GB/T 20280-2006Information security technology -- Testing and evaluation approaches for network vulnerability scanners (English PDF)

4.1 Symbols and Abbreviations

4.2 Stipulation of Notation

a) Selection. It is used for emphasizing one or more than one options in the

statement of certain functional requirement, represented by underlined italics.

b) Note. This Standard performs a classified discussion on testing and evaluation

of network vulnerability scanners. The provisions in this Standard, unless

stated, are all the requirements of basic products. The testing and evaluation

item, testing content and testing and evaluation result of enhanced products

shall be represented in italics.

7.1 Basic-type

7.1.1 Basic function

7.1.1.1 Requirements for self-security

7.1.1.1.3 Sensitive information protection

7.1.1.1.4 Software use records

7.1.1.1.5 Label of scan data pack

a) Evaluation contents. refer to the contents in 7.2.5 of GB/T 20278-2006.

b) Testing and evaluation approaches.

1) According to version release statement, user manual, high-level design

document, testing document etc. of network vulnerability scanners, start

network vulnerability scanners A and B in Figure 1 and perform scan

function;

2) Acquire scan data pack of network vulnerability scanners via sniffer (e.g.

Tcpdump etc.) and analyze it.

c) Testing and evaluation result. record testing result and judge whether the

result conforms to requirements of testing and evaluation approaches.

7.1.1.2.4 Port and service scan

a) Evaluation contents. refer to the contents in 7.3.4 of GB/T 20278-2006.

b) Testing and evaluation approaches.

7.1.1.3 Management requirement

7.1.1.3.1 Administrator access

7.1.1.3.2 Analysis and processing for scan result

a) Evaluation contents. refer to the contents in 7.4.2 of GB/T 20278-2006.

b) Testing and evaluation approaches.

7.1.1.3.4 Security of scanning object

a) Evaluation contents. refer to the contents in 7.4.4 of GB/T 20278-2006.

b) Testing and evaluation approaches.

7.1.1.3.5 Upgrade capability

a) Evaluation contents. refer to the contents in 7.4.2 of GB/T 20278-2006;

b) Testing and evaluation approaches. check version release statement,

instruction manual, user manual etc. of network vulnerability scanners; start

product A and B in Figure 1; inspect whether the products are provided with

upgrade and update capability according to user manual.

c) Testing and evaluation result. record testing result and judge whether the

result conforms to requirements of testing and evaluation approaches; it shall

meet such requirements as convenient and automatic upgrade and available

manual upgrade and vulnerability database addition.

7.1.1.4 Operation requirement

7.1.1.4.1 Installation and operation control

a) Evaluation contents. refer to the contents in 7.5 of GB/T 20278-2006.

b) Testing and evaluation approaches. check version release statement,

instruction manual, administrator manual, configuration management

document of network vulnerability scanners, network vulnerability scanners

shall be installed and operated practically.

c) Testing and evaluation result. records testing result and judge whether it

conforms to the requirements of testing and evaluation approaches; it shall

meet the following requirements.

1) Installation, management, operating controllability of network

vulnerability scanners are explained in random documents; network

vulnerability scanners execute the measure of issuing license (e.g.

issuing serial number; generating license according to installed

computer information etc.);

2) Scanning process of network vulnerability scanners can be suspended

at any time, maintain breakpoint and restore at any time;

3) In the scanning process of network vulnerability scanners, keyboard lock

function and screen protection function can be executed.

7.1.2 Performance requirements

7.1.3.2 Development process of security function

7.1.3.2.2 Representation correspondence

a) Representation contents. refer to the contents in 9.1.2.2 of GB/T

20278-2006.

b) Testing and evaluation approaches. the evaluator shall check whether the

developer provides correspondent analysis among all the adjacency pairs

expressed by security function of network vulnerability scanners. In which,

the correspondence among various security function representations (such

as function design, high-level design, low-level design and realization

representation of network vulnerability scanners) of network vulnerability

scanners is an accurate and complete example required by security function

representation of network vulnerability scanners. Security function of network

vulnerability scanners is defined in functional design, while all the security

function-related parts in relatively abstract security function representation of

network vulnerability scanners are defined in relatively specific security

function representation of network vulnerability scanners.

c) Testing and evaluation result. record checking result and judge whether the

result conform to the requirements of testing and evaluation approaches;

checking contents for the evaluator shall at least include these four

items-functional design, high-level design, low-level design, realization

representation. The contents provided by the developer shall be accurate

and complete and mutually corresponding.

7.1.3.3 Testing 7.1.3.3.1 Function test

a) Evaluation contents. refer to the contents in 9.1.3.1 of GB/T 20278-2006.

b) Testing and evaluation approaches.

1) Evaluate whether testing document provided by the developer include

testing plan, testing process, expectative testing result and actual testing

result;

2) Judge whether to-be-test security function is marked and the test object

is described in testing plan;

3) Whether to-be-executed test is marked and each test general condition

of security function (these general condition include the sequence

dependence for other testing result) is described;

4) Whether the expected testing result indicate the expected output after

the successful test;

5) Whether the actual testing result indicates each tested security function

can be operated as required.

c) Testing and evaluation result. record checking result and judge whether the

result conforms to requirements of testing and evaluation approaches; the

checking contents for the evaluator shall at least include five aspects in

testing and evaluation approaches. The contents provided by the developer

shall be complete.

......