ting in-depth analysis of the technical verification requirements for core control points in CCP 2.0—including secure communica-tion networks,security boundaries,and secure computing environments—we combine traditional penetration testing processes with ATT&CK tactics and techniques,and propose a novel validation framework characterized by multi-dimensional test scenario de-sign,closed-loop validation of attack chains and quantitative assessment of defensive capabilities.Empirical study on industrial control systems demonstrates that this approach can effectively identify compliance blind spots in CCP implementations while en-hance systems' proactive defense capabilities and resilience against real-world attacks.The research provides network operators with actionable penetration testing solutions for implementing CCP standards,thereby advancing cybersecurity from compliance-driven to capability-oriented defense paradigms.关键词
网络安全等级保护/ATT&CK/渗透测试Key words
cybersecurity classified protection/ATT&CK/penetration test分类
信息技术与安全科学引用本文复制引用
颜星晨,张鑫,周志洪,陈恺凡..基于等保 2.0 验证测试与ATT&CK攻击矩阵的融合实践[J].网络安全与数据治理,2025,44(9):15-21,7.基金项目
国家自然科学基金(62202303,62471301) （62202303,62471301）
