GB/T 25068.1-2020Information technology. Security techniques. Network security - Part 1: Overview and concepts (English PDF)

Foreword

GB/T 25068-2020 "Information technology - Security techniques - Network security"

is currently divided into the following 5 parts.

- Part 1.Overview and concepts;

- Part 2.Guidelines for the design and implementation of network security;

- Part 3.Securing communications between networks using security gateways;

- Part 4.Securing remote access;

- Part 5.Securing communications across networks using virtual private networks.

This is Part 1 of GB/T 25068.

This Part was drafted in accordance with the rules given in GB/T 1.1-2009.

This Part replaces GB/T 25068.1-2012 "Information technology. Security techniques.

Network security -- Part 1.Overview and concepts". Compared with GB/T 25068.1-

2012, the main technical changes in this Part are as follows.

- Add the contents such as "Supporting controls", " Reference network scenarios -

Risks, design, techniques and control issues" and "Develop and test security

solution". Delete contents such as "Target" and "Crypto-based services in public

infrastructure" (see Chapter 8, Chapter 10, Chapter 12 of this Edition; Chapter 2,

Chapter 13 of Edition 2012);

- Add the contents such as "Supporting controls", "Reference network scenarios -

Risks, design, techniques and control issues" and "Develop and test security

solution". Delete contents such as "Target" and "Crypto-based services in public

infrastructure" (see Chapter 8, Chapter 10, Chapter 12 of this Edition; Chapter 2,

Chapter 13 of Edition 2012);

- Delete the dated references to GB/T 22081-2008, GB/T 25068.2-2012, and GB/T

25068.3-2010.Add the undated references to ISO/IEC 27000, ISO/IEC 27001,

ISO/IEC 27002, ISO/IEC 27005 (see Chapter 2 of this Edition; Chapter 2 of

Edition 2012);

- Delete the terms and definitions such as "security dimension" and "spam". Add the

terms and definitions such as "architecture" and "information security policy"

(see Chapter 3 of this Edition; Chapter 3 of Edition 2012);

- Delete the abbreviations such as "Telnet" and "TETRA". Add the abbreviations

such as "BPL", "CA" and "DPNSS" (see Chapter 4 of this Edition; Chapter 4 of

Edition 2012);

- Delete network connection types, identification of trust relationships, trust

relationship references, and potential vulnerability types. Add the conceptual

model of network security risk areas, network security risk assessment and

management process (see Chapter 5 ~ Chapter 8 of this Edition; Chapter 7,

Chapter 10 ~ Chapter 12 of Edition 2012);

- Add cross-references between the security control section in this Part and the

relevant provisions in ISO/IEC 27001 and ISO/IEC 27002 and the SecOPs

document sample template (see Annex A and Annex B of this Edition).

This Part uses translation method to identically adopts ISO/IEC 27033-1.2015

"Information technology - Security techniques - Network security - Part 1.Overview

and concepts".

The Chinese documents which have consistency with the international normative

reference in this Part are as follows.

- GB/T 9387 (all parts), Information technology. Open Systems Interconnection.

Basic Reference Model [ISO/IEC 7498 (all parts)];

- GB/T 22080-2016, Information technology -- Security techniques -- Information

security management systems -- Requirements (ISO/IEC 27001.2013, IDT);

- GB/T 22081-2016, Information technology -- Security techniques -- Code of

practice for information security controls (ISO/IEC27002.2013, IDT);

- GB/T 29246-2017, Information technology -- Security techniques -- Information

security management systems -- Overview and vocabulary (ISO/IEC 27000.2016,

IDT);

- GB/T 31722-2015, Information technology -- Security techniques -- Information

security risk management (ISO/IEC 27005.2008, IDT).

This Part made the following editorial modifications.

- In Chapter 2, add the international document ISO/IEC 27000 which is used as a

normative reference in the text.

This Part was proposed by and shall be under the jurisdiction of National Technical

Committee on Information Security of Standardization Administration of China

(SAC/TC 260).

The drafting organizations of this Part. Heilongjiang Provincial Cyberspace Research

Center, China Electronics Technology Standardization Institute, Beijing Antian

Network Security Technology Co., Ltd., Hangzhou Anheng Information Technology

Co., Ltd., Harbin University of Science and Technology, Xi'an Xidian Jietong Wireless

Network Communications Co., Ltd.

Main drafters of this Part. Fang Zhou, Qu Jiaxing, Ma Chao, Gu Juntao, Shubin, Liu

Jia, Li Rui, Song Xue, Ma Yao, Wang Dameng, Wu Qiong, Jiang Guochun, Feng Yana,

Zhang Hong, Si Dan, Zhang Chi, Yu Haining.

Version of standard substituted by this Part is.

- GB/T 25068.1-2012.

1 Scope

This part of GB/T 25068 provides an overview of network security and related

definitions. It defines and describes the concepts associated with, and provides

management guidance on, network security. (Network security applies to the security

of devices, security of management activities related to the devices,

2 Normative references

The following referenced documents are indispensable for the application of this

document. For dated references, only the edition cited applies. For undated references,

the latest edition of the referenced document (including any amendments) applies.

ISO/IEC 7498 (all parts), Information technology - Open systems interconnection

Basic reference model. Naming and addressing

3 Terms and definitions

person deliberately exploiting vulnerabilities in technical and non-technical security

controls in order to steal or compromise information systems and networks, or to

compromise availability to legitimate users of information system and network

resources

variant on intrusion detection systems that are specifically designed to provide an active

response capability

4 Symbols and abbreviated terms

The following abbreviated terms are used in all parts of ISO/IEC 27033.

5 Structure

The structure of the ISOI/IEC 27033 series of standards is shown in diagrammatic, or

"road map", form in Figure 2 below.

6 Overview

When an organization decides to use VoIP technologies to implement the internal

telephone network, then appropriate security gateways to the phone network are

typically present as well.

7 Identifying risks and preparing to identify security controls

The next step should be to gather and review information on the current and/or planned

network(s) - the architecture(s), applications, services, types of connection and other

characteristics - this will have a bearing on the identification and assessment of risks,

and determining what is possible in terms of network technical security

architecture/design. These aspects are described below.

8 Supporting controls

A key requirement for any network is that it is supported by secure management

activities, which will initiate and control the implementation, and operation, of security.

These activities should take place to ensure the security of all of an organization/community's

information systems. Network security management activities should include.

9 Guidelines for the design and implementation of network security

It is emphasized that the technical security architecture/design for any project should

be fully documented and agreed, before finalizing the list of security controls for

implementation.

......