GB/T 24294.1-2026Cybersecurity technology - Implementation guide for the information security of internet-based e-government - Part 1: General (English PDF)

5.3 Requirements Identification

5.3.1 Security Object Identification Internet-based e-government applications are the targets of security protection. These targets include the following two categories.

a) Government Affairs. Internal business processes within government departments, such as document circulation, document processing, office management, and data sharing between government departments. Enjoy, etc.;

b) Government Services. Through various means such as online halls, service windows, mobile clients, and self-service terminals, combined with third-party platforms, face-to-face services are provided. The government provides one-stop services to the public, including information disclosure, social security and medical insurance, marriage and childbirth services, and interactive communication services. Content. Government services take many forms, including government websites, government apps, and government mini-programs.

5.3.2 Government Data Identification In municipal-level (and below) internet-based e-government systems, data that does not involve state e-government secrets includes the following. Two categories.

a) Internal Data. Internal data refers to information accessible to government personnel by level, scope, and unit, such as government office data. Documents, shared government data, and government meeting notices, etc.;

b) Public Data. Public data refers to information that can be made available to the public on the internet, such as government service procedures, government information disclosure, etc. Information on public services projects and enterprise services, etc.

5.3.3 Security Target Identification Security target identification includes the following.

a) The key points of security protection for government offices and their internal information mainly include the identification of government personnel and the authorization of access to government resources. Questions regarding data transmission protection, etc.;

b) The key security protection for government offices and their internal information mainly focuses on the integrity and availability of application systems and their information, as well as privacy. To ensure the confidentiality of private information and prevent unauthorized modification of data and leakage of privacy information, the internal information contained in government offices mainly... This includes important government documents, important government plans, business approvals, and personal privacy information.

5.3.4 Security Protection Level Identification Security protection level identification for internet-based e-government systems shall be conducted in accordance with GB/T 22240, and security framework design shall be carried out in accordance with GB/T 22239. Framework construction.

5.4 Safety Design

5.4.1 Select security control items Based on the application scope, application model, security requirements and expectations of the Internet-based e-government system, as well as the cloud computing and big data technologies adopted... Based on and traditional database and other application technologies, select appropriate security technologies and security controls, and construct corresponding security systems based on the internet, as described in Chapters 6 and 8. Implementation framework for cybersecurity in online e-government.

5.4.2 Design of Safety Technology System To ensure the secure application of internet-based e-government systems (including secure government office and trusted government services), and to realize government... For secure information transmission over the internet, it is advisable to rely on services such as digital certificates provided by PKI, and to comprehensively adopt cryptographic-based security measures. The entire technology suite covers perimeter protection, secure device access and secure communication networks, government cloud service security, government data security, and government cloud application security. It encompasses comprehensive security control and auditing, forming an integrated security protection system.

5.5 Safety Implementation Based on the identification of internet-based e-government systems, and according to security strategies and the designed security technology system, a security system is constructed. The mechanisms and security measures should be designed to build a secure government network and a secure government office platform, focusing on three aspects. government networks, government offices, and government services. The Trusted Government Service Platform provides security protection for internet-based e-government systems, specifically as follows:

a) Employing technologies such as cryptography, firewalls, VPNs, and micro-segmentation, relying on the internet, and using various means such as wired and wireless connections, at each access point... A virtual, secure government service network is formed between the unit and the government service center;

b) Employ technologies such as government personnel identity authentication, authorized access to government resources, and classified protection of government information to safeguard the internal operations of government departments. Security protection should be provided for government affairs processing systems (such as government office and government approval management systems) to achieve secure government office operations;

c) Employ security technologies such as government personnel identity verification, government information release review, and reliable operation of government services to safeguard one-stop government services. The platform is protected for security purposes to ensure reliable government services.

d) For the general public, corporate entities, and other recipients of government services, it is advisable to use real-name registration, identity verification, password or token login, and backend access control. Through methods such as limitation and control, convenient and reliable integrated government services can be achieved.

5.6 Operation and Evaluation

5.6.1 Authorizing e-government systems Based on the security risk assessment report of the Internet-based e-government system, the current security status and security risks of the e-government system are determined. Within the scope of authorization, the e-government system is permitted to continue operating, and the organization is authorized to conduct regular testing and evaluation of security strategies and technologies. And the effectiveness of operational measures.

5.6.2 Monitor safety status Real-time monitoring of internet e-government systems is achieved through system identification, security monitoring, surveillance analysis, security auditing, and situational awareness. Monitoring and analyzing network and host activity, user and system behavior, statistically tracking abnormal network behavior, and identifying violations of security policies enable management to... Personnel are able to effectively monitor, control, and evaluate security behaviors in internet-based e-government systems.

5.6.3 Assess the security system For internet-based e-government systems under construction or in operation, methods such as analysis, verification, inspection, scanning and detection, and penetration testing are employed. A security assessment was conducted in accordance with relevant national standards for graded protection, cryptographic applications, and cloud applications, and the system underwent compliance verification and security risk assessment. The assessment aims to ensure that all security mechanisms comply with the requirements for implementing cybersecurity in internet-based e-government and reduce cybersecurity risks. Safety assessments generally include two types. project acceptance assessments and periodic assessments during operation. This applies to internet-based e-government systems. After conducting a security assessment, a cybersecurity assessment report is provided, and based on the results of the cybersecurity risk assessment, recommendations are made for internet-based e-government systems. A comprehensive safety rectification campaign will be carried out.

5.7 System Migration and Decommissioning Before the termination or partial termination of an internet-based e-government system, systems, devices, or storage media containing data shall be managed in accordance with security policies. To completely, thoroughly, and securely erase and overwrite it, making it unrecoverable and unusable; for important devices or storage media containing sensitive information, it is necessary to... Choose a qualified organization to carry out safe destruction and keep a record of the process. Before migrating an internet-based e-government system, data should be backed up as needed, and the migration should be carried out according to business migration standards to ensure the security of government operations. A completely smooth migration supports the availability, stability, and continuity requirements of government services.

8.1 System Implementation Framework under Traditional Business Deployment Model

8.1.1 Basic Structure In the construction of internet-based e-government systems, relevant municipal and prefecture-level government departments, based on application needs, adopted traditional hardware server deployment models. This involves building data storage and application systems using a traditional business deployment model. Under this model, administrative office areas such as counties/townships utilize... The internet facilitates data sharing and management, enabling remote work users to securely access data remotely via the network, thus requiring a more robust security system. Note the network security of the Internet e-government application area and the user side. Its implementation framework is shown in Figure 3.

8.1.2 User side The user side refers to users who access the e-government application area via the internet. This includes. public users/corporate entities, and remote workers. Users, county and district administrative office users, and township administrative office users.

8.1.3 Boundary protection equipment Boundary protection devices are typically high-performance firewalls located at the boundary of the internet e-government application area, implementing network security policies. Network access control and intrusion prevention.

8.1.4 VPN Gateway Located behind the border protection equipment, together with the VPN gateway or VPN client on the user side, they jointly construct an internet-based virtual network. A simulated secure government network enables secure mobile access for remote administrative users, supporting secure access for district/county/township administrative users. Full office and information exchange.

8.1.5 Internet-based e-government application areas The area of internet-based e-government applications encompasses data storage, data processing, network operation and maintenance, and security management. The area for data management and security services includes four zones. internal data processing zone, public data processing zone, security management zone, and security service zone. Internal The data processing area stores database servers and application services related to government affairs, such as the internet-based e-government office platform and data sharing platform. The public data processing area stores databases of internet-based government service systems and administrative approval systems that are accessible to the general public and corporate entities. Servers and application servers. The security management area stores terminals or servers that centrally manage user identities, permissions, policies, and other information. The security service area is a convenient space for users to perform security operations and maintenance, storing security services such as patch update downloads, website anti-tampering, and malicious code protection. Server. In areas where e-government is used, internal government data and publicly available data are stored separately according to their sensitivity levels. Effective isolation is achieved through domain control devices, and one-way controlled exchange of information between different data processing areas is realized using secure data exchange technology. Mutual support for the compliant use of government data.

8.1.6 Public Administration Business Area Public government service areas and e-government application areas are securely isolated. When cross-domain data sharing is required, it is done through security... All switching devices share data.

8.2 System Implementation Framework under Cloud Computing Deployment Model

8.2.1 Basic Structure Unlike traditional business deployment models, the construction and operation of internet-based government systems rely on government cloud infrastructure. This is achieved through cloud computing deployment. Under this model, municipal and prefecture-level government departments build government cloud and data centers, or cascade them with higher-level government clouds, and build separate servers on the basis of the government cloud. Government office applications for government personnel, government service applications for the public and enterprise users, and security management platforms for security management and operation. The platform is a security service platform for preventing malicious code and providing patch updates. It is integrated with the subordinate municipal and prefecture-level vertical management departments, township administrative office areas, and... Secure access and interconnection for remote office users, building a virtualized and secure government network to achieve secure remote government office work and secure data sharing. Information reporting and aggregation. The security system implementation framework under the cloud computing deployment model is shown in Figure 4.

8.2.2 Government Cloud In the application of e-government via the internet, cloud computing deployment models include. public cloud, private cloud, hybrid cloud, and cloud leasing, etc., which are collectively referred to here. This is called government cloud. When municipal and prefecture-level government departments adopt a cloud deployment model, they can choose cloud service providers that have passed the evaluation. The selection of cloud service providers and deployment requirements... See GB/T 31167 for details, or you can rent other internet-connected e-government services...