GB/T 37972-2019Information security technology—Operation supervision framework of cloud computing service (English PDF)

3.1 Operation Supervisor

Independent of the relevant parties of cloud computing services, and have professional technical capabilities, an organization that conducts operation supervision.

4.1 Purpose of operation supervision

The purpose of conducting cloud computing service operation supervision is to ensure.

a) Cloud computing services continue to meet relevant national laws and regulations, administrative orders, policies and standards;

b) Cloud computing service related parties can timely and effectively grasp the operating quality and security status of the cloud computing platform;

c) The security risks of cloud computing services are controllable;

d) The security capabilities of cloud computing services continue to meet requirements.

So as to ensure the main objectives of operation supervision proposed in 8.1 of GB/T 31167-2014.

4.2 Operational regulatory framework

The cloud computing service operation supervision framework is based on the operation supervision in the national standards GB/T 31167-2014 and GB/T 31168-2014

In accordance with the request. The cloud computing service operation supervision framework is shown in Figure 1.

Figure 1 Operational regulatory framework

Cloud service providers shall implement management and technical measures such as security control, change management, and emergency response for cloud computing services, and provide

Supervisors provide supporting materials that have implemented relevant management and technical measures to form deliverables (any actual evidence that supports supervisory activities)

Body, including but not limited to various documents, pictures, audio, video, physical objects, data, etc., and are effectively stored in paper, electronic, etc.), Appendix A

The reference template of the operation supervision deliverables is given, and Appendix B is the operation supervision list of safety control measures.

The operation supervisor conducts supervision activities such as analysis, review, evaluation and verification of the deliverables of the cloud service provider, and forms the supervision result to inform the cloud computing service

If necessary, relevant parties should give reasonable opinions and suggestions based on the results of supervision.

4.3 Roles and responsibilities of operation supervision

4.3.1 Role of Operation Supervision

The operational regulatory framework consists of two main roles.

a) Cloud service provider. Cloud service providers that have passed the national cybersecurity review and provide services to government departments.

b) Operation supervisor. Management department of cloud service customers (e.g. government information security management department, competent department of cloud service customers

Etc.) The designated or commissioned operation supervisor.

4.3.2 Responsibilities of cloud service providers

Cloud service providers should ensure.

a) The security control measures in the cloud computing platform continue to be effective;

b) The risk of major changes in the cloud computing platform is controllable;

c) The emergency response in the cloud computing platform is timely and adequate;

d) Submit the required deliverables for operation supervision to the operation supervision party in accordance with the agreed content, form, frequency, manual or automatic mechanism, and ensure

The deliverables are authentic and reliable;

e) Rectify relevant management and technical measures based on the supervision results fed back by the operation supervisor.

So as to fulfill the responsibility of cloud service providers in operation supervision specified in 8.2.3 of GB/T 31167-2014.

4.3.3 Responsibilities of the operation supervisor

The operation supervisor shall.

a) Operational supervision of the security control measures, major changes and emergency response of cloud computing services;

b) Negotiate with the cloud service provider to operate the supervision interface, that is, the content, form, frequency and manual or automatic mechanism of the delivery;

c) Ensure the security of deliverables submitted by cloud service providers, and do not include deliverables and materials involving cloud service providers’ intellectual property and trade secrets

Provide to third parties;

d) Analysis and review of deliverables submitted by cloud service providers;

e) Evaluate the security capabilities of cloud computing services based on the analysis and audit results, and conduct random checks, verifications, and tests when necessary

Verify the content in the deliverable;

f) Based on the evaluation and verification conclusions, an evaluation report is formed and notified to the relevant parties of the cloud computing service, and rectification opinions and suggestions should be given when necessary.

So as to help cloud service customers to fulfill the customer's responsibility in operation supervision activities specified in 8.2.2 of GB/T 31167-2014.

5.1 Contents of safety control measures

The main content involved in security control measures includes but not limited to.

a) System development and supply chain security;

b) System and communication protection;

c) access control;

d) Configuration management;

e) maintenance;

f) Emergency response and disaster preparedness;

g) audit;

h) Risk assessment and continuous monitoring;

i) Security organization and personnel;

j) Physical and environmental safety.

5.2 Safety control measures supervision link

The regulatory aspects of safety control measures include.

a) The operation supervisor formulates safety control supervision strategies and plans, clarifies the purpose and requirements of supervision, supervision methods and means, and refines safety

The supervision content, delivery type, format and frequency of the control measures;

b) The cloud service provider shall implement the security status of the cloud computing platform in accordance with the security control measures and supervision strategies and plans formulated by the operation supervisor.

Implement continuous monitoring and submit relevant deliverables related to the effectiveness of safety control measures;

c) The operation supervisor analyzes and reviews the security control measures of the cloud computing platform based on the deliverables submitted by the cloud service provider.

At the time, the effectiveness of security control measures should be evaluated, and the results should be notified to the relevant parties of cloud computing services.

6.1 Change management content

The main content involved in change management includes but is not limited to (see 8.4.2 Major Change Supervision in GB/T 31167-2014).

a) Identification (including identification and data source identification) and changes in access control measures;

b) Changes in data storage implementation methods;

c) Changes to the backup mechanism and process;

d) Change of network connection with external service provider;

e) Changes in safety control measures;

f) Changes to deployed commercial software and hardware products;

g) Changes in cloud computing service subcontractors, such as PaaS and SaaS service providers replacing IaaS service providers;

h) Changes to the operating entity of cloud computing services;

i) Changes in the software version of the cloud computing platform;

j) Changes to cloud computing platform infrastructure;

k) Changes to the IT structure of the system.

6.2 Change management and supervision

The supervision of major changes is as follows.

a) The operation supervisor formulates a change management supervision strategy and plan, and clarifies the supervision purpose and requirements, methods and means, deliverables, etc.;

b) Before implementing major changes, cloud service providers should conduct a security impact analysis on the changes, and test the changes when necessary.

Verify and submit relevant deliverables related to the safety of major changes in accordance with the format, content, and time agreed with the operation supervisor;

c) The operation supervisor analyzes and reviews the changes to the cloud computing platform based on the deliverables submitted by the cloud service provider, and responds if necessary

The security of the changed items is evaluated and verified, and the results are notified to the relevant parties of the cloud computing service.

7.1 Emergency response content

The main content involved in emergency response includes, but is not limited to (see 8.4.3 Security Incident Supervision in GB/T 31167-2014).

a) Unauthorized access events, such as unauthorized logical or physical access to business systems, data or other computing resources under the cloud computing platform

Visit etc.;

b) A security attack event occurs, such as a denial of service attack;

c) Malicious code infection, such as cloud computing platform infected by viruses, worms, Trojan horses and other malicious codes;

d) Cloud computing platform is down;

e) Discovery of major security threats;

f) Major safety information leakage.

7.2 Emergency response supervision

The supervision of emergency response is as follows.

a) The operation supervisor formulates emergency response supervision strategies and plans, clarifies the purpose and requirements of supervision, supervision methods and means, and refines emergency response

The regulatory content, delivery type, format, etc. of the response;

b) The cloud service provider detects that it may cause the business interruption of the cloud service customer or the confidentiality and integrity of the cloud service customer data

When there is a threatening security incident, carry out and record emergency response activities, form emergency response deliverables and submit them to the operation supervisor in time;

c) The operation supervisor shall analyze and evaluate security incidents and emergency response activities based on the deliverables submitted by the cloud service provider. When necessary,

The adequacy of emergency response activities shall be evaluated and verified, and the relevant parties of cloud computing services shall be informed of the results.

8.1 Overview

The operation supervisor shall obtain information and deliverables related to the security of the cloud computing platform in an effective, accurate, and timely manner, so that the cloud computing

Computing service security capabilities to carry out analysis, evaluation, review, verification and other regulatory activities. The implementation methods for obtaining operation supervision information and deliverables include.

Manual mechanism and automatic mechanism.

8.2 Artificial mechanism

According to the content and frequency agreed with the operation supervisor, the cloud service provider submits the support operation to the operation supervisor in a determined non-online way

For the relevant deliverables of supervision activities, please refer to Appendix B for the list of deliverables.

8.3 Automatic mechanism

8.3.1 Main content

The main content of automatic mechanism supervision includes but not limited to.

a) Restrict access to various media and audit media access;

b) Centralized management, application and verification of configuration item parameters;

c) Detect new unauthorized software, hardware or firmware components added to the cloud computing service platform;

d) Maintain a list of information system components;

e) Support the incident handling process;

f) Support the incident reporting process;

g) Improve the availability of incident response support resources;

h) Integrate the review, analysis and reporting process to support the investigation and response to suspicious activities;

i) Compare the vulnerability scan results at different times to determine the trend of information system vulnerabilities;

j) Update the malicious code protection mechanism;

k) Management account;

l) Monitor and control remote access sessions to detect network attacks and ensure that remote access policies are implemented;

m) Check the components after defect repair;

n) Quasi real-time analysis of attack events;

o) Temperature and humidity control.

8.3.2 Requirements

Consider when implementing automatic mechanisms.

a) Comply with relevant national laws, administrative orders, directives, policies, regulations, standards and guidelines;

b) Use open specifications, standards, technologies and protocols;

c) Extract information from various information sources;

d) Provide interoperability with other tools;

e) Able to integrate and format the information in the process of safety control, change management and emergency response.