GB/T 36958-2018Information security technology—Technical requirements of security management center for classified protection of cybersecuriy (English PDF)
信息安全技术 网络安全等级保护安全管理中心技术要求
This is a limited preview
Buy now to download the full PDF (49 pages)
Need quotation for your management?
Get a formal quotation for GB/T 36958-2018 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
December 28, 2018
Implementation date
July 1, 2019
Scope
GB/T 36958-2018 is the English-translated version of 信息安全技术 网络安全等级保护安全管理中心技术要求.
GB/T 36958-2018 sets the technical requirements for the security management center used in the classified protection of cybersecurity, the platform that centrally manages security policies and mechanisms across the computing environment, area boundaries and communication network.
After an overview of the center, it gives separate requirements for second-, third- and fourth-level centers, covering system management and data protection, security event and risk management, interfaces with third-party plug-ins and agents, and the self-security of the console, from identity authentication and access control to audit and data security.
Fifth-level requirements are to be formulated separately, and a clause deals with cross-grading systems. It guides security vendors and operating organizations that design, build and run such centers. It was issued on 28 December 2018 and has applied since 1 July 2019.
Found what you need?
Document preview — GB/T 36958-2018
National Standard of the People's Republic of China
- ICS
- 35.040
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword3
- Introduction4
- 1 Scope5
- 2 Normative references5
- 3 Terms and definitions5
- 4 Abbreviations6
- 5 Overview of security management center6
- 6 Technical requirements for the second-level security management center9
- 7 Technical requirements for the third-level security management center17
- 8 Technical requirements for the fourth-level security management center29
- 9 Technical requirements for fifth-level security management center44
- 10 Technical requirements for security management center of cross-grading system44
- Appendix A (Normative) Correspondence between security management center and cybersecurity classified protection object's level46
- Appendix B (Normative) Classification of technical requirements of security management center47
- Appendix C (Informative) Normalized security event attributes49
Foreword
This standard was drafted in accordance with the rules given in GB/T 1.1-2009.
Please note that certain contents of this document may involve patents. The issuing agency of this document is not responsible for identifying these patents.
1 Scope
This standard specifies the technical requirements for the cybersecurity classified protection for security management center.
This standard is applicable to guide security manufacturers and operating & using organizations to design, construct and operate security management centers in accordance with the requirements of this standard.
2 Normative references
The following documents are essential to the application of this document. For the dated documents, only the versions with the dates indicated are applicable to this document; for the undated documents, only the latest version (including all the amendments) are applicable to this standard.
GB/T 5271.8 Information technology - Vocabulary - Part 8: Security
GB 17859-1999 Computer information system -- Criteria for classifying security protection level
GB/T 25069 Information security technology - Glossary
GB/T 25070 Information security technology - Technical requirements of security design for information system classified protection
3 Terms and definitions
The terms and definitions as defined in GB 17859-1999, GB/T 5271.8, GB/T 25069, GB/T 25070 as well as the following terms and definitions apply to this document.
3.1 Data acquisition interface
An interface that collects security events, vulnerabilities, related configuration and status information on monitoring objects such as host operating systems, database systems, network devices, security devices in the network environment.
4 Abbreviations
The following abbreviations apply to this document.
CPU. Central Processing Unit
CVE. Common Vulnerabilities & Exposures
DDoS. Distributed Denial of Service
5 Overview of security management center
5.1 General description
The security management center, as a system platform for unified management of the security policies of the cybersecurity classified protection objects and the security mechanism of the secure computing environment, the security area boundary and the secure communication network, realizes unified management, unified monitoring, unified audit, comprehensive analysis, collaborative protection.
5.2 Function description
System management mainly uses administrators to configure, control and manage system resources and operations, including user identity management, system resource configuration, system loading and startup, abnormal handling of system operation, support for managing local and remote disaster backup and recovery.
6 Technical requirements for the second-level security management center
6.1 Functional requirements
6.1.1 System management requirements
6.1.1.2 Data protection
6.1.1.2.1 Data confidentiality
Data confidentiality shall meet the following requirements. […]
6.1.1.2.2 Data integrity
Data integrity shall meet the following requirements. […]
6.1.1.2.3 Data backup and recovery
Data backup and recovery shall meet the following requirements. […]
6.1.1.3 Security incident management
6.1.1.3.2 Security event alarm
Security event alarms shall have an alarm function, which can generate alarms based on preset thresholds when abnormalities are found.
6.1.1.3.3 Security incident response
Security incident response shall meet the following requirements. […]
6.1.1.4 Risk management
6.1.1.4.1 Asset management
Asset management shall meet the following requirements. […]
6.1.1.4.2 Threat management
Threat management shall meet the following requirements. […]
6.1.1.4.3 Vulnerability management
Vulnerability management shall allow the creation and maintenance of asset vulnerability lists; support the merging and updating of vulnerability lists.
6.2 Interface requirements
6.2.1 Third-party plug-in/agent interface protocol requirements
The security management center shall support conventional interfaces such as SNMP Trap, Syslog, Web Service, customized interfaces, third-party plug-in or agent interfaces, to implement data exchange between components and third-party platforms.
6.3 Self-security requirements
6.3.1 Identity authentication
The administrator identity authentication of the security management center console shall meet the following requirements. […]
6.3.2 Access control
The access control of the security management center console shall meet the following requirements. […]
6.3.3 Security audit
The security audit of the security management center console shall meet the following requirements. […]
6.3.4 Software fault tolerance
The software fault tolerance of the security management center console shall provide the data validity check function, to ensure that the data format or length input through the man-machine interface or through the interface meets the system setting requirements.
6.3.7 Data security
The data security of the security management center console shall meet the following requirements. […]
7 Technical requirements for the third-level security management center
7.1 Functional requirements
7.1.1 System management requirements
7.1.1.2 Data protection
7.1.1.2.1 Data confidentiality
Data confidentiality shall meet the following requirements. […]
7.1.1.2.2 Data integrity
Data integrity shall meet the following requirements. […]
7.1.1.2.3 Data backup and recovery
Data backup and recovery shall meet the following requirements. […]
7.1.1.2.4 Remaining information protection
The remaining information protection shall ensure that the storage space where the identification information of the subject and object is located is completely cleared before being released or redistributed to other subjects, regardless of whether the information is stored on the hard disk or in the memory.
7.1.1.3 Security event management
7.1.1.3.2 Security event alarm
Security event alarms shall meet the following requirements. […]
7.1.1.3.4 Event correlation analysis
Event correlation analysis shall meet the following requirements. […]
7.1.1.3.5 Statistical analysis report
The statistical analysis report shall meet the following requirements. […]
7.1.1.4 Risk management
7.1.1.4.1 Asset management
Asset management shall meet the following requirements. […]
7.1.1.4.2 Asset business value assessment
Asset business value evaluation shall support custom asset business value evaluation models, which can form asset business value levels based on parameters such as asset type, asset importance, impact after damage, scope involved.
7.1.1.5 Resource monitoring
7.1.1.5.1 Availability monitoring
Availability monitoring shall meet the following requirements. […]
7.2 Interface requirements
7.3 Self-security requirements
7.3.1 Identity authentication
The administrator identity authentication of the security management center console shall meet the following requirements. […]
8 Technical requirements for the fourth-level security management center
8.1 Functional requirements
8.1.1 System management requirements
8.1.2.3 Equipment policy management
8.1.2.3.1 Security configuration policy
Equipment management shall meet the following requirements. […]
8.1.2.3.2 Intrusion prevention
Intrusion prevention shall meet the following requirements. […]
8.1.2.3.3 Malicious code prevention
Malware prevention shall meet the following requirements. […]
8.1.2.4 Password guarantee
Password guarantee shall provide guarantee for the correctness, compliance and effectiveness of the cryptographic technology, products, services of the managed objects. In the IoT system platform, the security administrator shall conduct unified management of the keys used in the system, including the generation, distribution, update, storage, backup, destruction of the keys; meanwhile take necessary measures to ensure the security of the keys.
8.1.3 Audit management requirements
8.2 Interface requirements
8.2.1 Third-party plug-in/agent interface protocol requirements
The interface protocol requirements shall meet the following requirements. […]
8.2.2 Interface security requirements
Interface security requirements shall meet the following requirements. […]
8.3 Self-security requirements
8.3.1 Identity authentication
The administrator's identity authentication of the security management center console shall meet the following requirements. […]
8.3.7 Resource control
The resource control of the security management center console shall meet the following requirements. […]
8.3.8 Intrusion prevention
The intrusion prevention of the security management center console shall meet the following requirements. […]
8.3.9 Data security
The data security of the security management center console shall meet the following requirements. […]
9 Technical requirements for fifth-level security management center
The technical requirements for the fifth-level security management center shall be formulated separately. […]
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 49 pages — is available in the English PDF.
Referenced standards
Normative references
- GB/T 5271.8Information technology -- Vocabulary -- Part 8: Security
- GB 17859-1999Classified criteria for security protection of computer information system
- GB/T 25069Information security techniques—Terminology
- GB/T 25070Information security technology — Technical requirements of security design for classified protection of cybersecurity
Similar standards
How to Download GB/T 36958-2018
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB 17859-1999 — Classified criteria for security protection of computer information system
GB/T 25069-2022 — Information security techniques—Terminology
GB/T 25070-2019 — Information security technology — Technical requirements of security design for classified protection of cybersecurity
Secure payment via Stripe
Payments accepted
GB/T 36958-2018
$345.00