GB/T 39412-2020Information security technology—Audit specification of code security (English PDF)
信息安全技术 代码安全审计规范
This is a limited preview
Buy now to download the full PDF (34 pages)
Need quotation for your management?
Get a formal quotation for GB/T 39412-2020 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
November 19, 2020
Implementation date
June 1, 2021
Scope
GB/T 39412-2020 is the English-translated version of 信息安全技术 代码安全审计规范.
GB/T 39412-2020 is the Chinese standard "Information security technology—Audit specification of code security".
Its scope clause reads: This standard specifies the audit process of code security, security function defects, code implementation security defects, resource usage security defects, environmental protection Typical audit indicators such as environmental security deficiencies and corresponding verification methods.
This standard is applicable to guide code security audit related work. Its clauses include terms, definitions and abbreviations.
Found what you need?
Document preview — GB/T 39412-2020
National Standard of the People's Republic of China
- ICS
- 35.040
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- 1 Scope1
- 2 Normative references1
- 3 Terms, definitions and abbreviations1
- 3.1 Terms and definitions1
- 3.2 Abbreviations2
- 4 Audit overview2
- 4.1 Audit Note2
- 4.2 Audit Purpose2
- 4.3 Timing of Audit2
- 4.4 Auditor3
- 4.5 Audit Method3
- 5 Audit process3
- 5.1 Overall process3
- 5.2 Audit Preparation4
- 5.3 Audit implementation4
- 5.4 Audit report5
- 5.5 Improve tracking5
- 6 Security function defect audit5
- 6.1 Data cleaning5
- 6.2 Data encryption and protection8
- 6.3 Access Control9
- 6.4 Log Security11
- 7 Code implementation security defect audit11
- 7.1 Object-Oriented Program Security11
- 7.2 Concurrent Program Security12
- 7.3 Function call security13
- 7.4 Exception Handling Security14
- 7.5 Pointer safety14
- 7.6 Code Generation Security15
- 8 Resource use security defect audit15
- 8.1 Resource Management15
- 8.2 Memory Management16
- 8.3 Database usage18
- 8.4 File management18
- 8.5 Network Transmission19
- 9 Environmental safety defect audit19
- 9.1 Legacy debugging code19
- 9.2 Third-party software is safe and reliable19
- 9.3 Protect important configuration information20
- Appendix A (Informative Appendix) Code Security Audit Report21
- Appendix B (informative appendix) Code example22
1 Scope
This standard specifies the audit process of code security, security function defects, code implementation security defects, resource usage security defects, environmental protection
Typical audit indicators such as environmental security deficiencies and corresponding verification methods.
This standard is applicable to guide code security audit related work.
2 Normative references
The following documents are indispensable for the application of this document. For dated reference documents, only the dated version applies to this document.
For undated references, the latest version (including all amendments) applies to this document.
GB/T 15272-1994 programming language C
GB/T 25069 Information Security Technical Terms
GB/T 35273-2020 Information Security Technology Personal Information Security Specification
3 Terms, definitions and abbreviations
3.1 Terms and definitions
The following terms and definitions defined in GB/T 15272-1994, GB/T 25069 and GB/T 35273-2020 apply to this document.
3.1.1 Code security audit
Perform security analysis on the code to find code security flaws or actions that violate code security specifications.
3.1.2 Security flaw
A problem or error in the code that undermines the security capability of the software.
3.1.3 Cross-site scripting
The attacker inserts malicious HTML code into the web page, and when the user browses the page, the HTML embedded in the web
The code will be executed to achieve the attacker's special purpose.
3.1.4 Buffer overflow
Write content beyond its length to the program's buffer, thereby destroying the program stack and causing the program to execute other instructions to obtain the program.
Control of the sequence or system.
3.1.5 Deadlock
A blocking phenomenon caused by competition for resources or communication between two or more processes during the execution.
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 34 pages — is available in the English PDF.
Referenced standards
Similar standards
How to Download GB/T 39412-2020
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 10003-2026 — Biaxially oriented polypropylene (BOPP) film
GB/T 10004-2026 — Plastic/Plastic laminated films and pouches for packaging
GB/T 10007-2026 — Rigid cellular plastics - Determination of shear properties
Secure payment via Stripe
Payments accepted
GB/T 39412-2020
$515.00