GA/T 1394-2017Information security technology - Security technical requirements for security operation and maintenance management products (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard proposed by the Ministry of Public Security Network Security Bureau.

This standard by the Ministry of Public Security Information System Safety Standardization Technical Committee.

1 Scope

This standard specifies the safety function requirements of operation and maintenance safety management products, safety protection requirements and classification requirements.

This standard applies to the operation and maintenance safety management product design, development and testing.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version applies to this article Pieces. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 18336.3-2015 Information Technology Security Technology Information Technology Security Assessment Guidelines Part 3. Security components Information technology - Security terminology

3 Terms and definitions

GB/T 18336.3-2015 and GB/T 25069-2010 defined by the following terms and definitions apply to this document.

Operation and maintenance user on the server, network equipment and databases and other important information systems operating and maintenance personnel.

Operation and maintenance security management products securityoperationandmaintenancemanagementproduct the maintenance of key assets of the information system to achieve single sign-on, centralized authorization, centralized management and audit of the product.

Operation and maintenance object Assets protected by O & M safety management products.

4 Operation and maintenance safety management product description

Operation and maintenance security management products provide a unified authentication interface for operation and maintenance users, a variety of remote operation and maintenance management, the assets and their accounts such as centralized management and authorization, monitoring and auditing operation and maintenance operations, and illegal operation of the alarm, blocking. This type of product protection the object is a server, network equipment, security products, databases, application systems and other important information system assets. In addition, operation and maintenance safety management production the product itself and its internal important data is also the object of protection.

O & M safety management products are usually deployed by-pass. Operation and maintenance safety management products typical operating environment shown in Figure 1.