GA/T 1543-2019Information security technology - Security technical requirements for network equipment information detection products (English PDF)

5.1 Classification of safety technical requirements

This standard divides the security technical requirements of network equipment information detection products into two categories. security functions and security assurance requirements. Among them, the safety function Capability requirements are specific requirements for the security functions that network equipment information detection products should have, including information detection, network topology generation, non-Authorized connection behavior checks, etc .; security guarantees require specific requirements for the development and use of the content of the network equipment information detection products.

Requirements, such as development, instructional documentation, lifecycle support, and testing.

5.2 Classification of security levels

The security level of network equipment information detection products is divided into basic level and increased level according to the strength of its security function requirements and security assurance requirements.

Strong, in which the security requirements refer to GB/T 18336.3-2015.

6.1 Information detection

6.1.1 Device detection

The following methods should be used to detect hosts, network devices, and security devices that are online within the specified IP range.

a) Quick scanning, such as ICMP;

b) Deep scanning, such as SNMP, telnet, SSH, CDP and so on.

6.1.2 Port detection

It should be able to detect the port status on online hosts, network devices, and security devices in the specified IP range, and support custom-detected endpoints.

Mouth range and detection method.

6.1.3 Equipment basic information detection

It should be possible to obtain host operating system information, as well as system version, device type, and brand information for network and security devices.

6.1.4 Service Type and Version Detection

It should be able to detect the service type and version of the port.

6.2 Network topology generation

It should be able to generate a topology map for the specified network based on the detected information.

6.3 Unauthorized connection behavior check

It should be able to check the behavior of unauthorized devices connected to the network where the target information system is located, and trigger a report when unauthorized connection occurs police.

6.4 Impact on the network environment where the target system is located

In the process of use, it should minimize the occupation of the resources of the inspection target system or the network resources of the network to which they belong to prevent the impact of the inspection target system industry.

Services and the normal operation of the network, the average bandwidth consumption is less than 3MB/s.

6.5 Detection task management

It shall provide the detection task management function, which can suspend, stop, delete, and restart the detection task.

6.6 Statistical Report

It should be possible to report the detected information.

6.7 IPv6 protocol support

It should be able to support IPv6 type network environment detection.

6.8 Identification and identification

6.8.1 User Identification

Ensure that any user has a globally unique identity.

6.8.2 Identity

Any user should be authenticated before performing product security functions. If the product is managed remotely via the network, Limit management IP addresses.

6.8.3 Authentication Failure Handling

An authentication failure handling function should be provided to prevent further authentication requests by the user when the user's continuous authentication failure reaches a predefined number of times.

6.8.4 Timeout lock or logout

User login timeout lockout or logout function should be provided to terminate the user's current when the user has not performed any operation for more than a predefined time Management session, you need to authenticate again to perform management operations again.

6.8.5 Authentication data protection

It shall be ensured that the authentication data is stored in a non-plain text form and shall not be accessed or modified without authorization.

6.9 Data security

6.9.1 Data Transmission Security

If remote management is adopted, the remote management data should be transmitted in non-plain text; if it is composed of multiple components, control commands and transmission should be guaranteed.

Information such as input data is transmitted confidentially between components.

6.9.2 Data Storage Security

The detected information should be stored in a non-volatile storage medium at power-down.

6.10 Audit Log

6.10.1 Log generation

It should be possible to generate logs for the following events.

a) user authentication, including success and failure;

b) User important operations.

The log content should include. date, time, event body, event description, etc.

6.10.2 Log Management

The following requirements should be met.

a) Only authorized users are allowed to access the log;

b) Provide the function of querying logs according to conditions such as date, time, and event subject;

c) Provide log archiving and emptying functions.

7.1 Development

7.1.1 Security Architecture

The developer should provide a description of the security architecture of the product's security functions. The description of the security architecture should meet the following requirements.

a) Consistent with the level of abstract description of security functions implemented in the product design document;

b) describe the security domain of the product security function consistent with the requirements of the security function;

c) describe why the product safety function initialization process is safe;

d) confirm that product safety functions can be prevented from being compromised;

e) Verify that product safety functions prevent safety features from being bypassed.

7.1.2 Functional Specifications

Developers should provide complete functional specifications, which should meet the following requirements.

a) fully describe the safety functions of the product;

b) describe the purpose and use of all safety function interfaces;

c) identify and describe all parameters related to each safety function interface;

d) describe the safety function implementation behavior related to the safety function interface;

e) describe direct error messages caused by the behavioral processing of safety functions;

f) confirm that the safety function requires traceability to the safety function interface;

g) describe all actions related to the safety function interface during the implementation of the safety function;

h) Describe all direct error messages that may be caused by the call of the safety function interface.

7.1.3 Implementation Representation

Developers should provide implementation representations for all security functions. Implementation representations should meet the following requirements.

a) Provide a mapping between product design descriptions and implementation representation examples and prove their consistency;

b) Define product safety functions according to the level of detail, to a level of detail that can be generated without further design;

c) Provided in the form used by developers.

7.1.4 Product Design

Developers should provide product design documents, which should meet the following requirements.

a) describe the product structure in terms of subsystems;

b) identify and describe all subsystems of product safety functions;

c) describe the interaction between all subsystems of the safety function;

d) the mapping relationship provided can verify that all the behaviors described in the design can be mapped to the security function interface that calls it;

e) describe safety functions according to the module;

f) Provide the mapping relationship between the safety function subsystem and the module;

g) describe all safety function implementation modules, including their purpose and interaction with other modules;

h) Describe the relevant interfaces required by all modules to implement the security functions, return values from other interfaces, interactions with other modules, and Called interface

i) Describe the supporting or related modules of all safety functions, including their purpose and interaction with other modules.

7.2 Guidance documents

7.2.1 Operation User Guide

Developers should provide clear and reasonable operating user guides, which are kept in line with all other documents provided for evaluation Sincerely, the description of each user role should meet the following requirements.

a) describe the functions and privileges accessible to users controlled in a secure processing environment, including appropriate alert information;

b) describe how to use the available interfaces provided by the product in a secure manner;

c) describe available functions and interfaces, especially all safety parameters controlled by the user, and indicate safety values where appropriate;

d) clearly state each security-related event related to the user-accessible function that needs to be performed, including changes to the control of the security function Security features of the entity;

e) identify all possible states of operation of the product (including failures or operational errors caused by operations), and their relevance to maintaining safety Causality and connection between operations;

f) Security policies implemented to fully achieve security purposes.

7.2.2 Preparation procedures

The developer shall provide the product and its preparation procedures. The preparation procedure description shall meet the following requirements.

g) describe all steps necessary to securely receive the delivered product in accordance with the developer delivery process;

h) Describe all steps necessary to safely install the product and its operating environment.

7.3 Life cycle support

7.3.1 Configuration Management Capability

Developer configuration management capabilities should meet the following requirements.

a) provide unique identification for different versions of the product;

b) use a configuration management system to maintain all configuration items that make up the product and uniquely identify configuration items;

c) Provide configuration management documents, which describe the method used to uniquely identify configuration items;

d) The configuration management system provides an automatic way to support the generation of products, by which it is ensured that only the implementation of the products can be expressed Authorized changes;

e) The configuration management document includes a configuration management plan, which describes how to develop products using a configuration management system. real the implementation of the configuration management is consistent with the configuration management plan;

f) The configuration management plan describes the procedures used to accept modified or newly created configuration items as part of the product.

7.3.2 Configuration Management Scope

The developer should provide a list of product configuration items and describe the developer of the configuration item. The configuration item list should include the following.

a) Evaluation evidence of products, safety assurance requirements and components of products;

b) Implementation indication, security defect report and resolution status.

7.3.3 Delivery Procedure

Developers should use a certain delivery procedure to deliver the product and document the delivery process. When delivering versions of the product to the user, the delivery documentation should describe all procedures necessary to maintain security.

7.3.4 Development Security

Developers should provide development security documentation. The development security documentation should describe the design and implementation all physical, procedural, personal and other security measures necessary for confidentiality and integrity.

7.3.5 Life Cycle Definition

The developer should establish a life cycle model to control the development and maintenance of the product, and provide a description of the life cycle definition document.

Describe the models used to develop and maintain products.

7.3.6 Tools and Techniques

Developers should clearly define the tools used to develop the product, and provide development tool documentation to unambiguously define the meaning of each statement in the implementation and the meaning of all implementation-dependent options.

7.4 Test

7.4.1 Test coverage

The developer should provide a test coverage document, and the test coverage description should meet the following requirements.

a) indicate the correspondence between the tests identified in the test documentation and the safety functions of the product described in the functional specification;

b) Show that the above correspondence is complete and confirm that all safety function interfaces in the functional specification have been tested.

7.4.2 Test depth

Developers should provide test depth analysis. The test in-depth analysis description should meet the following requirements.

a) confirm the consistency between the tests in the test documentation and the safety function subsystem and implementation modules in the product design;

b) Verify that all safety function subsystems and implementation modules in the product design have been tested.

7.4.3 Functional test

Developers should test product security features, document results and provide test documentation. The test documentation should include the following.

a) A test plan that identifies the tests to be performed and describes the scenarios for each test, including those for other test results any order dependency;

b) the expected test results, indicating the expected output after a successful test;

c) Consistency of actual test results and expectations.

7.4.4 Independent testing

Developers should provide a set of resources equivalent to those used for self-testing security features for sample testing of security features.

7.5 Vulnerability assessment

Based on the identified potential vulnerabilities, the product is resistant to the following attacks.

a) attacks by attackers with basic attack potential;

b) Attacks by attackers with enhanced basic attack potential.

8.1 Safety function requirements

The security function requirements of network equipment information detection products with different security levels are shown in Table 1.

Table 1 Security function requirements for network equipment information detection products with different security levels

Security functions require basic level enhanced level Information detection Device detection 6.1.1 6.1.1 Port detection 6.1.2 6.1.2 Equipment basic information detection 6.1.3 6.1.3 Service type and version detection 6.1.4 6.1.4 Network topology generation-6.2 Unauthorized connection behavior check-6.3 Impact on the network environment where the target system is located 6.4 6.4 Detection Task Management 6.5 6.5 Statistical Reports-6.6 IPv6 protocol support 6.7 6.7

Table 1 (continued)

Security functions require basic level enhanced level Identification and authentication User ID 6.8.1 6.8.1 Identity 6.8.2 6.8.2 Authentication Failure Handling-6.8.3 Lockout or logout over time-6.8.4 Discrimination data protection 6.8.5 6.8.5 Data Security Data transmission security 6.9.1 6.9.1 Data storage security 6.9.2 6.9.2 Audit log Log generation 6.10.1 6.10.1 Log management-6.10.2

8.2 Security requirements

Table 2 shows the security requirements for network equipment information detection products with different security levels.

Table 2 Security requirements for network equipment information detection products with different security levels

Security Assurance Requirements Basic Level Enhanced Level Develop Security Architecture 7.1.1 7.1.1 Functional specifications 7.1.2 a) to f) 7.1.2 Implementation representation-7.1.3 Product design 7.1.4 a) ~ d) 7.1.4 Guidance Document Operation User Guide 7.2.1 7.2.1 Preparation procedures 7.2.2 7.2.2 Life cycle support Configuration management capabilities 7.3.1 a) ~ c) 7.3.1 Configuration management scope 7.3.2 a) 7.3.2 Delivery procedures 7.3.3 7.3.3 Development Security-7.3.4 Life cycle definition-7.3.5 Tools and techniques-7.3.6 test Test coverage 7.4.1 a) 7.4.1 Test depth-7.4.2 Functional test 7.4.3 7.4.3 Independent test 7.4.4 7.4.4 Vulnerability assessment 7.5 a) 7.5 b)