GB/T 36627-2018Information security technology—Testing and evaluation technical guide for classified cybersecurity protection (English PDF)

3.1 Terms and definitions

Terms and definitions defined in GB 17859-1999 and GB/T 25069-2010 as well as the followings apply to this file.

3.2 Abbreviations

The following abbreviations apply to this file. CNVD. China National Vulnerability Database

4.1 Technical classification

Testing and evaluation technology that can be used to classified testing and evaluation can be divided into the following three categories.

4.2 Selection of technology

When selecting and determining technology method that is used for classified testing and evaluation activities, the factors that shall be considered mainly include but not limited to target of testing and evaluation, applicability of testing and evaluation technology, security risk that might be introduced by testing and evaluation technology to target of testing and evaluation, so as to select a suitable technology method.

5.1 Check technology

5.1.1 File check

Main function of file check is based on files that are provided by operation authority of classified protection target, to evaluate technical accuracy and integrity of file policy and procedures. When performing file check, the following […]

5.1.2 Log check

Main function of log check is to verify whether security control measures record appropriate information such as information system of target of testing and evaluation, use of equipment and devices, history record of configuration and modification, whether operation using authority of classified protection target adhere to log management policy.

5.1.3 Rule set check

Main function of rule set check is to discover vulnerability of security control measures based on rule set. Check targets include access control list, policy set of network equipment, security equipment, database, operating system and application system. Level-three and above protection targets shall also include mandatory access control mechanism. When performing rule set check, it shall consider the following evaluation key elements and evaluation principles.

5.2.2 Network port and service identification

Main function of network port and service identification is to identify open port, relevant service and application program on active device. When performing network port and service identification, it shall consider the following evaluation key elements and evaluation principles.

5.2.3 Vulnerability scanning

Main function of vulnerability scanning is to identify known vulnerability of host and open port, to provide suggestion so as to reduce vulnerability risk. At the same time, it helps to identify outdated software version, missing patches and misconfiguration. Verify compliance with organizational security policy. When performing vulnerability scanning, it shall consider the following evaluation key elements and evaluation principles.

5.2.4 Wireless scanning

Main function of wireless scanning is to identify situation where there is no physical connection (such as a network cable or peripheral cable) in testing environment to make one or more devices communicate, help organization assesses and analyzes security risks that wireless technology poses for scanning target.

5.3.3 Remote access test

Main function of remote access test is to evaluate vulnerabilities in remote access method to discover unauthorized access method. When performing remote access test, it shall consider the following evaluation key elements and evaluation principles. […]