JR/T 0071-2012Implementation guide for classified protection of information system of financial industry (English PDF)

3.4 Security requirement

The protection class and protection level required in order to meet the security policy requirements for equipment, information, application and installation.

3.5 Integrity

It covers data integrity and system integrity. The data integrity characterizes data, i.e. the degree that the accuracy and consistency of data keep unchanged no matter how its form changes; the system integrity characterize the performance of system in fulfilling operation intention when preventing unauthorized user from modification or use of resource and preventing authorized user from improper modification or use of resource.

3.6 Availability

Characterizing the security quality of data or system in terms of the assessable and usable degree upon request of authorized entity.

3.7 Weak password

The password or secret code set in the use process of computer, which is too simple or can be cracked easily.

4.1 National requirements of classified protection

A series of legislations and standards on classified protection have been developed by the nation and are the basis for developing the classified protection system. There have been more than 50 national and industrial standards, approved standards developed and published in China, which have preliminarily formed the standard system for classified protection of information security. These standards, providing requirements and recommendations in aspects of classified protection of information security, e.g. foundation, design, implementation, management and system, provide users, designers and constructors with management specifications and technical standards, as shown in Figure 1.

system security.

The “Baseline", in all levels or respects, proposes the security requirements duly to be fulfilled by each component of system. The overall security protection ability of the information system is guaranteed by the fulfillment of the basic security requirements of various components. Besides to guarantee each system component satisfactory to the basic security requirements, the interrelationship between components shall be so considered as to guarantee the overall security protection ability of the information system.

4.1.2 Design requirements

"Information Security Technology - Technical Requirements of Security

Design for Information System Classified Protection" (GB/T 25070-2010) (hereinafter referred to as the "Design Requirements") is the direct guidance for carrying out classified protection development. Based on the "Baseline", it introduces the protection concept of defense-in-depth in a manner of systemized design. It proposes the assurance framework of assurance framework "one center, three defenses". It establishes a technical system comprehensively guaranteed by security computing environment, security zone boundary and security communication network under the unified management of security management center. It regulates technical requirements of security design for information system classified protection, including those for the design of security environment for systems of Levels I to V and of rating system interconnection. It provides scientific, reasonable and effective methods and guidance for the classified protection establishment of information system. For security technology design, appropriate security policies shall be determined.

Security protection measures shall be taken, according to the rating of information system.

The "Baseline" explicitly indicates that the design of security technology for classified protection of information system covers the design of the security protection environment and security interconnection for all levels of system, as shown in Figure 3. The security protection environment of each system level is composed of the security computing environment, security zone boundary, security communication network and (or) security management center. The rating system interconnection is composed of security interconnection components and cross-rating system security management center.

provide specific recommendations on the implementation and allocation measures (see Appendix A) so as to ensure that the basic requirements for classified protection are implemented in financial institution.

d) Implementation guide for classified protection suitable for the characteristics of financial industry

The requirements of "fortified financial industry security protection (Class F)” are added in this Standard (see Appendix B). They are supplemented and improved from relevant requirements of classified protection and financial industry so as to make this Standard closer to the characteristics and requirement of financial industry and more easily to be understood and implemented.

4.2.1 Necessity of defense-in-depth design

Security architecture of defense in depth can provides a framework of multi- layer protection so as to prevent computer threat. In this way, the attack behavior of breaching one level or class of protection is disabled to damage the infrastructure of the entire information system. The four areas, i.e. network infrastructure, zone boundary, computing environment and supportive infrastructure, are protected to achieve the objective of defense in depth. In the strategy of defense in depth, man, technology and operation are three core factors which are all indispensable to guarantee the security of information and information system. Man denotes management which also plays a very critical effect in the establishment of information security assurance system.

Technology is the foundation of security, and management is the root. As those three are closely related to the safe and stable operation of information system, to guarantee the safe and stable operation, the information system must be designed and specified in various dimensions, e.g. technology, management, individual system and overall production system.

4.2.2 Significance of the combination between basic requirements and

defense-in-depth design

The "Baseline" is the requirements for establishment of classified protection, while the "Design Requirements" is the design and implementation guideline.

The architecture of "one center, three defenses" proposed in "Design

Requirements" provides scientific and effective methodology for the implementation of classified protection, and intends to implement the "Baseline" under the ideology of systemization and industrialization. In this case, to guarantee the overall security of system, only an organic combination between the "Baseline" and the "Design Requirements" can fulfill the requirements for classified protection in a point-to-plane way.

The requirements for classified protection are ensured to be implemented in a

The two requirements refer to the assurance requirements comprehensively formed by technical and management requirements. The technical requirements involve physical security, network security, host security, application security and data security, while the management requirements involve security management system, security management setup, personal security management, system construction management, system operation and maintenance management.

The two systems refer to the assurance system comprehensively formed by the technical and management systems. The technical system, basing on the core idea of "one center, three defenses", divides computing environment, zone boundary, communication network and management center, and performs protection by zones and domains according to the current conditions of the system and service in financial industry; the management system, in line with the principle of life cycle, performs scientific management in the four processes including establishment, execution and operation, supervision and audit, and maintenance and improvement, and forms "life circle" management method with the idea of cycled improvement.

Technology-management interaction refers to the fusion between technical requirements and management requirements, and the complementation between technical system and management system, reflecting the basic idea of equal attentions to technology and management in terms of security assurance requirements and security assurance methods.

Comprehensive assurance refers to that the framework, in compliance with the national requirements of classified protection, meets special service requirements of financial industry by taking comprehensive consideration of the assurance requirements and methods, effectively combining technology with management.

5.2 Technical system

By reference to the security domain model of the "Design Requirements", technical system modelling for the information security assurance of financial industry is established by combining such security protection ideas as

"protection in depth for security domain", "multi-level and -dimension defense" and "classified protection of information security". Each institution is regarded as one complete object to be protected according to the organization structure and network architecture of financial industry, and an information security assurance framework for financial institution is designed as shown in Figure 6, with the headquarter and affiliates as independent security domains which in turn can be further divided into computing environment domain, zone boundary, communication network and supporting facilities domain, which can be implemented by financial institution depending on its structure.

As there are service and data interconnections between systems, the security level and security risk vary with system. The zone boundary, boundary of the security computing environment of rating system, must be ensured to have reliable interconnection mechanism between system levels. The interconnection mechanism must be established with the access control policy and other security policy set based on the security protection requirements of a higher rating system or security domain, which may be achieved by using network security isolation technique or by deploying information exchange system (e.g. front-end system). By performing strict control on the reliable interconnection between system levels, it can guarantee that no security vulnerability occurs due to differential protection between different levels of system.

5.2.3 Communication network

The communication network is a related component allowing the data transmission and security policy implementation between the security computing environments of rating system. The communication network security refers to that data is ensured not to be intercepted, tampered or damaged in the transmission process by perform reliability identification and authentication, establishing security passage and implementing data transmission protection.

Communication network protection mainly addresses the network security of information system.

5.2.4 Supporting facilities

Supporting facilities implement unified security policy management over computing environment, zone boundary and communication network, to ensure complete and reliable system configuration, strict division of user operation authority and whole-process tracing of audit. Functionally, it can be further divided into system management, security management, comprehensive audit management and physical support implementation management. Their administrators are of defined responsibilities and authorities, with the authorities separated yet interacted.

5.3 Management system

To establish a sound security management system, first of all, progressively build up security management setup, security management systems and personnel allocation according to actual demand of the informatization progress of financial institution; secondly, improve the capability of information security assurance through implementing systems by specific security setup and personnel; next, basing on the implementation results, inspect the systems for existing problems and defects; finally, basing on the inspection results, improve the systems. In this way, establishment, a cycle process of execution and the area for the placement of equipment such as power supply equipment, fire-fighting equipment and air conditioner. (F2)

3) Prevention of burglary and damage (G2) a) Place main equipment in the machine room;

b) The equipment or main component shall be fixed and provided with obvious and irremovable marks;

c) The communication cables shall be laid under a shelter, such as under the floor or in the piping;

d) Classify, identify and store the media in the media library or filing room;

e) Install necessary anti-burglary alarm facilities in the main machine room;

f) Equip monitoring system for the purpose of machine room facilities and site environment to comprehensively monitor the important facilities such as air conditioner, fire-fighting equipment, UPS, access control system, etc. (F2)

4) Lightening protection (G2) a) Lightning arrester shall be set for machine room building;

b) AC ground wire shall be set in the machine room.

5) Fire prevention (G2) a) The machine room shall be installed with gas fire extinguishing equipment having little influence on computer system and installed with automatic fire alarm system;

b) The layout of inner passage, decorative materials and equipment cables shall meet the firefighting requirements and pass the fire acceptance. (F2)

6) Water-proofing and damp-proofing (G2) a) The water pipe should not be installed through the roof of machine room, but protective and precautionary measures shall be taken in case of passing through the floor;

b) Measures shall be taken to prevent rain water from penetration through the windows, roof and walls of the machine room;

b) The log-in address of the administrator of network equipment shall be restricted;

c) The user's identity for the network equipment shall be unique;

d) The identity authentication information shall not be liable to use falsely;

the password shall have complexity requirements and be changed periodically;

e) Login failure handling function shall be provided by adopting measures such as session closure, limited unauthorized log-in times and auto-exit in case of log-in connection timeout;

f) Necessary measures shall be taken to protect the authentication information from interception in the process of network transmission when the network equipment is remotely controlled;

g) Monthly backup shall be carried out for the configuration files of network equipment, and backup shall be conducted timely in case of any change; (F2) h) Regular inspection shall be carried out in allusion to the operating condition of network equipment; (F2) i) The accompanied service ports of network equipment system shall be sorted to turn off the unnecessary port and corresponding port opening approval system shall be established; (F2) j) Regular inspection shall be carried out in allusion to the software version information of network equipment; (F2) k) Clock synchronization mechanism for network equipment shall be established; (F2) l) Regular inspection and locking or revoking shall be carried out in allusion to the needless user account in network equipment.

(F2)

6.1.1.3 Host security

1) Identity authentication (S2) a) Identity identification and authentication shall be carried out for the user logging in the operating system and the database system;

b) The user identity of the operating system and database system management shall not be liable to use falsely, the static-password framework and the like of the security work shall be explained;

b) Security management system shall be established for all management contents in security management activities;

c) Operation specifications shall be established for the important management operations to be executed by security management personnel or operation personnel.

2) Development and publication (G2) a) The science-tech department of financial institution headquarters shall be responsible for developing the institution-wide security management system, while the science-tech department of affiliates shall be responsible for developing the security management system for their governing scope;

b) Organize relevant personnel to demonstrate, review and approve the developed security management system;

c) The security management system shall be released to associated personnel in some way.

3) Review and revision (G2) a) Carry out review and approval for the security management system periodically and the defective or to be improved security management system shall be revised.

6.1.2.2 Security management setup

1) Post setting (G2) a) Unified leadership and hierarchical management are adopted for the information security management; headquarters is responsible for the unified leadership of all affiliates regarding information security management, while the affiliates are responsible for the information security management of their own and their governing scope; (F2) b) Any department other than science-tech department shall designate at least one computer security personnel to take charge of the information security management work of this department and cooperate with the science-tech department for information security management; (F2) c) Security director as well as posts for the responsible persons of every aspect of security management shall be established and responsible d) It is required to notify the relevant security responsibilities and disciplinary measures to the personnel; those personnel violating the security policies and requirements shall be punished.

5) Access management of outsiders (G2) a) Each institution shall appoint responsible department to take charge of the access authorization approval for outsiders associated with non-secret-involved computer system and network,; after the approval, special personnel shall be designated for entire company or supervision and registration is required;

b) All organizations and individuals obtaining the outsider access authorization shall sign security confidentiality agreement with financial institution, and shall not add, delete, modify and query data without authorization, or duplicate and leak any information of the institution; (F2) c) Where outsiders enter into financial institution for field conducting, the planned operation content shall be submitted in advance, and the outsiders shall be accompanied by financial institution personnel on site for checking the operation content and recording. (F2)

6.1.2.4 System construction management

1) System grading (G2) a) The boundary and security protection grade of information system shall be defined;

b) The method and reasons for determining an information system to be a certain security protection grade shall be clarified in written form;

c) It is required to ensure that the grading result of information system is approved by relevant departments.

2) Security scheme design (G2) a) It is required to select basic security measures according to the system security protection grade as well as supplement and adjust the security measures based on the risk analysis result;

b) It is required to describe the system security protection requirements, policies, measures and other contents in written form and form the system security scheme;

caused by the bankruptcy of outsourcing service provider, force majeure or other potential problems. (F2)

6) Project implementation (G2) a) Dedicated department or personnel shall be designated or authorized to manage the project implementation process;

b) It is required to establish detailed project implementation scheme and corresponding process control documents to control the project implementation process.

7) Acceptance test (G2) a) Security acceptance test shall be carried out for the system;

b) It is required to develop acceptance test scheme based on the design scheme or contract requirements prior to acceptance test, record the detailed results during acceptance test, and form the acceptance test report;

c) It is required to organize relevant departments and personnel to examine and approve the system acceptance test report, and sign to confirm;

d) As for the test carried out for production system, detailed plans, including those concerning system and data backup, construction of test environment, post-test system and data recovery, production system audit, etc., shall be developed to guarantee the security of the production system (F2)

8) System delivery (G2) a) It is required to develop a system delivery list, against which the delivered equipment, software and documents, etc. shall be checked;

b) The system construction organization shall handover all the documents of system construction process and system operation and maintenance to the science-tech department after the completion of construction; (F2) c) The external construction organization shall sign relevant intellectual property protection agreement and confidentiality agreement with financial institution and shall not make public the key security technical measures and core security function design adopted in the system; (F2) d) It is required to provide corresponding skill training to the technical protection responsibility; (F2) f) As for the equipment to be abandoned, the science-tech department shall clear the data information with special tools. If such equipment will not be used or allocated to the organizations other than financial institution, the science-tech department shall carry out unrecoverable destruction by demagnetizing or physically smashing the data storage device; (F2) g) Where the equipment has to be sent to external agency for repair, the stored work-related information shall be eliminated thoroughly, and confidentiality agreement shall be signed with the repair servicer. Before the supporting device of cipher equipment is delivered for repair, the research organization must be invited to dismantle the cipher hardware and eliminate all cipher software and information; (F2) h) Develop standardized fault handling process and detailed fault log (covering the fault occurrence time, scope, phenomena, processing results and personnel, etc.); (F2) i) Ensure that the information processing equipment must not be taken out from the machine room or office site unless examined and approved.

5) Network security management (G2) a) Establish network operation security management system to specify the network security configuration, log preservation time, security policy, upgrading & patching, password updating period, significant file backup, etc.;

b) Routing inspection shall be carried out for the operating state of network environment and shall be recorded and signed by the operator and reviewer; (F2) c) For the purpose of internetworking security in financial industry, the management mode of uniform standardization, level-to-level administration and responsibility division shall apply. No financial institution has the right to internetwork with external institutions without the approval of the science-tech department;

(F2) d) Remote access control standard shall be developed. Where the task requires remote access, the science-tech department of the initiating institution shall propose the science-tech department (post) of the visited institution to enable the remote access d) Scan the vulnerability at least once a year, repair the discovered system security vulnerability timely; (F2) e) Install the latest patch program of the system, which shall not be carried out until the program passes the test in the test environment first and then important files are backed up;

f) It is required to maintain the system according to the operation manual and record the operation logs in detail including important routine operation, operation & maintenance records and parameter setting & modification, etc.; unauthorized operations are strictly forbidden;

g) The running log and audit data shall be analyzed periodically, so as to discover abnormal behaviors timely.

7) Malicious code defense management (G2) a) Raise the anti-virus awareness of all users, inform the anti-virus software version timely and conduct virus checking before reading the data on removable storage device and the files or e-mails received from the network, as well as before external computer or storage device's accessing to the network system;

b) Install uniform anti-virus software for Client of financial institution, provide such security measures as user password and screensaver password, and ensure timely update of virus signatures and installation of necessary patch program; (F2) c) Designate special personnel to detect the malicious code in the network and host, preserve the detection records;

d) Clearly specify the authorized application of anti-malicious code software, update of malicious code base and periodical report, etc.

8) Password management (G2) a) The selected encryption products and encryption algorithm shall meet the requirements of relevant national password management policy;

b) The key management must be standardized by developing systems for managing secret key generation, distribution and reception, usage, storage, updating, destroy, etc.; the key management personnel must be permanent official employee of the organization; (F2) c) The system administrator, database administrator, network administrator and business operator must set password which disaster recovery training periodically; carry out disaster recovery exercise according to practical situation; (F2)

11) Handling of security event (G2) a) Report the discovered security vulnerability and suspicious events, but in no case shall the user attempt to verify the vulnerability;

b) Develop the security event report and handling management system;

make clear the type of security event; specify the management responsibilities of on-site handling, event report and post recovery of security event;

c) Grade the computer security events of this system according to the grading method of computer security events by the relevant national management department and the influences of security events on this system;

d) Record and preserve all reported security vulnerabilities and suspicious events, analyze the event reason, supervise the event development and take measures to avoid occurrence of security event;

e) Establish effective technical support mechanism so that the emergency handling of security event will not be interrupted or prolonged due to deficient technical capacity. (F2)

12) Management of emergency plan (G2) a) Develop emergency plans for different events under the uniform emergency plan framework which shall include emergency organization, emergency plan starting conditions, emergency processing flow, system recovery flow, after-the-fact education and training, etc. Provide the signature and seal of organizations involved in the emergency plan;

b) Conduct training on emergency plan for system-related personnel at least once a year;

c) The emergency leading group of financial institution shall post information in strict accordance with the relevant provisions and requirements of the industry and institution. Any other department or individual in the institution shall not accept interview of the news media or express personal viewpoints without authorization; (F2) d) The emergency handling leading team shall uniformly lead the emergency management of computer system, command and case of escaping. The passage of machine room shall be marked with conspicuous fire symbol. (F3)

6) Water-proofing and damp-proofing (G1) a) The water pipe should not be installed through the roof of machine room, but protective and precautionary measures shall be taken in case of passing through the floor;

b) Measures shall be taken to prevent rain water from penetration through the windows, roof and walls of the machine room;

c) Drainage ditch and floor drain shall be arranged around the ground vulnerable to water leakage for the convenience of underground water transferring, where air conditioner air outlet is set on the ceiling, the air outlet should not be located right over the equipment in order to avoid vapor condensation and penetration;

d) Detecting instrument or elements that are sensitive to water shall be installed in the machine room to conduct water-proof detection and alarm.

7) Electrostatic prevention (G3) a) Necessary grounding electrostatic prevention measures shall be taken for main equipment;

b) Electrostatic prevention floor shall be adopted in the machine room;

c) Electrostatic conductive or electrostatic dissipative material should be adopted for the worktable surface in main machine room and auxiliary area. (F3)

8) Temperature and humidity control (G3) a) For main machine room, the temperature and humidity at starting of equipment shall be controlled as the requirements of

Grade A; for primary working room, they may be controlled as the requirements of Grade A or B depending on specific equipment requirements; for other auxiliary rooms, they shall be determined as required by the equipment;

The temperature and humidity of computer room at starting of equipment shall comply with those specified in Table 1:

d) The redundancy mode of UPS power supply system shall be N+1,

N+2, 2N, 2(N+1) or other modes. Where the emergency power supply system of diesel generator are not established for the organization, the UPS backup time shall be equal to or more than

1h; (F3) e) The machine room shall adopt dedicated socket for machine room and be provided with power socket for maintenance and test respectively with distinctive differentiating marks. The mains supply socket and UPS power supply socket shall be separated to meet load operating requirements; (F3) f) Copper-core cable shall be adopted for computer system.

Combined application of copper and aluminum shall be avoided;

otherwise, copper-aluminum transition connector shall be adopted; (F3) g) Emergency lighting and indicator light of emergency exit shall be provided for machine room, various switches, handles and buttons in power supply and distribution cabinet (case) and section board shall be provided with clear marks for preventing mis-operation. (F3)

10) Electromagnetic protection (S3) a) Grounding mode shall be adopted to prevent external electromagnetic interference and equipment intercoupling interference;

b) The power line and communication cables shall be laid separately to avoid mutual interference;

c) Electromagnetic shielding shall be conducted for key equipment and magnetic media;

d) The network wiring of computer system equipment shall not be parallel to the electromagnetic shielding wiring of air conditioning equipment and power supply equipment; in case of intersection, the intersection shall be in approximate right angle as possible and certain measures shall be taken to prevent fire spreading. (F3)

6.2.1.2 Network security

1) Structure security (G3) a) The redundancy of main network equipment and communication e) The boundary of network area (boundary of internet area, exterior area and interior area) shall be monitored in allusion to the maximum flow number of the network and the network concurrent connections;

f) Technical means shall be taken in important network segments to prevent address spoofing;

g) The allowing or refusing of the access to resources of the controlled system by the user shall be determined based on the allowed access rules between the user and the system; the control size is single user;

h) Digital certificate authentication mechanism shall be adopted for the dial-in access user, and the number of user provided with dial- up access authority shall be restricted.

i) The access control authority of network equipment shall be set according to the least security access principle. (F3)

3) Security audit (G3) a) Log records for the operating condition of network equipment, network traffic and user behavior, etc. in the network system shall be conducted;

b) The audit record shall cover the date & time of event, user and event type, whether the event is successful and other audit-related information;

c) Enable to analyze according to the recorded data and generate audit statement;

d) The audit records shall be protected from unexpected deletion, modification or covering, etc., with the preservation period not less than half a year.

4) Boundary integrity checking (S3) a) Enable to check the behavior of unauthorized equipment connecting to the internal network privately, fix its position accurately and stop it effectively;

b) Enable to check the behavior of internal network user connecting to the external network privately, fix its position accurately and stop it effectively.

5) Intrusion defense (G3) a) Monitor the following attack behaviors at the boundary of network as period not less than half a year in allusion to sensitive data;

d) Enable to analyze according to the recorded data and generate audit statement;

e) The audit process shall be protected from unexpected interruption;

f) The audit records shall be protected from unexpected deletion, modification or covering, etc.

4) Residual information protection (S3) a) It shall be ensured that the memory space for the authentication information of the users of operating system and database system is cleared entirely before releasing or redistributing to other users regardless of whether the information is stored in the hard disk or the internal memory;

b) It shall be ensured that the memory space for resources such as system files, catalogue and database records, etc. is cleared entirely before releasing or redistributing to other users.

5) Intrusion defense (G3) a) Enable to detect the intrusion behavior to important server, record the source IP of intrusion as well as type, purpose and time of attack, and alarm in case of serious intrusion event;

b) Enable to detect the integrity of important programs and take recovery measures if damage to integrity is detected or cut off in advance if potential damage to integrity is detected;

c) The operating system shall, under the minimum installation principle, only install the necessary components and application programs, and the system patches shall be updated timely by server upgrading and preventative maintenance of system software, etc.

6) Malicious code defense (G3) a) Genuine anti-malicious code software certificated by state security ministry shall be installed; the anti-malicious code software version and malicious code library shall be updated timely in allusion to the software which searches and kills malicious code relying on virus library; the validity and real-time performance of feature library adopted by the software shall be ensured in allusion to the software which defenses malicious code not relying on virus library (e.g., active defense software), repetitive user identity exists in application system and the identity authentication information is not used falsely;

d) Login failure handling function shall be provided by adopting measures such as session closure, limited unauthorized log-in times and auto-exit, etc.;

e) Functions of identity authentication, inspection of user identity uniqueness, inspection of user identity authentication information complexity and login failure handling shall be enabled, and relevant parameters shall be configured according to security policy;

f) Application software shall be able to lock the use of Client automatically upon the expiration of designated idle time interval;

(F3) g) As for the initial password automatically distributed or preset by the system with less strength, the system shall force the user to change the initial password at the first login; (F3) h) When changing the password, the new password shall not be the same with the old one. (F3)

2) Access control (S3) a) Access control function shall be provided to control the user's access to objects such as files and database tables, etc. according to the security policy;

b) The scope of access control shall include the subject and object related to resource access, as well as the operation between them;

c) The access control policy shall be configured by authorized subject and the access authority of default account shall be restricted strictly;

d) Different accounts shall be granted with the least authority for accomplishing their respective tasks and building inter-restricted relationship among them;

e) Relation table of key accounts and authority of the production system shall be provided; (F3) f) The function of setting sensitive marks on important information resources should be enabled;

g) The user's operations on important information resources with sensitive marks should be controlled strictly according to the security policy.

7) Non-repudiation (G3) a) It shall be functional in providing data originator or receiver with data reception evidence when requested; the origin evidence includes application system operation and management records which shall at least include the records of operation time, operation personnel as well as operation type and operation content, etc.;

the transaction system shall also be able to record the details of user's compliance transaction data such as business serial number, account name, IP address, transaction command, etc.

for auditing and tracing the user;

b) It shall be functional in providing data originator or receiver with data reception evidence when requested; the reception evidence includes application system operation and management records which shall at least include the records of operation time, operation personnel as well as operation type and operation content, etc.; the transaction system shall also be able to record the details of user's compliance transaction data such as business serial number, account name, IP address, transaction command, etc. for auditing and tracing the user.

8) Software fault tolerance (A3) a) Data validity check function shall be provided to guarantee that the data format or length input via man-machine interface or communication interface complies with the system setting;

b) The automatic protection function shall be provided to protect all the current states automatically in case of failure and ensure that the system is able to recover;

c) Enable to shield the error message of system technology effectively rather than feed them back to the user directly. (F3)

9) Resource control (A3) a) As for application system having session or short connection, when one of the two communicating parties thereof does not respond over a period of time, the other party shall be able to end the session automatically;

b) Enable to restrict the connections of the maximum concurrent sessions of system;

c) Enable to restrict the multiple concurrent sessions of single account for the application system having sessions;

c) Multiple persons shall be allocated to co-manage key business posts.

3) Authorization and approval (G3) a) Authorization and approval matters, approval department and approver, etc. shall be clarified according to the responsibility of each department and post;

b) Approval program shall be established in allusion to the system change, important operation, physical visit and system access, etc.;

approval process shall be implemented according to the approval procedure and progressive approval system shall be established for important activities;

c) Periodic review shall be carried out for approval matters; the items to be authorized and approved, the approval department and the approver, etc. shall be updated timely;

d) The approval process shall be recorded and the approval document shall be saved;

e) Users shall be granted with the least authority for accomplishing their tasks and inter-restricted relationship shall be built among the employees at important posts. Authority change shall be carried out in relevant approval process and provided with complete change record; (F3) f) System user and authority list shall be established, the authority of employee shall be inspected and checked periodically, and cause shall be ascertained and adjustment shall be conducted timely when finding unauthorized user, meanwhile, expired user authority shall be cleaned up and recorded and filed as well. (F3)

4) Communication and cooperation (G3) a) It is required to strengthen the cooperation and communication between various management personnel, the organization's internal structures and the information security function departments; to convene coordination meeting periodically or non-periodically to coordinate and handle information security matters together and to form meeting minutes;

b) It is required to strengthen the cooperation and communication with associate organizations, public security organs and telecommunication companies;

c) It is required to strengthen the cooperation and communication with a) It is required to specify security education and training in written form periodically, and to make different training plans for different posts;

b) It is required to perform security awareness education, post skill training and relevant security technology training for various personnel, as well as to popularize basic knowledge of information security, standardize post operation and improve security skill;

c) The information security training shall be carried out for information security management personnel at least once a year;

(F3) d) It is required to specify the security responsibilities and disciplinary measures in written form and notify relevant personnel; those personnel violating the security policies and requirements shall be punished;

e) The performance and result of security education and training information shall be recorded and filed.

5) Access management of outsiders (G3) a) Each institution shall appoint responsible department to take charge of the access authorization approval for outsiders associated with non-secret-involved computer system and network,; after the approval, special personnel shall be designated for entire company or supervision and registration is required; b) It is required to establish access control mechanism and authentication mechanism for the financial institution's computer system and network resources which provide access to outsiders, provide a list of all users and their authorities, and monitor their activities;

c) All organizations and individuals obtaining the outsider access authorization shall sign security confidentiality agreement with financial institution, and shall not add, delete, modify and query data without authorization, or duplicate and leak any information of the institution. (F3)

6.2.2.4 System construction management

1) System grading (G3) a) The boundary and security protection grade of information system shall be defined;

b) The method and reasons for determining an information system to be c) Dedicated department shall be designated or authorized to take charge of product procurement which shall be based on the principle of openness, justice and fairness, and should be achieved by such approaches as bidding and inviting bid, etc.;

d) The institutions shall report to its science-tech competent department for approval and record when procuring scan type and detection type information security products; (F3) e) Selection test on products shall be performed in advance to determine the scope of candidates; and the list of product candidates shall be periodically reviewed, approved and updated;

f) Scan type and detection type information security products can only be used by the information security management personnel of this institution or the network administrator authorized by principal leader; (F3) g) It is required to check relevant log and statement of the information security products periodically and carry out summary and analysis for them, once significant problem was found, take control measures immediately and report in accordance with the required procedure; (F3) h) It is required to backup the log and statement of various information security products and preserve for at least three months; (F3) i) It is required to upgrade and maintain the information security products timely, the information security products exceeding the service life or incapable of further use shall be handled according to the approval procedure of retirement of fixed assets.

(F3)

4) Independent software development (G3) a) It is required to establish the management system of software development and security regulations of coding, and clarify the control method of development process and the code of conduct;

developers are required to write the code in accordance with regulations and shall not set backdoor or malicious code procedure in the program; (F3) b) It is required to ensure that the development environment is physically separated from practical operating environment, and the developers are separated from testing personnel, the developer cannot concurrently serve as system administrator or business operator, a) It is required to conduct grade evaluation for the system under operation at least once a year and immediately correct any detected inconformity with the requirements of corresponding grade protection standard;

b) It is required to immediately conduct grade evaluation for the system upon any change, adjust the grade if any change in grade is detected and then carry out security reformation, as well as to immediately correct any detected inconformity with the requirements of corresponding grade protection standard;

c) The selected evaluation organization shall be the one listed in

"National Level Evaluation Agency Recommended Directory" which is approved by Ministry of Public Security, and the security confidentiality agreement shall be signed with the evaluation organization;

d) Dedicated department or personnel shall be designated or authorized to manage grade evaluation.

11) Selection of security service provider (G3) a) Such elements as the qualification, operation behavior, performance, service system, service quality, etc. of the information security service provider shall be evaluated at selection; (F3) b) It is required to ensure that the security service provider is selected in compliance with the relevant national requirements;

c) It is required to sign the security-related agreements with the selected security service provider to specify the relevant responsibilities clearly;

d) It is required to ensure that technical training and service commitment are provided by the selected security service provider, and sign service contract as necessary.

6.2.2.5 System operation and maintenance management

1) Environment management (G3) a) Central machine room shall be established to provide operating environment for all information systems in a unified way. The machine room shall be equipped in compliance with the relevant national standard concerning computer room;

b) The machine room shall adopt structured cabling system. Where distribution frame is allocated in the wiring cabinet; the jumper selection, procurement, releasing and receiving, etc. of various software and hardware for the information system;

b) Develop maintenance management system for supporting facility and software & hardware to conduct effective management of maintenance, including defining the responsibilities of maintenance personnel, examination and approval of foreign repair and service, supervision and control of repair process, etc.

c) Where the equipment has to be sent to external agency for repair, the stored work-related information shall be eliminated thoroughly, and confidentiality agreement shall be signed with the repair servicer. Before the supporting device of cipher equipment is delivered for repair, the research organization must be invited to dismantle the cipher hardware and eliminate all cipher software and information; meanwhile, special personnel shall be assigned for supervision on site; (F3) d) Develop standardized fault handling process and detailed fault log (covering the fault occurrence time, scope, phenomena, processing results and personnel, etc.); (F3) e) Conduct standardized management on the operation and use of such equipment as terminal computer, work station, portable computer, system and network; achieve startup/shutdown, power-on/power-off and other operations of key equipment (including backup and redundant equipment) based on the operation specifications;

f) The science-tech department of institutions is responsible for maintaining and managing all relevant equipment (including backup and redundant equipment) and wiring of information system; (F3) g) The newly-purchased equipment shall not be put into service unless tested as qualified; (F3) h) Get the equipment registered, develop equipment management specifications and the equipment user shall fulfill the security protection responsibility; (F3) i) As for the equipment to be abandoned, the science-tech department shall clear the data information with special tools. If such equipment will not be used or allocated to the organizations other than financial institution, the science-tech department shall carry out unrecoverable destruction by demagnetizing or physically smashing the data storage device; record shall be system administrator needs to maintain the business data in the database system indeed, the written approval shall be obtained from the business department and such information as maintenance content, personnel and time shall be recorded in detail; (F3) d) It is required to scan the vulnerability at least once semiannually, repair the discovered system security vulnerability and report the scanning result timely; (F3) e) Install the latest patch program of the system, which shall not be carried out until the program passes the test in the test environment first and then important files are backed up; the system change shall be recorded;

f) It is required to maintain the system according to the operation manual and record the operation logs in detail including important routine operation, operation & maintenance records and parameter setting & modification, etc.; at least two persons shall be present for the setting of important computer system;

g) The running log and audit data shall be analyzed periodically, so as to discover abnormal behaviors timely; h) Authority change of system user shall be recorded in written form and approved by relevant management layer. (F3) h) Authority change of system user shall be recorded in written form and approved by relevant management layer. (F3)

8) Malicious code defense management (G3) a) Raise the anti-virus awareness of all users, inform the anti-virus software version timely and conduct virus checking before reading the files or e-mails received from the network, as well as before storage device's accessing to the network system;

b) Install uniform anti-virus software for Client of financial institution, provide such security measures as user password and screensaver password, and ensure timely update of virus signatures and installation of necessary patch program; (F3) c) Designate special personnel to detect the malicious code in the network and host, preserve the detection records;

d) Clearly specify the authorized application of anti-malicious code software, update of malicious code base and periodical report, etc.;

i) The financial institution shall determine the audit frequency according to the disaster recovery performance of information system. The organization shall organize internal audit for disaster recovery at least once a year; (F3) j) Disaster recovery training shall be carried out periodically, and disaster recovery exercise shall be carried out according to practical situation; (F3) k) Disaster backup system shall be established. The actual switching time of host/backup system shall be less than 60min.

The processing capacity of backup system shall not be lower than the host system by 50%. The communication lines shall be connected to the host/backup system separately. If conditions permit, double-system mode, i.e. host and backup systems with same processing capacity and can be used in alternation, may be adopted. (F3)

12) Handling of security event (G3) a) Report the discovered security vulnerability and suspicious events, but in no case shall the user attempt to verify the vulnerability;

b) Develop the security event report and handling management system;

make clear the type of security event; specify the management responsibilities of on-site handling, event report and post recovery of security event;

c) Grade the computer security events of this system according to the grading method of computer security events by the relevant national management department and the influences of security events on this system;

d) Develop security event reporting and response processing programs to specify event reporting process, the scope and degree of response and handling, handling methods, etc.;

e) Analyze and identify the causes of the security event in the reporting and response process; collect evidences, recording the handling;

summarize experiences and lessons and developing remedial measures to avoid re-occurrence. All documents and records formed from the process shall be well kept;

f) Adopt different processing and reporting programs against security events causing system interruption and information leakage.

g) Establish effective technical support mechanism so that the b) Set lightning protector certificated by the nation to prevent induction stroke;

c) Ground wire of AC power supply shall be set in the machine room.

5) Fire prevention (G4) a) Effective automatic fire extinguishing system shall be set in machine room, which can automatically detect fire and activate automatic alarm via various means such as setting smoke detector and temperature detector in machine room and primary working rooms, or under movable floors, or in ceiling and main air conditioner pipes as well as at the position nearby the combustibles;

b) The machine room shall be provided with gas extinguisher having little impact on computer equipment; (F4) c) Building materials with at least Grade 2 fire endurance shall be used for the machine room and related working room and auxiliary rooms; (F4) d) Area isolating fire prevention measures shall be taken in the machine room to isolate important equipment from other equipment;

e) The machine room shall be installed with automatic fire alarm system (with both automatic and manual triggers) and extinguisher. The fire alarm system shall be able to link with air conditioning system, fresh air system and access control system and with manual triggering as the general operating state; (F4) f) The equipment cables used in machine room shall meet the fire prevention requirements, such combustible materials as paper, tape and film shall be placed in fire-proof metal cabinet; (F4) g) Where the pipe-network-type clean gas fire extinguishing system or high-pressure water mist fire extinguishing system is adopted for main machine room, two types of fire detectors shall be installed and the fire alarm system shall be linked with the fire extinguishing system; dedicated self-container breathing apparatus or oxygen respirator shall be provided for any main machine room adopted with clean gas fire extinguishing system;

(F4) h) Regular inspection shall be carried out for fire-fighting facilities, and at least one fire drill shall be performed semiannually; (F4) i) More than two fire escape routes shall be provided for the machine room and the passage from each divided area of machine room to each fire escape route shall be unimpeded in case of escaping. The passage of machine room shall be marked with conspicuous fire symbol. (F4)

6) Water-proofing and damp-proofing (G4) a) The water pipe should not be installed through the roof of machine room, but protective and precautionary measures shall be taken in case of passing through the floor;

b) Measures shall be taken to prevent rain water from penetration through the windows, roof and walls of the machine room;

c) Drainage ditch and floor drain shall be arranged around the ground vulnerable to water leakage for the convenience of underground water transferring, where air conditioner air outlet is set on the ceiling, the air outlet should not be located right over the equipment in order to avoid vapor condensation and penetration;

d) Detecting instrument or elements that are sensitive to water shall be installed in the machine room to conduct water-proof detection and alarm.

7) Electrostatic prevention (G4) a) Necessary grounding electrostatic prevention measures shall be taken for main equipment;

b) Electrostatic prevention floor shall be adopted in the machine room;

c) Shoe cover shall be prepared to reduce the dust carried into the machine room; (F4) d) Devices such as electrostatic eliminator shall be adopted to reduce electrostatic generation;

e) Electrostatic conductive or electrostatic dissipative material should be adopted for the worktable surface in main machine room and auxiliary area. (F4)

8) Temperature and humidity control (G4) a) For main machine room, the temperature and humidity at starting of equipment shall be controlled as the requirements of

Grade A; for primary working room, they may be controlled as

6.3.1.3 Host security

1) Identity authentication (S4) a) Identity identification and authentication shall be carried out for the user logging in the operating system and the database system;

b) The user identity of the operating system and database system management shall not be liable to use falsely, the static-password of system shall have more than 8 digits in mix composition of letter, figure and symbol, etc. and shall be changed at least every month;

c) Login failure handling function shall be enabled by adopting measures such as session closure, log-in interval restriction, limited unauthorized log-in times and auto-exit, etc.;

d) Set authentication warning information so that the system will automatically warn unauthorized access in case of unauthorized access or unlawful access attempt;

e) The host system shall carry out identity identification and authentication for the server or terminal equipment connected with it, encryption measure shall be taken to protect the authentication information from interception in the process of network transmission when server is remotely controlled via internet; (F4) f) Distribute different names to different users of the operating system and database system to ensure that the user name is unique;

g) Two or more combined authentication technologies should be adopted to authenticate the identity of the admin user; at least one of the identity authentication information, which includes secret key certificate, dynamic password card and biological characteristics, etc., is unforgeable.

2) Security mark (S4) a) Set sensitive mark for all subjects and objects.

3) Access control (S4) a) The access of subject to object is controlled according to the security policy and the sensitive marks of all subjects and objects;

b) Access control grain shall be that the subject is user level or process level and the object is file, database table, record and field level;

c) The authority shall be distributed according to the role of admin user to realize separation of admin user authorities; only grant the least authority to the admin user as required;

d) Realize the separation of authorities of operation system and database system, the system administrator only having the operation and maintenance management authority of operation system, database administrator only having operation and maintenance management authority of database;

e) The access authority of default account shall be banned or strictly restricted, the system default account shall be renamed and the default passwords of these accounts shall be modified;

f) Redundant and expired account shall be deleted without delay to avoid shared account.

4) Trusted path (S4) a) Enable to establish a secure data transmission route between the system and the user by carrying out identity authentication to users accessing the operation system and database system remotely through the Internet;

b) Enable to establish a secure information transmission path between the system and the user when the user remotely accesses the operation system and database system through the Internet.

5) Security audit (G4) a) The audit scope shall cover all users of operating system and database on the server and important Clients;

b) The audit contents shall include such important security-related events in the system as behavior of important user, abnormal application of system resource and application of important system commands, distribution, creation and change of account, adjustment of audit strategy as well as the closure and enabling of auditing system function, etc.;

c) The audit record shall include the date, time, type, subject identification, object identification and result of the event, and the audit record shall be backed up periodically and preserved for at least one year;

d) Enable to analyze according to the recorded data and generate audit statement;

identity authentication information is not used falsely;

d) Login failure handling function shall be provided by adopting measures such as session closure, limited unauthorized log-in times and auto-exit, etc.;

e) Functions of identity authentication, inspection of user identity uniqueness, inspection of user identity authentication information complexity and login failure handling shall be enabled, and relevant parameters shall be configured according to security policy;

f) Application software shall be able to lock the use of Client automatically upon the expiration of designated idle time interval;

(F4) g) The system shall force the user to change the initial password at the first login; (F4) h) When changing the password, the new password shall not be the same with the old one. (F4)

2) Security mark (S4) a) Provide the function of setting security label for subjects and objects, and enable after installation.

3) Access control (S4) a) Access control function shall be provided to control the user's access to objects such as files and database tables, etc. according to the security policy;

b) The scope of discretionary access control shall include the subject and object related to information security, as well as the operation between them;

c) The access control policy shall be configured by authorized subject and the access of default account shall be prohibited;

d) Different accounts shall be granted with the least authority for accomplishing their respective tasks and building inter-restricted relationship among them;

e) Relation table of key accounts and authority of the production system shall be provided; (F4) f) The function of setting sensitive marks on important information resources should be provided;

shall be provided for trans-area important communication to protect data integrity from the attack acting on universal communication protocol.

2) Data confidentiality (S4) a) Hardware encryption, point-to-point data encryption/decryption network mechanism or other effective measures shall be adopted to realize the confidentiality of the collection, transmission, use and storage process of system management data, authentication information and important business data;

b) Special communication protocol or secure communication protocol shall be provided for important trans-area communication to protect data confidentiality from the attack acting on general protocol.

3) Backup and recovery (A4) a) The function of local data backup and recovery shall be provided and the mode of real-time backup and asynchronous backup or incremental backup and full backup shall be adopted with incremental data backup once every day and full data backup once a week; the backup media is stored outside the field and the data preservation period is at least 15 years;

b) Data backup shall be stored in multi-redundancy mode, and the full data backup shall ensure the data redundancy with the period of at least one month; (F4) c) Establish remote backup center for disaster recovery; provide communication line, network equipment and data processing equipment required for disaster recovery, as well as real-time seamless switching for business application;

d) Remote real-time backup function shall be provided to conduct real- time backup of data to backup center for disaster recovery via communication network;

e) As for city data backup center, the linear distance from the production center shall be at least 30km and it can manage the operation of all core businesses; as for nonlocal data backup center, the linear distance from the production center shall be at least 100km; (F4) f) To meet the requirements of disaster recovery policy, verification test shall be carried out on the feasibility of critical technology application in the technical scheme, and its result shall be significant information security matters of this institution and its governing scope;

c) Special post for information technology risk auditing shall be set up to implement the information technology auditing system and process, make and execute information technology audit plan, as well as to audit the entire life cycle, important event and the like of information technology; (F4) d) Function departments for information security management work and security director as well as posts for the responsible persons of every aspect of security management shall be established and responsible persons' responsibilities shall be defined as well;

e) Posts of system administrator, network administrator and security administrator, etc. shall be established and the responsibilities of each operating post shall be defined as well;

f) Any department other than science-tech department shall appoint at least one computer security personnel to take charge of the information security management work of this department and cooperate with the science-tech department for information security management; (F4) g) The principal of financial institution is the first responsible person for the security protection work of computer information system of this organization. The leading team, special department and full-time (part-time) security administrator and other personnel concerned for the security protection of computer information system of financial institution shall assist the first responsible person to organize and implement relevant provisions; (F4) h) The principle of three separations shall be adhered to achieve the separation of front and back platform, of development and operation and of technology and business, information technology personnel shall exclusively hold the specific post (which shall not be concurrently held by the business personnel) with specific responsibility and shall not concurrently serve as business personnel. (F4)

2) Personnel allocation (G4) a) A certain number of system administrators, network administrators and security administrators, etc. shall be allocated;

b) Full-time instead of part-time information security administrators shall be allocated under A and B shift system;

c) Multiple persons shall be allocated to co-manage key business posts;

d) The personnel holding important information technology posts shall be rotated periodically or non-periodically. (F4)

3) Authorization and approval (G4) a) Authorization and approval matters, approval department and approver, etc. shall be clarified according to the responsibility of each department and post;

b) Approval program shall be established in allusion to the system change, important operation, physical visit and system access, etc.;

approval process shall be implemented according to the approval procedure and progressive approval system shall be established for important activities;

c) Periodic review shall be carried out for approval matters; the items to be authorized and approved, the approval department and the approver, etc. shall be updated timely;

d) The approval process shall be recorded and the approval document shall be saved;

e) Users shall be granted with the least authority for accomplishing their tasks and inter-restricted relationship shall be built among the employees at important posts. Authority change shall be carried out in relevant approval process and provided with complete change record; (F4) f) System user and authority list shall be established, the authority of employee shall be inspected and checked periodically, and cause shall be ascertained and adjustment shall be conducted timely when finding unauthorized user, meanwhile, expired user authority shall be cleaned up and recorded and filed as well. (F4)

4) Communication and cooperation (G4) a) It is required to strengthen the cooperation and communication between various management personnel, the organization's internal structures and the information security function departments; to convene coordination meeting periodically or non-periodically to coordinate and handle information security matters together and to form meeting minutes;

design scheme which cannot be implemented before approval;

f) It is required to periodically regulate and revise such supportive documents as overall security policy, security technology framework, security management policy, overall construction planning, security requirement analysis and detailed design scheme according to the grade evaluation and security assessment results.

3) Product procurement and use (G4) a) It is required to ensure that the procurement and use of security products comply with the relevant national requirements;

b) It is required to ensure that the procurement and use of encryption products comply with the requirements of the national encryption competent department;

c) Dedicated department shall be designated or authorized to take charge of product procurement which shall be based on the principle of openness, justice and fairness, and should be achieved by such approaches as bidding and inviting bid, etc.;

d) The institutions shall report to its science-tech competent department for approval and record when procuring scan type and detection type information security products; (F4) e) Selection test on products shall be performed in advance to determine the scope of candidates; and the list of product candidates shall be periodically reviewed, approved and updated;

f) For the product at important positions, professional evaluation organization shall be entrusted to perform special test;

g) Scan type and detection type information security products can only be used by the information security management personnel of this institution; (F4) h) It is required to check relevant log and statement of the information security products periodically and carry out summary and analysis for them, once significant problem was found, take rectification measures immediately and report in accordance with the required procedure; (F4) i) It is required to backup the log and statement of various information security products and preserve for at least six months; (F4) codes of software and examine the possible backdoor and convert channel of the software;

e) The outsourcing service provider shall be required to reserve operation traces and record complete log; the relevant contents and preservation period shall meet the requirements of event analysis, security evidence collection, independent audit and supervision and inspection; (F4) f) The outsourcing service provider shall be required to carry out assessment of information security risk at least once a year and submit the assessment report, and periodically employ external institution to carry out security audit and submit the audit report, so as to supervise and urge the provider to correct the problems timely; (F4) g) The outsourcing service provider shall be banned for wholly subcontracting and partly subcontracting shall be controlled strictly, so as to guarantee the outsourcing service level; (F4) h) It is required to make outsourcing service contingency plan for the data center and establish supplier alternative scheme, to support the consecutive and reliable operation of data center in case of the service interruption or service level declining caused by the bankruptcy of outsourcing service provider, force majeure or other potential problems. (F4)

6) Project implementation (G4) a) Dedicated department or personnel shall be designated or authorized to manage the project implementation process;

b) It is required to establish detailed project implementation scheme to control the implementation process, and prepare corresponding process control documents, besides, the project implementation organization shall be required to execute the security project process formally;

c) The switching of new-old data systems shall be carried out in the period of less influence on the clients. If the system switching time exceeds one workday, announcement needs to be released at least 5 workdays in advance, and emergency service channel shall be provided;

d) It is required to establish the management system of project implementation and clarify the control method of implementation process and the code of conduct;

the delivered equipment, software and documents, etc. shall be checked;

c) The system construction organization shall handover all the documents regarding system construction process and system operation and maintenance to the science-tech department after the completion of construction; (F4) d) The system construction organization shall provide corresponding skill training to the technical personnel responsible for operating maintenance of system;

e) Dedicated department shall be designated or authorized to manage system delivery and execute system delivery in accordance with management provisions;

f) The external construction organization shall sign relevant intellectual property protection agreement and confidentiality agreement with financial institution and shall not publicize the key security technical measures and core security function design adopted in the system. (F4)

9) System record (G4) a) Dedicated department or personnel shall be designated to manage the documents related to system grading and control the use of these documents;

b) The system grade and related documents shall be submitted to the system competent department for record;

c) The system grade and other required documents shall be submitted to the corresponding public security organ for record.

10) Grade evaluation (G4) a) It is required to conduct grade evaluation for the system under operation at least once a year and immediately correct any detected inconformity with the requirements of corresponding grade protection standard;

b) It is required to immediately conduct grade evaluation for the system upon any change, adjust the grade if any change in grade is detected and then carry out security reformation, as well as to immediately correct any detected inconformity with the requirements of corresponding grade protection standard;

normal operation depending on the technical documents; (F4) h) Perform content encryption and monitoring management for the storage media taken out of service environment;

i) The media sent out for maintenance or destroy shall undergo multiple readings/writings to cover and eliminate the sensitive or secret data;

the damaged media impossible for deletion must be destroyed;

j) Destroy of storage media with sensitive information shall be reported to the relevant department for record; the science-tech department is responsible for information elimination, demagnetization and physical crushing, as well as making corresponding record. Information elimination is limited to the case that the storage media will still be used in the financial institution, otherwise, the information shall be destroyed irrevocably; (F4) k) Specification for application of removable storage media shall be developed and the media application status shall be inspected periodically; (F4) l) Multiple backup mechanisms shall be employed for important data, and at least 1 portion of backup media shall be kept in the safe region in the same or another city designated by the science-tech department; (F4) m) Adopt encrypted storage for the data and software in important media, and carry out classification & identification management for the media according to the importance degree of the data and software;

n) Carry out validity management on technical documents; degrade the confidentiality of those beyond the validity period;

periodically clean up the invalid technical documents and strictly enforce the destroy and supervision requirements in technical document management system; (F4) o) Carry out periodic recovery verification towards main business data backed up and timely dump the data depending on the media's service life. (F4)

4) Equipment management (G4) a) Establish equipment security management system based on declaration, examination and approval, and specially-assigned responsible personnel; conduct standardized management on model selection, procurement, releasing and receiving, etc. of various j) Ensure that the information processing equipment must not be taken out from the machine room or office site unless examined and approved.

5) Monitoring management and security management center (G4) a) Monitor and alarm the running condition, network flow and user behavior of telecommunication line, network equipment, host and application software; make record and preserve it properly;

b) Establish weekly, monthly or quarterly report system concerning the operation monitoring of computer system to carry out statistical analysis of the operation conditions; (F4) c) Analyze and review the monitoring and alarming records periodically; form analysis report if any suspicious behavior detected. Timely solve any major hidden danger and operational accident detected and report to the upper-level department concerned;

d) Establish security management center to conduct centralized management of such security-related items as equipment status, malicious code, patch updating and security audit.

6) Network security management (G4) a) Designate special personnel to manage the network and take charge of the routine maintenance of running log and network monitoring record and of the analysis & processing of alarm information;

b) Establish network operation security management system to specify the network security configuration (minimum service configuration), log preservation time, security policy, upgrading & patching, password updating period, significant file backup, etc.;

c) Inspect the network log periodically to check any prohibited dial- up or other behaviors against the network security policy;

manage the network resources and its configuration information;

make network operation security maintenance record which shall be signed by the operator and reviewer and be kept for at least six months;

d) Strictly control the authorization of network management user; the authorized program requires that there must be two personnel present and operation is forbidden until approved by both of them; immutable audit log for the operating process shall be reserved;

l) For the purpose of internetworking security in financial industry, the management mode of uniform standardization, level-to-level administration and responsibility division shall apply. No financial institution has the right to internetwork with external institutions without the approval of the science-tech department.

(F4)

7) System security management (G4) a) Establish security management system to specify the system security policy, security configuration, log management and routine operation process, etc.;

b) Designate special personnel to manage the system; classify roles of system administrators and define the authority, responsibility and risk of each role; the authority setting shall comply with the least privilege principle;

c) The system administrator shall not concurrently hold business operator, or add, delete, modify any business data. Where the system administrator needs to maintain the business data in the database system indeed, the written approval shall be obtained from the business department and such information as maintenance content, personnel and time shall be recorded in detail; (F4) d) Information security manager shall scan the vulnerability at least once every quarter, repair the discovered system security vulnerability and report the scanning result timely; (F4) e) Install the latest patch program of the system, which shall not be carried out until the program passes the test in the test environment first and then important files are backed up; the system change shall be recorded;

f) The system administrator shall maintain the system according to the operation manual and record the operation logs in detail including important routine operation, operation & maintenance records and parameter setting & modification, etc.; at least two persons shall be present for the setting of important computer system and unauthorized operation is strictly forbidden;

g) The system administrator shall record the system changes in detail; (F4) h) The running log and audit data shall be analyzed periodically, so as to discover abnormal behaviors timely;

backing up and encrypting the data needing encryption or concealment. All files and records shall be properly kept.

d) For the important information system, special disaster backup switching exercise shall be carried out at least once a year, and comprehensive exercise be carried out at least once every three years. Determine the period of exercise depending on the emergency recovery contents and assign special personnel to manage and maintain the emergency plan which shall be updated and improved properly according to the change of personnel and information resources, and the exercise conditions, so as to guarantee effectiveness of the emergency plan and its accessibility in disaster; (F4) e) Check the validity of backup data periodically and at least 10% data shall be sampled each time. The backup data shall be kept remotely; (F4) f) The disaster recovery demand shall be reanalyzed periodically with the longest period of three years. Where significant change occurs on the environment of production center, production system or business process, the organization shall immediately reanalyze the disaster recovery demand and develop disaster recovery policy based on the analysis; (F4) g) Where relevant password is required for recovery and application of backup data, the password shall be sealed and then properly kept together with all the data media; (F4) h) Develop corresponding disaster recovery plan according to the technical requirements for backup of the information system and testing the plan to ensure the correctness of each recovery regulation and the effectiveness of the overall plan. The test content includes recovery of operating system, personnel coordination, backup system performance test, communication connection, etc. The non-applicable specifications shall be modified or updated according to the test results;

i) Disaster recovery training shall be carried out periodically, which is subject to the unified arrangement of relevant departments if possible. Disaster recovery exercise shall be conducted at least once a year, including remote backup station switching exercise and local-system disaster recovery exercise. Remote backup station switching: establish hot backup station in different location to undertake the function of host station in case that the host system becomes unrecoverable in disaster. Local-system events causing system interruption and information leakage.

g) Report the significant losing and disclosure event that may involve state secrets to the police, security and confidential departments according to the relevant provisions;

h) Strictly control the personal participated in the handling and recovery of the event involving state secrets; at least two personnel shall be present and be registered for important operations;

i) Establish effective technical support mechanism so that the emergency handling of security event will not be interrupted or prolonged due to deficient technical capacity. (F4)

13) Management of emergency plan (G4) a) Develop emergency plans for different events under the uniform emergency plan framework which shall include emergency organization, emergency plan starting conditions, emergency processing flow, system recovery flow, event information collection, analysis and reporting system, after-the-fact education and training, etc. The emergency plan for transaction processing system shall be jointly prepared by relevant operating department and science-tech department and be provided with the signature and seal of the involved organization;

b) Ensure sufficient resources for the execution of emergency plan from aspects of manpower, equipment, technology, finance, etc.;

c) Conduct training on emergency plan for system-related personnel at least once a year;

d) For the purpose of cooperative business with the third party, establish and improve internal responsibility mechanism and the coordination mechanism with relevant organizations; develop complete emergency plan and emergency coordination plan, and periodically participating in joint exercise; (F4) e) The emergency handling leading team shall uniformly lead the emergency management of computer system, command and make decision for significant emergency handling matters and coordinate emergency resources, appoint specific contact person for emergency handling and report the contact information to the information security supervision department of the industry; (F4) f) The emergency leading group of financial institution shall

Bibliography

[1] "Standardization Law of the People's Republic of China" of Standing

Committee of the National People's Congress (No. 11 Presidential Decree of the People's Republic of China in 1988)

[2] GB/T 1.1-2000 Directives for Standardization - Part 1: Rules for the

Structure and Drafting of Standards

[3] GB/T 10112-1999 Terminology Work - Principles and Methods

[4] GB/T 16785-1997 Terminology Work - Harmonization of Concepts and

Terms

[5] GB/T 20001.1-2001 Rules for Drafting Standards - Part 1: Terminology

[6] GB/T 22240-2008 Information Security Technology - Classification Guide for Classified Protection of Information Systems Security

[7] GB/T 25070-2010 Information Security Technology - Technical

Requirements of Security Design for Information System Classified

Protection

[8] JR/T 0060 Securities and Futures Industry - Baseline for Classified

Protection of Information System

[9] JR/T 0067 Securities and Futures Industry - Testing and Evaluation

Requirement for Classified Protection of Information System

__________ END __________