JR/T 0223-2021Financial Data Security Data Life Cycle Security Specification (English PDF)

5.1 Security Framework

The life cycle of financial data refers to the collection, processing and management of financial data by financial institutions in the process of business development and management.

The entire process of transmission, storage, use, deletion, and destruction. The Data Lifecycle Security Framework (see Figure 1) follows data security principles to Based on data security classification, establish a security protection system covering the entire process of the data life cycle, and establish a sound data security organization Structure and clarify the data security requirements in the operation and maintenance of information systems, and comprehensively strengthen the data security protection capabilities of financial institutions.

The data life cycle security protection requirements are the core of the data life cycle security framework. For data with different security levels, specify its the security protection requirements of all links in the data life cycle such as collection, transmission, storage, use, deletion, and destruction are the requirements of financial institutions.

The basic basis for carrying out data security protection work. Combining financial data business rules and financial data characteristics, build a financial data life the security protection mechanism of the whole process of the cycle is the top priority of the data security protection work of financial institutions, and it is also the key to ensuring the security of financial data.

The only way.

Data security organizational guarantee and information system operation and maintenance guarantee are also essential components of the data life cycle security framework, which together constitute it is the cornerstone to ensure that the data life cycle security protection mechanism can be effectively implemented and strictly enforced. Data Security Organization Guarantees Ensure Data Security the work has a complete management system including the decision-making level, management level, executive level and supervision level, which provides a basis for the organization and implementation of data security-related work.

really lay the foundation. In the daily operation of financial institutions, the data security prevention and control work in the information system operation and maintenance process cannot be ignored.

Strengthen data security in the process of border control, access control, security monitoring, security audit, inspection and evaluation, emergency response and incident disposal.

The comprehensive risk prevention and control capability can effectively guarantee the effective implementation of the data security protection mechanism and the timely discovery and response of data security issues.

5.2 Hierarchical protection

The security level of financial data is in accordance with the relevant requirements of JR/T 0197-2020, according to the scope and degree of influence after the security is breached the security level of financial data is divided into 5, 4, 3, 2 and 1 from high to low.

The security of financial data referred to in this document mainly refers to ensuring the security of financial data at each stage of its life cycle.

Measures to minimize or reduce the possible security impact of data security breaches to an acceptable range. Among them, the level 1 data is in principle, there is no confidentiality requirement for public data, and its security protection should refer to the relevant integrity and availability security requirements of this document; Level 2 to Level 4 Data security protection should be on the basis of balancing security needs and business needs, and according to different data security levels, appropriate measures should be taken with emphasis.

Level 2 data should give priority to business needs, level 4 data should give priority to security needs, and level 5 data should be protected in accordance with national standards.

The relevant requirements of national and industry authorities shall be implemented.

The data security classification and data security protection work in the securities industry shall be implemented in accordance with the relevant requirements of the securities industry such as JR/T 0158-2018, Yunhuan the data security of the environment should meet the relevant requirements of the national and industry authorities. Overseas branches, subsidiaries and branches of financial institutions for data collected and generated in the course of conducting business, its security rating and data protection work shall be implemented in accordance with the relevant requirements for cross-border data.

Content involving personal financial information, in addition to meeting the requirements of this document, should also be implemented in accordance with the relevant requirements of JR/T 0171-2020.

Note. The terms of the specific security level are not specified in this document, which are the general security requirements that all data with security level 1 to 4 should meet; the specific security level has been specified.

All levels of clauses are additional security requirements that need to be implemented for this level of data protection.

7.1.1 Overview

Data collection refers to the direct or indirect collection of personal financial data by financial institutions in the provision of financial products and services, business management and other activities.

Financial information entities, as well as the process of obtaining data by external organizations such as corporate customers and external data suppliers. Data leakage during data collection Exposure, data source forgery, privileged account abuse, data tampering and other security risks.

The data collection process realizes data collection and extraction, conversion and standardization, information upload, and provides built-in security audit and supervision, etc.

Auxiliary tools. According to the collection mode, it can be divided into data collection from external institutions and personal financial information subjects, see Appendix A.

7.1.2 Data collection from external agencies

When financial institutions collect data from external institutions, the security requirements are as follows.

a) The responsibilities and obligations of both parties in terms of data security should be clarified through contract agreements and other means, and the scope, frequency, and types, uses, etc., to ensure the legal compliance and authenticity of data from external agencies, and provide relevant personal financial information when necessary body's authorization.

b) To collect data from external data suppliers, a data supplier restriction mechanism should be formulated, and the data source and data collection scope should be clarified and frequency, and carry out data security impact assessment in advance.

Note. Data security impact assessment (data security impact assessment). For data processing activities, check its legal compliance and judge Various risks of damage to the legitimate rights and interests of related parties, and the process of evaluating the effectiveness of relevant protection measures.

c) The corporate customer data collected should be directly related to the financial products or services provided, and should be consistent with the terms of contract agreements and privacy policies.

The content of the agreed collection should be consistent, and the data should not be collected beyond the scope.

d) The scope of personal financial information and important data and security control measures during the data collection process should be clarified to ensure that the collected data compliance, integrity and authenticity.

e) The data collected in batches through the system should adopt cryptographic techniques such as digests, message authentication codes, and digital signatures to ensure the collection process data integrity.

f) Security management and control should be carried out in the environment of manual batch data collection, and through personnel authority control, information fragmentation, etc., to prevent Prevent data leakage during the collection process.

g) When collecting data, the authenticity of the data collection equipment or system should be verified.

h) The data collection process should be recorded in logs, and technical measures should be taken to ensure the traceability of information sources.

i) When collecting level 3 and above data, passwords, device fingerprints, physical locations of devices, network access methods, device the authenticity of the data acquisition equipment or system is enhanced and verified by various factors such as equipment risk conditions.

j) When collecting Level 4 data, it should also meet the following requirements.

1) Carry out continuous dynamic authentication on the whole collection process to ensure the authenticity of the data collection equipment or system, and implement blocking if necessary.

operations such as disconnection and secondary authentication.

2) Encrypt the collected data.

3) It should not be collected manually.

7.1.3 Collect data from personal financial information subjects

When financial institutions collect data from personal financial information subjects, the security requirements are as follows.

a) Level 3 and above data should not be retained after the completion of APP, WEB and other client-related services, and the cache should be cleaned up in time.

b) The personal financial information collected should be directly related to the financial products or services provided, and should be consistent with the terms of contract agreements and privacy policies.

The content of the agreed collection should be consistent, and the data should not be collected beyond the scope.

c) When data is collected through paper forms and converted into electronic data, the following requirements are met.

1) Strictly approve and authorize operations such as saving, viewing, and copying forms, and operations involving data at level 3 and above should be Carry out special approval, and monitor and audit the whole process of form circulation.

2) In the process of electronicizing paper forms, technical measures should be taken to ensure the integrity and confidentiality of data in the electronic process.

row control.

d) The data collection process should meet the requirements described in 7.1.2 d)~j).

e) When financial institutions stop providing financial products or services, they should immediately stop data collection activities and data analysis application activities If there are other regulations stipulated by the relevant countries and industry authorities, the relevant regulations shall be followed.

7.2 Data transmission

Data transmission refers to the process by which financial institutions send data from one entity to another. There are data transmission interruptions, tampering, Security risks such as forgery and theft. Financial data transmission involves the full communication network architecture and communication methods associated with financial institutions, according to Transmission mode (see Appendix B), which can be divided into internal data transmission of financial institutions, data transmission between financial institutions and external institutions or financial customers There are two forms of data transmission, and the data transmission technology methods adopted by different transmission forms and different transmission objects are also different. Data transmission security requirements are as follows.

a) Take measures to strengthen network and data security during data transmission and meet the following basic requirements.

1) The security management of software development should be strengthened to ensure the security of data transmission tools, and necessary infiltration should be carried out before the tools go online Testing, support library vulnerability finding, etc., to prevent malicious damage, function tampering, information Attacks such as theft.

2) Security technologies or equipment such as firewalls and intrusion detection should be adopted to ensure the security of the data transmission network.

3) Security isolation and access control should be implemented between different network areas or security domains.

4) Terminals should adopt technical measures such as access control and terminal identification to prevent illegal or unauthorized terminals from accessing the internal network.

5) Identity authentication should be carried out for both parties in communication to ensure that both parties in data transmission are trustworthy.

6) Digital signatures, time stamps, etc. should be used to ensure the non-repudiation of data transmission.

7) Cryptographic or non-cryptographic techniques should be used to ensure data integrity.

8) A secure cryptographic algorithm should be selected, and insecure algorithms such as MD5, DES-CBC, and SHA1 should be disabled.

9) The internal transmission of level 2 and above data should be approved and authorized in advance to clarify the scope, frequency and validity period of the current authorization etc., to avoid one-time authorization, package authorization, etc.

10) The external transmission of level 2 and above data should be approved and authorized in advance and adopt data encryption, secure transmission channel or security Full transmission protocol for data transmission.

11) For internal data transmission of Level 3 and above, data encryption, secure transmission channel or secure transmission protocol shall be adopted for data transmission.

transmission.

12) Level 3 and above data should not be transmitted externally in principle. If it is really necessary to transmit due to business needs, it should be approved and authorized in advance.

And take technical measures to ensure data confidentiality.

13) For level 4 and above data transmission, the data should be encrypted at the field level and transmitted using a secure transmission protocol.

14) Personal financial information in level 4 data should not be transmitted externally in principle, unless otherwise stipulated by the state and industry authorities.

15) The transmission cache data should be cleared when the data transmission is incomplete.

16) The transfer history cache data should be cleared immediately after the data transfer is completed.

17) The security and reliability of data transmission should be regularly checked or evaluated.

18) The transmission of data to state agencies, industry supervisors and regulatory units should be carried out in accordance with the relevant national and industry management requirements.

b) To transmit data through the internal wireless network, on the basis of meeting the basic requirements of 7.2 a), the following requirements should also be met.

1) Use management and control measures such as binding device serial numbers or hardware addresses (MAC addresses) to control access to wireless access points, Reasonably set the transmission power to control the coverage of wireless signals.

2) The SSID adopts standardized naming rules, and does not disclose information such as organization names, network characteristics, and physical locations.

In the production environment, SSID broadcasting should be disabled to prevent attackers from directly obtaining wireless network information through scanning.

3) Adopt a safe and reliable encryption protocol to securely encrypt the wireless communication channel.

4) Ensure the physical security of wireless network devices, disable unnecessary services, and strengthen the management accounts and ports of wireless network devices.

password security, prohibit the use of weak passwords, and establish a security management baseline.

5) Strengthen the management of wireless network users, prohibit multiple people from using the same account, and use two-factor authentication to authenticate access users.

Identity verification, deactivation of accounts that have not logged in to use the wireless network for a long time.

6) Take measures to control the risk of cross-use of mobile smart terminals on the intranet and the Internet, and strengthen application security and data leakage Protection against the spread of malicious code.

7) Define the short-term use and temporary construction of the wireless network service period, and it should be dismantled or closed in time after the expiration.

c) To transmit data through the operator's network, on the basis of meeting the basic requirements of 7.2 a), private lines should be used for level 2 and above data or VPN and other technologies to ensure the security of the transmission channel and ensure the security of data transmission.

d) When transferring level 3 and above data in batches through physical media, the data should be encrypted or desensitized, and a special person is responsible for sending, receiving, and logging Recording, numbering, delivery, storage and destruction, etc. During the delivery process, sealing, double escort, video surveillance, etc. can be used to ensure physical Media safety is in place, and the physical media should not leave the scope of monitoring and control of relevant responsible persons and monitoring equipment during the transfer process.

And it should not be passed on through a third party without supervision, unless otherwise stipulated by the state and industry authorities.

7.3.2 Storage Security

The security requirements for data storage are as follows.

a) Data storage should not reduce the strength of security protection due to changes in storage form or storage timeliness.

b) Data should be stored in domains and levels according to factors such as security level, importance, magnitude, and frequency of use.

c) Data should be stored in accordance with the minimum sufficient principle, financial data that is not necessary for business should not be stored in any form, and the storage time should be the minimum time necessary for business, unless otherwise stipulated by the state and industry authorities.

d) Regularly conduct risk assessments on possible impacts during the data storage process, and take corresponding safety protection measures.

e) The desensitized data should be stored in isolation from the recovery files used to restore the data, and the technology used to restore the original data should be strictly Approval, and keep relevant approval and operation records.

f) Certain measures should be taken to ensure the integrity of data storage. When storing level 3 and above data, password technology, authority control and Control and other technical measures to ensure data integrity.

g) For level 2 and above data, technical measures shall be taken to ensure the confidentiality of the stored data. If necessary, multi-factor authentication and fixed processing may be adopted.

Security policies such as managing terminals, fixed processing procedures or tools, and dual-person dual-post control.

h) For the storage of level 3 data, technical measures such as encryption shall be adopted to ensure the confidentiality of data storage.

i) For information systems that store data at level 3 or above, its network security construction and supervision and management should meet the level 3 level of network security protection Require.

j) Files containing level 3 and above data stored in the file system should be protected by encrypted storage of the entire file.

k) Level 4 and above data should be encrypted and stored using cryptographic algorithms.

l) In principle, financial data generated within the territory of my country should be stored within the territory of my country, unless otherwise stipulated by the state and industry authorities.

m) Level 5 data generated within my country shall only be stored within my country.

n) The data storage area should be planned, and the data flow between different areas should be safely controlled.

7.3.3 Backup and restore

The safety requirements for data backup and recovery work are as follows.

a) According to the security level of data and the impact of data on system operation, formulate data backup strategy and recovery strategy, the backup strategy should be Indicate at least the location of backup data, file naming conventions, frequency of media replacement and method of off-site transportation of data, backup Backup cycle or frequency, backup scope, etc.

b) Production data should be backed up in real time and asynchronously, incrementally and completely, and provide local data backup and recovery complex function.

c) The remote data backup and recovery function of the data backup center in the same city and different places should be established, and the key data can be timed by using the communication network.

Bulk transfers to alternate sites.

d) Data backup should be based on a multi-redundancy strategy, which can be realized by using technologies such as tape, disk mirroring, disk cold backup, hot backup, and active-active.

The backup frequency and retention period shall not be lower than the relevant regulatory and business use requirements.

e) Disaster recovery drills should be carried out regularly, and the feasibility of key technology applications in the technical plan should be verified and tested, and records and Save the results of the verification test.

f) The validity and availability of the backup data shall be checked regularly, and the restoration and verification of the main backup business data shall be carried out regularly.

Data is dumped in time according to the lifespan of the medium to ensure data availability.

g) The safety protection level of the production data backup storage environment and its physical facilities shall be implemented in accordance with the requirements of GB 50174-2017.

h) The big data platform should provide the overall data migration function and have the ability to detect the integrity of the migrated data.