GB/T 20945-2023Information security technology - Technical specification for network security audit products (English PDF)

1 Scope

This document specifies the technical requirements for network security audit products and describes the evaluation methods:

This document applies to the design, development, testing and evaluation of network security audit products:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references

For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GB/T 18336:1-2015 Information technology security technology Information technology security assessment criteria Part 1: Introduction and general

Model

GB/T 18336:3-2015 Information Technology Security Technology Information Technology Security Assessment Criteria Part 3: Security Assurance Components

GB/T 25069-2022 Information Security Technical Terminology

GB/T 35273-2020 Personal Information Security Specifications for Information Security Technology

3 Terms and Definitions

GB/T 18336:1-2015, GB/T 18336:3-2015 and GB/T 25069-2022 and the following terms and definitions apply used in this document:

3:1 network security network security

The maintenance of confidentiality, integrity and availability of information stored, transmitted and processed in the network environment:

[Source: GB/T 25069-2022, 3:616]

3:2 abnormal abnormal

A deviation from a previously verified condition, state, or behavior observed from documentation, operation, or monitoring:

Note: Generally, the subjects involved in anomalies may be people, equipment, applications, services/processes, data, etc: Because the identified anomalies point to different subjects, they can be divided into

Abnormal user behavior, abnormal device operation, abnormal program execution, abnormal service operation, abnormal data, etc:

[Source: GB/T 32422-2015, 3:1, modified]

3:3 event incident

Attempts to alter the state of an object and cause or may cause abnormal or damaging behavior to occur:

[Source: GB/T 25069-2022, 3:552, modified]

3:4

Security audit securityaudit

Independent review and examination of the records and activities of networks, information systems and their components to test the adequacy of system controls to ensure […]