GB/T 28448-2019Information security technology —Evaluation requirement for classified protection of cybersecurity (English PDF)

3.1 Interview

The process that the evaluator helps the evaluator understand, clarify, or obtain evidence by guiding the relevant personnel of the classified protection target through purposeful (targeted) communication.

3.2 Examine

The process that the evaluator observes, inspects, analyzes the evaluation target of testing-evaluation (such as system documents, various types of device and related security configurations, etc.) to help the evaluator understand, clarify or obtain evidence.

3.3 Test

The process that the evaluator uses a predetermined method / tool to make the target of testing-evaluation (various types of device or security configuration) produce a specific result, meanwhile compare the running result with the expected result.

5.1 Method of testing-evaluation for classified cybersecurity protection

The basic method of implementation of testing-evaluation for classified cybersecurity protection is, focusing on specific evaluation targets, to adopt relevant evaluation methods; follow certain evaluation procedures; obtain required evidence data; give an evaluation of whether a certain level of security protection capability is reached. The detailed process and method for the implementation of testing-evaluation for classified cybersecurity protection are as shown in GB/T 28449-2018.

The testing-evaluation of each requirement in this standard constitutes a single item testing-evaluation; all the specific testing-evaluation contents of a specific requirement constitute the evaluation implementation. Each specific testing-evaluation implementation requirement item in the single item testing-evaluation (hereinafter referred to as "testing-evaluation requirement item") corresponds to the requirement item (testing-evaluation index) included under the security control point. In the testing-evaluation of each requirement, it may use three testing-evaluation methods. interview, examine, test; it may also use one or two of them. The content of the testing-evaluation implementation fully covers the testing-evaluation requirements of all the requirement items in GB/T 22239-2019 and GB/T 25070-2019. When used, it shall, from the implementation of the testing-evaluation of single item, choose the testing-evaluation requirements of each requirement item in GB/T 22239-2019; meanwhile follow these testing-evaluation requirements to develop the testing-evaluation guidance, so as to standardize and guide testing-evaluation for classified cybersecurity protection activities.

According to the survey results, the business process and data flow of the classified protection targets are analyzed to determine the scope of the testing-evaluation work. Combined with the security level of the classified protection target, comprehensively analyze the functions and characteristics of each device and component in the system; determine the testing-evaluation target at technical level from the attributes of the importance, security, sharing, comprehensiveness, appropriateness of the classified protection target constituting the component; determine the personal and management documents related to it as the testing-evaluation target of the management level.

The testing-evaluation targets can be described according to categories, including computer rooms, business application software, host operating systems, database management systems, network interconnection device, security device, interviewers, security management documents.

The testing-evaluation activities for classified cybersecurity protection involve testing-evaluation intensity, including testing-evaluation breadth (coverage) and testing-evaluation depth (intensity). For the implementation of testing-evaluations with a higher level of security protection, it shall choose a wider coverage of testing-evaluation targets and stronger testing-evaluation methods, to obtain more credible testing-evaluation evidence. For a detailed description of the testing-evaluation intensity, see Appendix A.

Each level of testing-evaluation requirements includes 5 parts. general requirements for security testing-evaluation, extended requirements for cloud computing security testing-evaluation, extended requirements for mobile internet security testing-evaluation, extended requirements for IoT security testing-evaluation, extended requirements for industrial control system security testing-evaluation. For bigdata, please refer to Appendix B for the security testing-evaluation method.

5.2 Single item testing-evaluation and overall testing-evaluation

Testing-evaluation for classified cybersecurity protection includes single item testing-evaluation and overall testing-evaluation.

Single item testing-evaluation is a testing-evaluation of each security requirement item, which supports the repeatability and reproducibility of the testing-evaluation results. The single item testing-evaluation in this standard consists of testing-evaluation index, testing-evaluation targets, testing-evaluation implementation, unit judgment results. For ease of use, each testing-evaluation unit is numbered. For a detailed description, see Appendix C.

The overall testing-evaluation is based on a single item testing-evaluation, to judge the overall security protection ability of the classified protection target.

The overall security protection capability is judged from the perspectives of depth protection and complementary measures.

6.1 General requirements for security testing-evaluation

6.1.1 Security physical environment

6.1.1.1 Physical access control

6.1.1.1.1 Testing-evaluation unit (L1-PES1-01)

The testing-evaluation unit includes the following requirements.

a) Testing-evaluation index. The entrance and exit of the computer room shall be arranged with dedicated personnel on duty or equipped with electronic access control systems to control, identify and record the personnel entering.

b) Testing-evaluation targets. Electronic access control system and duty records of computer room.

c) Testing-evaluation's implementation. It shall check whether a dedicated person is on duty or equipped with an electronic access control system.

d) Unit judgment. If the content of the above testing-evaluation is positive, it meets the index requirements of the testing-evaluation unit; otherwise, it does not meet the index requirements of the testing-evaluation unit.

6.1.1.2 Anti-theft and anti-vandalism

6.1.1.2.1 Testing-evaluation unit (L1-PES1-02)

The testing-evaluation unit includes the following requirements.

a) Testing-evaluation index. The device or main components shall be fixed and marked with signs that are not easily removed.

b) Testing-evaluation target. Computer room's device or main components.

c) The implementation of the testing-evaluation includes the following.

1) It shall check whether the device or main components in the computer room are fixed;

2) It shall check whether the device or main components in the computer room are provided with obvious signs that are difficult to remove.

d) Unit judgment. If both 1) and 2) are positive, it meets the index requirements of this testing-evaluation unit; otherwise, it does not meet or partially meets the index requirements of this testing-evaluation unit.

7.1 General requirements for security testing-evaluation

7.1.1 Security physical environment

7.1.1.1 Selection of physical location

7.1.1.1.1 Testing-evaluation unit (L2-PES1-01)

The testing-evaluation unit includes the following requirements.

a) Testing-evaluation index. The computer room site shall be selected in a construction with the capability of shockproof, windproof and rainproof.

b) Testing-evaluation targets. Record documents and computer room.

c) The implementation of the testing-evaluation includes the following.

1) It shall check whether the construction has seismic approval documents for construction seismic fortification;

2) It shall check whether there is no rain leakage in the computer room;

3) It shall check whether the doors and windows of the computer room are free from serious dust caused by wind;

4) It shall check whether the roof, walls, doors, windows and ground are not damaged or cracked.

d) Unit judgment. If all of 1) ~ 4) are positive, it meets the index requirements of the testing-evaluation unit; otherwise, it does not meet or partially meets the index requirements of the testing-evaluation unit.

8.1 General requirements for security testing-evaluation

8.1.1 Security physical environment

8.1.1.1 Physical location selection

8.1.1.1.1 Testing-evaluation unit (L3-PES1-01)

The testing-evaluation unit includes the following requirements.

a) Testing-evaluation index. The computer room site shall be selected in a construction with the capability of shockproof, windproof and rainproof.

b) Testing-evaluation targets. Record documents and computer room.

c) The implementation of the testing-evaluation includes the following.

1) It shall check whether the construction has seismic approval documents for construction seismic fortification;

2) It shall check whether there is no rain leakage in the computer room;

3) It shall check whether doors and windows are free from serious dust caused by wind;

4) It shall check the roof, walls, doors, windows and ground for damage and cracking.

d) Unit judgment. If all of 1) to 4) are positive, it meets the index requirements of the testing-evaluation unit; otherwise, it does not meet or partially meets the index requirements of the testing-evaluation unit.

8.1.1.1.2 Testing-evaluation unit (L3-PES1-02)

The testing-evaluation unit includes the following requirements.

a) Testing-evaluation index. The computer room site shall be avoided on the top floor or basement of the construction; otherwise, it shall strengthen the waterproof and moisture-proof measures.

b) Testing-evaluation target. Computer room.

c) Testing-evaluation's implementation. It shall check whether the computer room is not located on the top floor or basement of the construction where it is located. If not, check whether the computer room takes waterproof and moisture-proof measures.

d) Unit judgment. If the content of the above testing-evaluation is positive, it meets the index requirements of the testing-evaluation unit; otherwise, it does not meet the index requirements of the testing-evaluation unit. […]