GB/T 34080.4-2021Security specification of electronic government common platform based on cloud computing—Part 4: Application security (English PDF)

Foreword

GB/T 34080 ``Security Specifications for Public Platforms of E-Government Based on Cloud Computing'' is divided into the following 4 parts.

---Part 1: General requirements;

---Part 2: Information Resource Security;

---Part 3: Service Security;

---Part 4: Application Security. This part is Part 4 of GB/T 34080.

This section was drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

The development of e-government is in a critical transition period of changing the development mode, deepening the application and highlighting the results. Government function transformation and service-oriented Government construction puts forward newer and higher requirements for the development of e-government affairs. Emerging information technologies, industries, and applications represented by cloud computing continue to The emergence has profoundly changed the technological environment and conditions for the development of e-government application services. Building a public platform for e-government based on cloud computing can Give full play to the role of existing resources and the potential of emerging information technology, accelerate the development and innovation of e-government, improve application support service capabilities, and enhance Security assurance capabilities, reduce duplication of construction, and avoid self-governance and information islands.

Application service refers to the direct use of various application service software provided on the e-government public platform by government affairs departments to quickly realize business applications.

Used service. The e-government public platform shall plan, design, develop and deploy government website systems, mail systems, instant messaging, electronic General application service software such as official document transmission system, electronic signature system, office system, etc., can be called by various government affairs departments on demand. E-government public Platform service providers must fully consider the application security risks brought by the application of cloud computing technology, and address possible data loss and leakage, Share technical vulnerabilities, insecure application program interfaces and other issues, and design corresponding application security protection measures.

1 Scope

This part of GB/T 34080 specifies the application security implementation, application security operation and maintenance, application security of the public e-government platform based on cloud computing. Use security management and application security testing.

This part is applicable to the security construction, implementation and management process of applications provided on the public platform of e-government based on cloud computing.

Note: Unless otherwise specified, "e-government public platform" and "public platform" in the following chapters refer to "cloud computing-based e-government public platform".

2 Normative references

The following documents are indispensable for the application of this document. For dated reference documents, only the dated version applies to this document. For undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 34078.1-2017 Cloud Computing-based E-government Public Platform General Specification Part 1: Terms and Definitions

GB/T 34080.1-2017 Cloud Computing-based E-government Public Platform Security Specification Part 1: General Requirements

3 Terms and definitions

The following terms and definitions defined in GB/T 34078.1-2017 and GB/T 34080.1-2017 apply to this document.

4 Abbreviations

The following abbreviations apply to this document. FTP. File Transfer Protocol (FileTransferProtocol) SSH. Secure Shell (SecureShel) WWW. World Wide Web (WorldWideWeb)

5 Analysis of application security threats on public platforms