GA/T 1552-2019Information security technology - Security technical requirements for disk array safety storage products (English PDF)

5.1 Classification of safety technical requirements

This standard divides the security technical requirements for disk array secure storage products into two categories. security functions and security assurance requirements. Among them, the safety function should Qiushi put forward specific requirements for the security functions that disk array secure storage products should have, including storage type support, storage resource access control, data Data security, storage reliability, etc .; security requirements require specific requirements for the life cycle process of disk array secure storage products, such as Development, instructional documentation, lifecycle support and testing.

5.2 Classification of security levels

The security level of disk array security storage products is divided into basic level and enhanced level according to the strength of their security function requirements and security guarantee requirements.

Among them, security requirements refer to GB/T 18336.3-2015.

6.1 Storage type support

Support at least one of iSCSI, FC SAN, NAS.

6.2 Storage resource access control

6.2.1 Storage subject management

Should be able to manage storage principals.

a) You can add or delete hosts or users using storage resources;

b) Manage hosts or users in groups. Host groups and user groups with different levels can be established and different access rights can be set.

6.2.2 Storage Resource Management

Should be able to manage storage resources.

a) storage resources can be allocated to authorized subjects;

b) monitoring the use of storage resources;

c) Ability to expand storage resources.

6.2.3 Access Control Policy

It should support the configuration of access control policies based on storage subjects, storage resources, and access methods.

6.2.4 Access assurance capabilities

Authorized principals should be able to access corresponding storage resources based on predefined policies.

6.2.5 Access control capabilities

The following access control capabilities should be supported.

a) Access subject restrictions. Only authorized subjects can access storage resources;

b) Access content restrictions. The content that authorized subjects can access to storage resources cannot exceed a predefined range;

c) Access address restrictions. When an authorized subject is allowed to remotely access storage resources through the network, the address of the subject cannot exceed a predetermined address the scope of justice

d) Restriction on access actions. The actions of authorized subjects to access storage resources cannot exceed the predefined allowable range.

1) If iscsi or FC SAN is supported, it should be able to restrict read-only, read-write and other actions of authorized entities to storage resources.

Out of the predefined allowable range;

2) If the NAS method is supported, it should be able to restrict read-only, write, execute, attribute modification, and deletion of storage resources by authorized subjects Operation cannot exceed the predefined allowable range.

6.3 Data security

6.3.1 Data transmission security

It should be able to protect the remote access session content when the subject accesses the storage resource from unauthorized access through encryption and other methods.

6.3.2 Data storage security

Encryption or other protection measures should be used to achieve confidentiality of data storage.

6.3.3 Encryption Algorithm

Data storage should use a cryptographic algorithm approved by the national password management authority.

6.4 Storage reliability

6.4.1 Key component redundancy

It should be able to provide redundant protection mechanisms for key components.

a) Support interface and link redundancy;

b) have power redundancy;

c) Controller redundancy.

6.4.2 Power-down protection

Should have power-down protection to prevent data loss during power-down.

6.4.3 Disk Reliability

Disks have reliability guarantee capabilities.

a) When a disk failure occurs, an alarm function should be provided, which supports at least one of screen alarm, email alarm, and SMS alarm.

Species

b) Support disk redundancy protection function, support common RAID methods;

c) When more than a redundant number of hard disks fail, the remaining hard disk data is still available and new data can still be written.

6.4.4 Storage System Reliability

After the storage management system is damaged, it should be able to recover the system and ensure that data is not lost.

6.5 Identification and identification

6.5.1 Basic authentication

The storage subject must authenticate before requesting access to storage resources.

6.5.2 Administrator authentication

The administrator should be authenticated before the administrator performs any operation related to the security function.

6.5.3 Handling of authentication failure

When a user authentication attempt fails for a specified number of consecutive times, the session established by the user should be terminated. Maximum number of failures only by authorized administrators set up.

6.5.4 Multiple Authentication Mechanism

Multiple authentication methods should be provided, and multiple authentication mechanisms should be used simultaneously.

6.5.5 Authentication data protection

The authentication data should be protected from unauthorized access and modification.

6.6 Management function requirements

6.6.1 Management interface independence

Should have a separate management interface.

6.6.2 Remote Management

Support remote management and protect remote management session content from unauthorized access.

6.6.3 Administrator attribute definition

A security attribute table should be kept for each administrator. The attributes should include. administrator identification, authentication data, authorization information or management group information, Other security attributes, etc.

6.6.4 Management Capability

Ensure that an authorized administrator can configure and manage all security-related features of the product, including at least.

a) add, delete and modify policies;

b) Modify its attributes, including at least the administrator password.

6.6.5 Management roles

Different security management roles should be divided to reasonably assign rights to the product.

6.7 Audit function requirements

Can ask

Audit log generation 6.7.1 6.7.1 Audit data management 6.7.2 6.7.2

Table 1 (continued)

Security functions require basic level enhanced level Audit function can ask Prevent audit data loss 6.7.3 a) 6.7.3

8.2 Security requirements

Table 2 lists the security requirements for disk array storage products with different security levels.

Table 2 Security assurance requirements for information technology security disk storage products with different security levels

Security Assurance Requirements Basic Level Enhanced Level Develop Security Architecture 7.1.1 7.1.1 Functional specifications 7.1.2 a) to f) 7.1.2 Implementation representation-7.1.3 Product design 7.1.4 a) to d) 7.1.4 Instructive Documentation Operation User Guide 7.2.1 7.2.1