JT/T 1275-2019Security risk assessment guidance for transportation information system (English PDF)

Foreword

This standard is in accordance with GB/T Draft the rules given in 1-2009.

Please note that some elements of this document may involve patents. The issuer of this document is not responsible for identifying these patents.

This standard is proposed by and under the jurisdiction of the Technical Committee on Transportation, Information, Communications and Navigation Standardization.

This standard was drafted. China Communications and Information Center.

1 Scope

This standard specifies the general requirements and implementation requirements for security risk assessment of transportation information systems.

This standard applies to the assessment and management of security risks in transportation information systems.

2 Normative references

The following documents are essential for the application of this document. For dated references, only the dated version applies to this article Pieces. For undated references, the latest version (including all amendments) applies to this document.

GB/T 1984-2007 Information Security Technology Information Security Risk Assessment Specification

3 Terms and definitions

The terms and definitions defined in GB/T 2084 and the following apply to this document. For ease of use, GB/T is repeatedly listed below Some terms and definitions in 1984.

Asset asset

Information or resources that are valuable to the industry are the objects of security policy protection.

[GB/T 1984-2007, definition 3. 1] 3. 2 Asset value Characterization of the importance or sensitivity of an asset. Asset value is the property of assets content.

[GB/T 1984-2007, definition 3. 2] 3. 3 Availability Data or resource characteristics, authorized entities can access and use data or resources as required.

[GB/T 1984-2007, definition 3. 3] 3. 4 Confidentiality the characteristics of the data, which means that the data has not been provided or leaked to unauthorized individuals, processes or other entities degree.

[GB/T 1984-2007, definition 3. 5] 3. Five Integrity Features that guarantee that information and information systems will not be altered or destroyed without authorization. Including data integrity and system integrity.

[GB/T 1984-2007, definition 3. 10] JT/T 1275-2019 3. 6 Information security risk security risk Human or natural threats make use of vulnerabilities in information systems and their management systems to cause security incidents Into the impact.

[GB/T 1984-2007, definition 3. 6] 3. 7 Security risk assessment security asssent According to relevant information security technology and management standards, the confidentiality and completeness of information systems and the information processed, transmitted and stored by them the process of evaluating security attributes such as integrity and usability. It assesses threats to assets and threats the possibility of a security event, and the value of the assets involved in the security event to determine if a security event occurs to the industry influences.

[GB/T 1984-2007, definition 3. 7] 3. 8 Inspection and assessment assentment Initiated by the superior authority or business authority of the assessed industry, the information system and its Manage mandatory inspection activities.

[GB/T 1984-2007, definition 3. 9] 3. 9 Self-assessment Risk assessment of the information system and its management initiated by the owner of the information system, referring to relevant national regulations and standards activity.

[GB/T 1984-2007, definition 3. 13] 3. 10 Information security incident confidential information Caused by natural, man-made or software or hardware defects or failures, causing harm to information systems or negatively affecting society event.

[GB/T 1984-2007, definition 3. 14] 3. 11 Security measures safety Practices, regulations to protect assets, protect against threats, reduce vulnerability and reduce the impact of security incidents, and combat information crime Process and mechanism collectively.

[GB/T 1984-2007, definition 3. 15] 3. 12 Threat Causes of accidents that could cause harm to the system or organization.

3. 13

Vulnerability

Weakness of assets or certain assets that could be exploited.

[GB/T 1984-2007, definition 3. 18] 3. 14 Information system information system it is composed of computers and related and supporting equipment and facilities (including networks), and the information is imported according to certain application goals and rules.

Collection, processing, storage, transmission and retrieval systems.

JT/T 1275-2019

4 General requirements for risk assessment

4.1 Work organization the security risk assessment of transportation information systems should focus on self-assessment. Self-assessment and inspection and assessment should be combined and complement each other.

Development.

Self-assessment is initiated by the competent department of the information system, the operating unit or the user unit.

Information systems carry out risk assessments.

The inspection and evaluation work shall be carried out by the higher-level management department of the information system or the relevant national functional department according to law.

4.2 Implementation requirements the transportation information system security risk assessment should be carried out regularly by the competent department of the information system, the operating unit, and the using unit. in when major changes are made to the information system or operating environment (including the discovery of new major threats and vulnerabilities), or other emergence that may affect system security all conditions should be reopened. The risk assessment work carried out during the trial operation of the information system should be an important part of project acceptance content.

The results of the information system security risk assessment shall be recorded in the risk assessment report, and targeted security rectification recommendations shall be made.

The assessment situation and improvement measures are reported to the relevant network security supervision function.

4.3 Implementation principles the implementation of the security risk assessment of the transportation information system follows the following principles.

a) The principle of least impact. The stable operation of the information system should be guaranteed, and the evaluation and testing items that may cause impact should be selected in non-business Test during peak business hours or in a simulated environment.

b) the principle of controllability. All personnel involved in the assessment of the security service organization shall sign a confidentiality agreement.

According to strict management, it shall not be disclosed to any unit or individual without authorization; the evaluation tools used shall be obtained from the party being evaluated.

license.

c) the principle of objective fairness. The security service organization should collect evidence in the risk assessment to make an objective assessment of the security risks of the information system Fair judgment.

4.4 Implementation form the transportation information system security risk assessment can be carried out in the form of self-assessment or third-party assessment by security service agencies.

Self-assessment and third-party assessment are combined and complementary. Third-party assessment should entrust a qualified security service agency Carry out.

4.5 Implementation methods the security risk assessment of the transportation information system should adopt the following implementation methods.

a) Document review. Consult the information system planning and design plan, security protection plan, management system and emergency plan, etc.

to evaluate.

b) On-site interviews. According to the needs of risk assessment, communicate with relevant personnel of the information system to understand the development and integration of the information system Development, supply, use, and management to understand the risks.

c) On-site testing. Check and test the asset status and configuration of the information system in the production environment, and agree with the appraised party Undertake vulnerability scanning and penetration testing.

d) Remote testing. According to the needs of the assessment, remote vulnerability scanning and penetration testing of the information system are performed.

JT/T 1275-2019

4.6 Risk Assessment of Information System Life Cycle the risk assessment at each stage of the information system life cycle should follow the requirements of Chapter 6 of GB/T 1984-2007.

5 Implementation of risk assessment

5.1 Evaluation principle the business implementation of information systems depends on system assets, which are vulnerable. Threats inside or outside the system, exploiting vulnerable assets Sexually jeopardizes assets, thereby generating security risks, and even evolving into security incidents, and affecting information system business. System adopted security Measures can compensate for the vulnerability of assets, thereby resisting threats and reducing risks.

Information system security risk assessment is based on identifying the three elements of information system assets, vulnerabilities and threats, and the possibility of production and the loss caused to the value of the affected assets are calculated as the impact on the system business, that is, the value at risk.

5.2 Implementation process According to various work contents in the risk assessment implementation process, the risk assessment implementation should be divided into risk assessment preparation, risk element identification, Risk analysis and risk processing in four stages. The main work of each stage is.

a) Risk assessment preparation. As a guarantee of the effectiveness of the evaluation implementation, it is the beginning of the evaluation.

b) Identification of risk elements. Identify and assign key elements of assets, threats, vulnerabilities and security measures in assessment activities.

c) Risk analysis. Perform correlation analysis on various types of information obtained during the identification phase and calculate the risk value.

d) Risk management. According to the assessed risks, put forward corresponding disposal recommendations, and carry out safety reinforcement according to the disposal recommendations.

Participate in risk management and other content.

The implementation process of the security risk assessment of the transportation information system is shown in Figure 1.

Figure 1 Risk assessment implementation process

5.3 Evaluation Preparation the work in the risk assessment preparation phase should meet the requirements of GB/T 2084-2007. For the work of forming a team, see Appendix A.

5.4 Asset identification

5.4.1 Asset classification Transportation information system assets are mainly divided into the following three categories.

JT/T 1275-2019

a) Production service systems. Support various transportation service departments to provide information services on transportation services such as cargo and passengers, Production support systems, such as rail transit signal systems, road traffic monitoring systems, intelligent gate systems, and doors for organizations Websites, highway and waterway travel service systems, and national public transportation and logistics public information platforms.

b) Administrative management system. Support transportation management departments and transportation service units at all levels in order to maintain their own organizational activities or Information systems built for administrative affairs in the transportation industry, such as office systems of various organizations, ship product inspection Inspection management system and online vehicle supervision information interaction platform.

c) Basic support systems. Support the operating environment of various systems in the transportation industry in terms of computing, operation or communication, such as various Organization's data center, cloud computing platform, highway fiber optic network and geographic information platform.

The risk assessment of the transportation information system should first determine the type of information system, and then according to Table 1 in GB/T 1984-2007 the requirements for identification and classification of assets contained in information systems.

5.4.2 Asset Assignment

5.4.2.1 Information system value benchmark the value benchmark of transportation information systems is based on the importance of business management and service assurance, and the confidentiality and integrity of information systems and availability of the three minimum required security attributes.

The value benchmarks of the three types of information systems in the transportation industry are shown in Table 1.

Table 1 Value benchmarks of the three types of information systems in the transportation industry

Information system category confidentiality integrity availability Production Services 2 3 3 Administrative Management 3 2 2 Basic support class 2 2 3

5.4.2.2 Asset Assignment Methods the value of the transportation information system assets on the three security attributes of confidentiality, integrity and availability, see GB/T Tables 2, 3, and 4 in 1984-2007.

The value of important assets contained in an information system should not be less than the value benchmark of the information system.

5.4.2.3 Asset importance the importance level of transportation information system assets should be synthesized by the value of the three security attributes of asset confidentiality, integrity and availability determination. Refer to Table 5 in GB/T 1984-2007 for a description of asset importance levels.

The calculation formula for the importance level of assets of the transportation information system is as follows.

siai

In the formula. v --- asset importance level;

s--the value benchmark of the three security attributes of the system;

a --- the value of the three security attributes of the asset.

5.5 Threat identification

5.5.1 Threat classification the threat sources of transportation information system security are divided into environmental and man-made threats. See Table 2 for specific threat sources.

JT/T 1275-2019

Table 2 Threat sources

Source description

envirnmental factor

Due to environmental conditions such as power outages, static electricity, dust, humidity, temperature, rat pests, electromagnetic interference, floods, fire and earthquake Natural disasters, accidents or failures in software, hardware, data and communication lines Human Factors Non-malicious person Malicious person Failure or loss of information due to lack of responsibility, inattention or inattention, and failure to follow rules and procedures Bad; internal staff suffers from information system failure due to lack of training, inadequate professional skills, and lack of job skills requirements or be attacked Insider Dissatisfied insiders are often allowed because they understand the target system and have certain permissions Allow unrestricted access to the system, and have more opportunities for attack than external attackers, so do not You need to know too much about computer intrusion to damage the system or steal system data.

High attack success rate Overseas National Power Well-organized, with sufficient financial, human and technical resources, and may Covert and highly disruptive distribution attacks that steal core organization secrets or make information systems comprehensive paralysis terrorist Terrorist attempts to disrupt, paralyze or use critical infrastructure to threaten national security Mass casualties have weakened the national economy and undermined the morale and confidence of the people. Terrorists may benefit Using phishing websites and malware to obtain funds or collect sensitive information may also attack a Goals to divert attention and protection from other goals hacker Hackers are hacking to get challenged or show off their skills in the hacker world force. Most of these attackers do not have professional technical capabilities, but they can download easily from the Internet.

Attacks and targets based on the use of destructive attack scripts and protocols. And their numbers Large amount, distributed worldwide, even independent or transient attack damage can cause serious as a result of Commercial spy Commercial spy attempts to gain intelligence-worthy assets and technical secrets by secret activity There are many ways to categorize threats. According to the threat sources in Table 2, Table 3 provides a classification of threats based on expressions.

method.

Table 3.A manifestation-based threat classification

Category Description Threat Subclass Software and hardware failure Due to equipment hardware failure, communication link disruption, and Defects in the system or software cause business implementation, Impact of stable system operation Control component and sensor failure, equipment hardware failure, transmission equipment failure Failure, storage media failure, system software failure, application software failure, database Software failures and development environment failures, etc.

Physical environmental impact Things that affect the normal operation of the information system Managing environmental and natural environmental issues Power failure, static electricity, dust, humidity, temperature, rodent pests, electromagnetic interference, flooding Environmental problems such as disasters, fires and earthquakes, or natural disasters, etc.

Do nothing

Or operation error

The corresponding operation was not performed because it should be performed Operation, or accidentally performed the wrong operation on the system Impact Maintenance errors, operational errors and excessive disclosure Poor management Security management could not be implemented or not in place, thus breaking Bad information system operates normally and orderly Irregular safety management, chaotic management, unclear responsibilities and incomplete management supervision Kind Malicious code and viruses Capable of self-replication and self-dissemination System constitutes corrupted program code Malicious code, Trojan backdoors, network viruses, spyware and eavesdropping software Pieces, etc.

JT/T 1275-2019

Table 3 (continued)

Category Description Threat Subclass Violation or abuse Beyond your own authority by adopting some measures Access to a resource that was not authorized to access, or abuse Acting under their own authority to disrupt information systems Unauthorized access to network resources, unauthorized access to system resources, abuse of permissions Improper modification of system configuration or data and abuse of authority to disclose secret information, etc.

Network attacks

Leverage tools and technologies such as reconnaissance, password cracking, Backdoor installation, sniffing, forgery, spoofing and denial of service to attack and invade information systems Network detection and information collection, vulnerability detection, sniffing (accounts, passwords, and permissions Restrictions, etc.), forgery and deception of user identity, theft of user or business data, and Sabotage, control and sabotage of system operations, phishing attacks and cloud computing Tenants use isolation failure to launch attacks, etc.

Social engineering

Comprehensive use of social sciences, such as psychology, linguistics and fraud, etc.

Deception, fraud, threats by personnel and weak links and intimidation, and access to technical means Control authority of information system and sensitive information Phishing emails, scam calls, etc.

Physical attack

Physical contact with software, hardware and Data destruction Physical contact, physical destruction, theft, etc.

Information leakage Information leakage to others who should not know Internal information leakage, external information leakage, etc.

tamper

Illegal modification of information, destroying the integrity of the information Reduced system security or information is not available Tamper with and bypass industrial control module instructions, tamper with network configuration information, tamper with Modify system configuration information, tamper with security configuration information, and tamper with user identity information Information or business data Supplier violation Suppliers and their sub-suppliers rely on their technological advantages and customer dependencies, for national and commercial interests, etc.

Reasons to violate the contract agreement to change the original service Promise Suppliers wantonly subcontract work content without the user's consent Equipment and systems rely on increasing operation and maintenance costs or occupying remote operation and maintenance authority, cloud Service providers operate user data without user consent, and cloud service providers migrate system Propose additional conditions Other threats besides those mentioned above

5.5.2 Threat assignment refer to the method specified in Table 8 in GB/T 1984-2007 for the threat assignment of the transportation information system.

Threat type.

Table 4 Major threats to transportation information systems

System type Focus on threat type Focus on threat subcategories Production Services Information leakage, personal information leakage, etc.

Malware backdoor etc Cyber attacks Denial of service attacks, exploits and phishing attacks, etc.

Physical attack outdoor terminal destruction and theft, etc.

Tamper with release information tampering, configuration information tampering, and control module instruction bypass, etc.

Software and hardware failure, industrial control module failure, communication line failure, etc.

Physical environment affects electromagnetic interference, natural disasters, etc.

JT/T 1275-2019

Table 4 (continued)

System type Focus on threat type Focus on threat subcategories Administrative Management Cyber attacks, denial of service attacks, exploits, etc.

Information leakage, sensitive information leakage, etc.

Tampering with web page tampering, data counterfeiting, etc.

Inadequate management. lack of management procedures, unclear responsibilities, and inadequate supervision and control Unauthorized or abused authorization, unauthorized access, etc.

Basic support

Software and hardware failures Computer hardware failures, software system failures, and communication line failures, etc.

The physical environment affects the internal environment of the equipment room Cyber attacks, denial of service attacks, exploits, etc.

Suppliers violate regulations and subcontract, operate user data in violation of regulations, etc.

5.6 Vulnerability identification

5.6.1 Vulnerability classification refer to the method specified in Table 9 of GB/T 1984-2007 for the vulnerability identification content of the transportation information system.

Vulnerable content in.

Table 5 Vulnerabilities identified by the transportation information system

System category identification object identification content Production Services System software (including operating system and system services) from patch installation, physical protection, user accounts, password policies, resource sharing, event auditing, Access control, new system configuration (initialization), registry hardening, network security, and system management Identification the WEB system recognizes aspects such as injection attacks, cross-site scripting, page hijacking, an...