GB/T 28452-2012Information security technology - Common security technique requirement for application software system (English PDF)

National Standard of the People's Republic of China

ICS

35.020

Classification

L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Contents

• Introduction
• 1 Scope
• 2 Normative references
• 3 Terms and definitions, abbreviations
• 3.1 Terms and definitions
• 3.2 Acronyms
• 4 application software life cycle Safety requirements
• 4.1 application software beginning Safety requirements
• 4.2 Application Software obtained or developed stage 3 Safety requirements
• 4.3 application software implementation and evaluation phase 3 Safety requirements
• 4.4 application software operation and maintenance phase 4 Safety requirements
• 4.5 application is terminated and disposal phases Safety requirements
• 5 The first application software system security technical requirements
• 4 technical requirements 5.1 security features
• 5.1.1 User authentication
• 5.1.2 Discretionary Access Control
• 5.1.3 User data integrity protection
• 5.1.4 Backup and Recovery
• 5.2 Technical requirements for security guarantees
• 5.2.1 Security Subsystem own security requirements
• 5.2.2 security subsystem design and implementation requirements
• 6 second-stage application software system security technical requirements
• 6.1 Technical requirements 8 security features
• 6.1.1 user authentication
• 6.1.2 Discretionary Access Control
• 6.1.3 Security Audit
• 6.1.4 integrity of user data protection
• 6.1.5 User data privacy protection
• 6.1.6 Backup and Recovery
• 6.1.7 Detection and Analysis System Security
• 6.2 Technical security assurance requirements
• 6.2.1 security subsystem itself claimed
• 6.2.2 security subsystem design and implementation requirements
• 7 Third level application software system security technical requirements
• 7.1.1 User authentication
• 7.1.2 Non-repudiation
• 7.1.3 Discretionary Access Control
• 7.1.4 numeral
• 7.1.5 Mandatory Access Control
• 7.1.6 Security Audit
• 7.1.7 User data integrity protection
• 7.1.8 User data privacy protection
• 7.1.9 Backup and Recovery
• 7.1.10 security detection and analysis system
• 7.2 Technical security assurance requirements
• 7.2.1 security subsystem itself claimed
• 7.2.2 security subsystem design and implementation requirements
• 8 The fourth application software system security technical requirements
• 8.1.1 User authentication
• 8.1.2 Non-repudiation
• 8.1.3 Discretionary Access Control
• 8.1.4 mark
• 8.1.5 Mandatory Access Control
• 8.1.6 Security Audit
• 8.1.7 User data integrity protection
• 8.1.8 User data privacy protection
• 8.1.9 Trusted Path
• 8.1.10 Backup and Recovery
• 8.1.11 security detection and analysis system
• 8.2 Technical security assurance requirements
• 8.2.1 security subsystem itself claimed
• 8.2.2 security subsystem design and implementation requirements
• 9 The fifth application software system security technical requirements
• 9.1.1 User authentication
• 9.1.2 Non-repudiation
• 9.1.3 Discretionary Access Control
• 9.1.4 marker
• 9.1.5 Mandatory Access Control
• 9.1.6 Security Audit
• 9.1.7 User data integrity protection
• 9.1.8 User data privacy protection
• 9.1.9 Trusted Path
• 9.1.10 Backup and Recovery
• 9.1.11 security detection and analysis system
• 9.2 Technical security assurance requirements
• 9.2.1 security subsystem itself claimed
• 9.2.2 security subsystem design and implementation requirements
• Annex B (informative) Application Software System Security and Information Systems Security Relationship