GB/Z 41290-2022Information security techniques - Guidelines for mobile internet security audit (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part

1.Structure and Drafting Rules of Standardization Documents" drafted. Please note that some content of this document may be patented. The issuing agency of this document assumes no responsibility for identifying patents. This document is proposed and managed by the National Information Security Standardization Technical Committee (SAC/TC260). This document was drafted by: Beijing Jiaotong University, Beijing Sifudi Information Technology Co., Ltd., Beijing Information Technology University, China Information Communication Technology Group Co., Ltd., Inspur Software Technology Co., Ltd., China Network Security Review Technology and Certification Center, ZTE Corporation Company, Lenovo (Beijing) Co., Ltd. The main drafters of this document. Liu Yun, Zhang Zhenjiang, Si Xiameng, Zeng Jianjun, Han Xiaolu, Zhang Yaochen, Wu Di, Shen Bo, Zhao Yingsi, Xiong Fei, Wang Jianwei, Zhong Hong, Li Ruxin. Information Security Technology Mobile Internet Security Audit Guidelines

1 Scope

GB/Z 41290-2022 is the Chinese national standard on information security techniques - guidelines for mobile internet security audit, in the field of information technology. The /Z suffix marks it as a guiding technical document: it does not prescribe requirements that can be certified against, but sets out the technique, the method or the state of the art that the standards bodies recommend following. It was issued on 9 March 2022 by the State Administration for Market Regulation; Standardization Administration of China. As a guiding technical document it carries no separate date of entry into force: it applies from publication. Classification: ICS 35.030, CCS L80. This page is published from the official record of the standard held by the Chinese standards administration: the identification, the dates, the classification and the issuing body are taken from there. The clause text, the tables and the numeric limits are in the document itself, which is delivered complete in English translation.

This document provides guidance and suggestions on the roles and responsibilities, audit scope, and audit content of mobile Internet security audit activities. The framework, functional tasks and specific content of security audit activities are presented. This document applies to activities related to mobile Internet security audits.

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 17143.6-1997 Information Technology Open System Interconnection System Management Part

3 Terms and Definitions

GB/T 17143.6-1997, GB 17859-1999, GB/T 18336.2-2015, GB/T 25069 and GB/T 35281- 2017 and the following terms and definitions apply to this document.

3.1 mobile internet mobile internet Users use mobile terminals (including mobile phones, network cards, tablet computers, smart books, etc.) to obtain mobile communication network services through mobile networks An open infrastructure telecommunications network for and Internet services. [Source: GB/T 35281-2017, 3.1.1]

3.2 Events are recorded and analyzed, and comparative actions are taken for specific events. [Source: GB/T 20945-2013, 3.2]

3.3 securityauditdomain In information systems and networks, under a single security audit policy, the security audit subject is responsible for the collection of audit entities.

3.4 privatedata The data that the security audit subject privately owns and needs to protect.

6 Log Control Function

GB 17859-1999 Criteria for classification of security protection levels of computer information systems

GB/T 18336.2-2015 Information Technology Security Technology Information Technology Security Assessment Criteria Part