Valid

GB/T 42708-2023Guideline for financial cybersecurity threat information sharing (English PDF)

金融网络安全威胁信息共享指南

Preview PDF

This is a limited preview

Buy now to download the full PDF (15 pages)

Need quotation for your management?

Get a formal quotation for GB/T 42708-2023 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

August 6, 2023

Implementation date

August 6, 2023

Scope

GB/T 42708-2023 is the English-translated version of 金融网络安全威胁信息共享指南.

This document gives the framework for sharing information on financial cybersecurity threats, together with the principles, methods and process of sharing, the management of quality, and recommendations on the mechanisms that support it and on security management.

The document applies to financial institutions and the related organisations that take part in such sharing.

Found what you need?

Document preview — GB/T 42708-2023

National Standard of the People's Republic of China

ICS: 35.240.40
Classification: A 11

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

PrefaceI
Introduction
1 Scope
2 Normative reference documents
3 Terms and Definitions
4 Abbreviations
5 General
6 Threat Information Sharing Framework
7 Threat Information Sharing Principles
8 Threat information sharing methods
9 Threat Information Sharing Process
9.1 Basic process of threat information sharing
9.2 Threat information analysis
9.3 Threat information sharing
9.4 Use of threat information
9.5 Threat information usage feedback
10 Threat Information Quality Management
10.1 Threat Information Component Format
10.2 Comprehensive assessment of threat information
11 Threat information sharing guarantee mechanism
12 Threat information sharing security management
12.1 Access control
12.2 Data Management
12.3 Security Audit
12.4 Emergency response
Appendix A (informative) Typical financial network security threat information sharing scenarios
A.1 Threat information sharing among network security service providers
A.2 Threat information sharing among infrastructure providers
A.3 Threat information sharing between different financial institutions
A.4 Threat information sharing among financial institutions' business partners
Reference

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

Introduction

Currently, Internet technology is widely used in the financial industry. Network technology not only brings convenience to users, but also brings network security threats.

The financial industry enhances its ability to obtain network security threat information and strengthens the sharing and use of threat information, which will help improve the overall network security prevention and control. level.

Financial network security threat information sharing aims to use technical means to achieve the effective flow of network security threat information.

Information sharing mechanism promotes the integration and analysis of threat information, improves the accuracy of threat information utilization, and achieves timely early warning and response to security risks. response and disposal to reduce the cost of using financial network threat information and improve financial network risk handling capabilities. Financial Cybersecurity Threat Information Sharing Guide

1 Scope

This document provides the sharing framework, sharing principles, sharing methods, sharing process, quality management, and guarantee of financial network security threat information. Suggestions on mechanisms, safety management, etc.

This document is applicable to financial institutions and related organizations that participate in information sharing on financial cybersecurity threats.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 2260 Administrative division code of the People's Republic of China

GB/T 2659 Name codes of countries and regions around the world

GB 32100 Unified Social Credit Code Coding Rules for Legal Persons and Other Organizations

3 Terms and definitions

The following terms and definitions apply to this document.

3.1 Threat

Potential causes of undesired events that may cause harm to a system or organization. [Source: GB/T 29246-2017,2.83]

3.2 Threat information

An evidence-based knowledge used to describe existing or possible threats to enable response and prevention of threats.

Note: Threat information includes context, attack mechanism, attack indicators, possible impact and other information. [Source: GB/T 36643-2018,3.3]

3.3 Threat information controller

Organizations or individuals who have the ability to determine the purpose, method, etc. of processing threat information.

3.4 Sharing

The process in which threat information controllers provide threat information to other controllers, and both parties have independent control over the threat information.

4 Abbreviations

The following abbreviations apply to this document.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 15 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB/T 42505-2023|GB/T 42777-2023|GB/T 42815-2023|GB/T 21079.2-2022|GB/T 14714-2008|GB/T 18240.6-2004

How to Download GB/T 42708-2023

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.