GB/T 35283-2017Information security techniques -- Specification for the structure of desktop core configuration baseline (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard by the National Information Security Standardization Technical Committee (SAC/TC260) and focal point.

This standard was drafted unit. National Information Center, China Information Security Assessment Center, University of Chinese Academy of Sciences, Ministry of Public Security Bureau Information Bureau Heart, CAAC Information Center, Beijing Beixinyuan Software Co., Ltd., Huawei Technologies Co., Ltd., Hangzhou Yinggao Technology Co., Ltd.

Introduction

The computer terminal operating system, office software, browser and other basic software for core configuration management, can effectively block the system security leak Hole, enhance security and controllability of the terminal, protect data security and user privacy, and improve the overall computer terminal of our government, enterprises and institutions Safety level.

Government Terminal core configuration series of standards is based on China's information security (sub) level protection requirements, based on China's government terminal security Actual needs, and draw lessons from the relevant foreign research results. The series of standards GB/T 30278-2013 "information security technology government Computer Terminal Core Configuration Specification "has been promulgated and implemented, which provides the basic configuration of the government computer terminal core concepts and requirements, nuclear the heart of the configuration of automated methods to regulate the core configuration of the implementation process and provide the basis for this standard. This standard is studying Windows Based on the security configuration method, learn from other operating system security configuration method, the provisions of the computer core configuration baseline structure and layers Prime labeling rules, and gives examples of baseline application methods. The core configuration baseline is based on the requirements of each unit information system security protection Computer terminal core configuration policy set for automated core configuration deployment and compliance management for large-scale computer terminals.

On the one hand, technicians can develop core configuration baseline generation and resolution tools with reference to this standard for automated deployment of core configuration baselines and monitoring and management. On the other hand, a technician can write a new baseline of safety configuration with reference to the baseline structure specified in this standard, thereby continuously expanding Exhibition computer terminal security configuration of the scope of application, improve the level of automation applications.

Information Security Technology Computer Terminal Core Configuration Baseline Structure Specification

1 Scope

This standard specifies the basic elements of the computer terminal core configuration baseline, standardizing the XML-based core configuration baseline marking rules, and gives the core configuration example of the application of the baseline method.

This standard applies to the computer terminal of the core configuration automation, including the computer terminal core configuration automation tool design, open Hair and application.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version applies to this article Pieces. For undated references, the latest edition (including all amendments) applies to this document.

Specification of XML - based electronic official document format - Part 1. General principles Information technology - Computerized terminal computer core configuration specifications

3 Terms and definitions

GB/T 30278-2013 and GB/T 19667.1-2005 and the following terms and definitions apply to this document.

Core configuration item (configuration item) coreconfigurationitem Computer operating systems, office software, browsers, BIOS systems and anti-malicious code software and other basic software affect the computer security the key parameters of options.

Note The core configuration item types include switch items, enumeration items, interval items, and compound items that can be assigned according to safety requirements.

[GB/T 30278-2013, Definition 3.2] 3.2 Core configuration Set the parameters of the core configuration items.

Note. Enabling or enhancing security features to limit or prevent the existence of security breaches or vulnerabilities through core configuration enhances your computer against security risks Ability.

[GB/T 30278-2013, Definition 3.3] 3.3 Core Configuration Baseline A set of base values of one or more core configuration items that satisfy basic computer security requirements.

Core Configuration Baseline package A core configuration data file with a specific syntax format developed for the core configuration of baseline automated deployment.

[GB/T 30278-2013, Definition 3.7]