MH/T 0067-2018Civil Aviation Web Application System Security Inspection Guide (English PDF)

4.1 Basic principles of testing

4.1.1 Standard principles

The safety inspection of civil aviation web application system shall meet the relevant requirements of the inspection process in GB/T 31509 and GB/T 25058.

4.1.2 The principle of controllability During the implementation of safety inspection projects, the service process, personnel and tools should be controlled strictly in accordance with standard project management methods.

To ensure the controllability and safety of the testing implementation process, the specific measures are as follows.

a) Personnel and information controllability. The personnel involved in the test should sign a confidentiality agreement to ensure the safety of the test item information;

The data generated in the process should be strictly managed to prevent data leakage;

b) Process controllability. in accordance with project management requirements, a project implementation team should be set up, and the project team leader should be responsible for the project process.

Control; before conducting a safety test, the tester should fully communicate with the tested party and inform the tested party before the test Test time and test strategy;

c) Tool controllability. Relevant tools that have been tested and approved by the state or civil aviation department should be used in the testing process.

4.1.3 The principle of least impact for the running civil aviation web application system, the tester should determine an appropriate test time window before testing to avoid business peaks at the same time, make an emergency plan for the business system.

4.2 How the test works

4.2.1 Manual interview

Professional information security personnel communicate and exchange with Web application system management, operation and maintenance and users, and fully master the Web application system Information on all aspects of the unified business process, data process, network architecture, host system, operation and maintenance, management organization and management system, Have a comprehensive understanding of the security status of Web application systems.

4.2.2 Manual inspection

Use the expertise and experience of professionals to conduct security tests on civil aviation Web application systems.

4.2.3 Tool test

Using automated web scanning tools to conduct security tests on the detection targets can fully understand the current security status of the web system and Information on vulnerabilities, potential threats, possible impacts and risks.

4.2.4 Penetration test

Simulate hacker's attack method to conduct security test on civil aviation Web application system.

5.1 Testing process

The safety inspection of civil aviation web application system should be divided into four stages.

--Test preparation stage;

--Inspection plan preparation stage;

--The specific implementation stage of testing;

--Inspection report writing stage.

5.2 Test preparation stage

5.2.1 Test preparation

The main task of the test preparation phase is to determine the target and scope of the test, set up a test team, and master the civil aviation web application being tested Information about the system.

5.2.2 Determine the purpose of the test

The goal of the civil aviation web application system detection is to understand the security risks of the web application system, and propose corresponding measures to the security risks found Security hardening recommendations.

5.2.3 Determine the detection range

To test the civil aviation Web application system, the business characteristics of the system operation should be grasped, and the business logic boundary should be determined according to its characteristics.

5.2.4 Establish a testing team

A testing team should be formed for the testing project, and the testing party and the tested party should jointly form a project team, and clarify the responsibilities of the project team members.

5.2.5 System research

The civil aviation web application system to be tested should be investigated, and the third part of the programming language, middleware, and call used by the target should be mastered.

Fang library files and other information.

5.2.6 Determine the basis for testing

The test basis is.

a) GB/T 28448

b) GB/T 20984

5.2.7 Determine the principles of testing tools

The selection and use of testing tools should follow the following principles.

a) The detection tool should have a more comprehensive vulnerability detection capability as much as possible;

b) The detection strategies and methods used by the detection tools should not cause abnormal effects on the Web application system;

c) Manual verification of tool test results should be performed as much as possible, and false alarms should be as few as possible;

d) The selection and use of testing tools should comply with relevant national regulations.

5.3 Test plan preparation stage

The test plan should be formulated based on the information obtained during the test preparation phase. The main contents include.

a) Testing objectives, assessment scope and assessment basis;

b) Testing team members and responsibilities;

c) Inspection work plan. project implementation schedule and work content, form and work results of each stage;

d) Risk avoidance measures. including confidentiality agreements, assessment of working environment requirements, assessment methods, tool selection, emergency plans, etc.;

e) Project acceptance method. including acceptance method, basis and conclusion definition.

5.4 The specific implementation stage of testing

5.4.1 General

The task of the specific implementation phase of the detection is to detect the target according to the detection plan, and the content in Appendix A should be tested, and the details Record the inspection process data.

5.4.2 Test implementation

5.4.2.1 Identity authentication

5.4.2.1.1 The administrator of the web application system shall be interviewed to ask whether the web application system adopts identification and identification measures, and the specific measures Content; and the types of measures to prevent fraudulent use of identity authentication information.

5.4.2.1.2 The administrator of the web application system should be interviewed to ask whether the web application system has a login failure handling function.

5.4.2.1.3 The design or acceptance documents shall be checked to see if there is a description of the measures adopted by the system to ensure unique identification.

5.4.2.1.4 The operating procedures and operating records shall be checked to see if there are operating procedures for adding, deleting users and modifying user rights, Operation records and approval records.

5.4.2.1.5 The main Web application system should be checked to see if it uses a combination of two or more identity authentication technologies.

Identification.

5.4.2.1.6 The main web application system should be checked to see if it provides identification and authentication functions; if the identification information is is it not easy to be used fraudulently; whether its authentication information complexity check function can ensure that there is no weak password in the system.

5.4.2.1.7 The main web application system should be checked to see whether the login failure handling function provided by it is configured according to the security policy.

Close parameters.

5.4.2.1.8 The main web application system should be tested. You can log in to the system as legal and illegal users to check whether it is successful.

Verify that its identity and authentication functions are effective.

5.4.2.1.9 The main web application system shall be tested to verify whether its login failure handling function is effective.

5.4.2.1.10 The main Web application system should be penetrated to verify whether the identity and authentication functions of the Web application system are not obvious.

weakness.

5.4.2.2 Access control

5.4.2.2.1 Web application system administrators should be interviewed to ask whether the Web application system provides access control measures, as well as specific measures and Access control strategy, the granularity of access control.

5.4.2.2.2 The main web application system should be checked to see if the system provides access control mechanisms; whether users are controlled according to security policies Access to the object.

5.4.2.2.3 The main web application system shall be inspected to see whether the coverage of its access control includes the main web application system directly related to information security.

Objects,, and operations between them; whether the granularity of access control reaches the user level of the subject, and the object of the file and database table level.

5.4.2.2.4 The main web application system should be checked to see if there are authorized users to set other users to access system functions and the number of users.

According to the function of the authority, whether to restrict the access authority of the default user.

5.4.2.2.5 The main web application system should be checked to see if the system grants different accounts the minimum rights required to complete their respective tasks.

Limits, whether the privileges of privileged users are separated, and whether the permissions are mutually restricted.

5.4.2.2.6 The main web application system should be checked to see if the user's operations on restricted resources are strictly controlled according to the security policy.

5.4.2.2.7 The main web application system should be tested. You can log in to the system as users with different permissions to check whether their permissions are the same as the permissions granted by the system are consistent to verify whether the Web application system access control function is effective.

5.4.2.2.8 The main web application system should be tested. You can log in to the system through the default user and perform some legal and illegal operations to Verify that the system strictly restricts the access rights of the default account.

5.4.2.2.9 The main web application system should be penetrated to verify whether the access control function of the web application system is effective.

5.4.2.3 Security audit

5.4.2.3.1 Security auditors should be interviewed to ask whether the Web application system has a security audit function, and the strategy for auditing incidents.

And audit log protection measures.

5.4.2.3.2 The main web application system should be checked to see if the log function is enabled.

5.4.2.3.3 The main web application system should be checked to see whether its current audit scope covers every user.

5.4.2.3.4 The main web application system should be checked to see whether its audit strategy covers important security-related events in the system, including but not limited to user identification and identification, all operation records of access control, important user behavior, abnormal use of system resources, important system life the use of orders, etc.

5.4.2.3.5 The main web application system should be checked to see whether its audit record information includes the date and time of the event, and the trigger event.

The subject and object of the file, the type of event, the success or failure of the event, the source of the request in the identity authentication event, the result of the event, etc.

5.4.2.3.6 The main web application system shall be checked to see if it provides special audit points for authorized users to browse and analyze audit data.

Analysis function, and can generate audit reports as required.

5.4.2.3.7 The main web application system should be checked to see if the log retention period is less than 6 months.

5.4.2.3.8 The main web application system should be tested, and some important security-related events should be generated on the web application system.

Whether the application system has audited it, verify whether the coverage of the security audit of the Web application system covers every user; if After auditing, check whether the audit record contains the date, time, initiator information, type, description, and result of the event.

5.4.2.3.9 The main web application system should be tested to try to delete, modify or overwrite the audit records without authorization to verify the protection of the security audit Whether it is impossible to delete, modify or overwrite the audit records without authorization.

5.4.2.4 System sensitive information protection (order adjustment)

5.4.2.4.1 Web application system administrators should be interviewed to ask whether the Web application system adopts security measures for the storage and use of sensitive information.

Measures.

5.4.2.4.2 The main web application system should be checked to see if it contains sensitive files such as backups and system configuration in the released files.

5.4.2.4.3 The main web application system should be checked to see if it has made necessary modifications to the deployment files to prevent the leakage of sensitive information.

5.4.2.4.4 The main web application system should be checked to see if all information has been cleared after stopping use.

5.4.2.4.5 The main web application system should be checked to see whether the sensitive fields in its database are encrypted and stored.

5.4.2.4.6 The main web application system should be tested to see if the download of sensitive files such as system configuration is restricted.

5.4.2.4.7 The main web application system should be tested to see if there are open source components and other information exposed.

5.4.2.5 Communication security

5.4.2.5.1 The security administrator should be interviewed to ask whether the Web application system has protective measures during data transmission, and the specifics the content of the measure.

5.4.2.5.2 The design or acceptance documents should be checked to see if they have instructions on protecting the security of communications.

5.4.2.5.3 The main web application system should be tested. By checking the content of the data packets of both parties, check whether the system can Before establishing a connection, use password technology to perform session initialization verification; check that the system performs the entire message or session process during the communication process.

Whether the function of row encryption is valid.

5.4.2.6 Software fault tolerance

5.4.2.6.1 The web application system administrator should be interviewed to ask whether the web application system has measures to ensure software fault tolerance, and the content of specific measures.

5.4.2.6.2 The main web application system should be checked to see whether the web application system has input to the man-machine interface or the data input from the communication interface Carry out validity and safety verification.

5.4.2.6.3 The main web application system should be penetrated to verify that the web application system is valid and effective on the various data input by the user.

Security verification.

5.4.2.6.4 Code auditing methods shall be used to conduct security audits on the code of the main web application system.

5.4.2.7 Resource control

5.4.2.7.1 The administrator of the Web application system should be interviewed to ask whether the Web application system has measures for resource control and the specific measures.

content.

5.4.2.7.2 The main web application system should be checked to see if multiple concurrent sessions of a single account are restricted;

Limit the number of possible concurrent session connections; whether to limit the shortest connection time.

5.4.2.7.3 The main web application system should be checked to see if there is a minimum service level setting. When the service level of the system drops to when the preset minimum value, the system alarms.

5.4.2.7.4 The main web application system should be tested, and the system can be tested by multiple concurrent sessions exceeding the prescribed number of single accounts.

Connect to verify whether the system can correctly limit the number of multiple concurrent sessions for a single account.

5.4.2.7.5 The main Web application system should be tested, and the service level can be reduced to the minimum value specified in advance to verify whether the system can Enough to detect and alarm correctly.

5.4.2.7.6 Important Web application systems should be tested. When one of the two communicating parties of the Web application system has not made any response for a period of time should, check whether the other party can automatically end the session.

5.4.2.8 Data backup and recovery

5.4.2.8.1 The administrator of the Web application system should be interviewed to ask whether the application has a backup function and a backup strategy.

5.4.2.8.2 The design or acceptance documents should be checked to see if the Web application system has a backup function.

5.4.2.8.3 The Web application system shall be tested to check the data backup function strategy and effectiveness of the Web application system.

5.4.2.9 Business logic security

5.4.2.9.1 Business executives should be interviewed, asked about the business processing flow of the Web application system, analyzed whether the business flow is reasonable, and the system code is verified.

5.4.2.9.2 System developers should be interviewed to inquire about the identity authentication mechanism and control logic of the Web application system, and perform the system code verification.

5.4.2.10 Management System

5.4.2.10.1 The Web application system shall be tested for the management system in accordance with the three-level basic requirements of the information system level protection.

5.4.2.10.2 System administrators, security auditors and users should be interviewed to ask whether the Web application system has a management system and instructions for use.

Pieces etc.

5.4.2.10.3 The design or acceptance documents shall be checked, and whether the design and construction are carried out in accordance with the basic requirements of the three-level protection of the information system.

5.4.3 Document Management

To ensure the completeness, accuracy and safety of the testing documentation, the following principles should be followed.

a) A dedicated person should be assigned to organize and preserve the documents;

b) The document should indicate project-related information. project name, document name, version number, approver, distribution scope, etc.;

c) The project information should not be disclosed to unrelated persons and organizations without permission.

5.5 Test report preparation stage

The testing process and testing results should be analyzed and sorted out, and the safety status of the tested target should be evaluated, and corresponding safety enhancements should be given.

Consolidate recommendations and form a final report.

Appendix A

(Normative appendix) Web application system security basic requirements A.1 Identification A.1.1 The login authentication function should be provided in the system management and ordinary user management modules to identify and authenticate the login user.

A.1.2 For important system modules, two or more authentication techniques should be adopted to authenticate users.

A.1.3 The uniqueness and complexity of the account and password entered by the user should be verified to ensure that they are not fraudulently used.

A.1.4 Measures such as verification code, limit illegal times, automatic logout, and session termination should be provided to prevent brute force cracking.

A.2 Access control

A.2.1 The file types that users can access and download should be limited in the configuration file. (There must be a specific method in the test) A.2.2 The user's operation authority for each directory and file should be limited in the configuration file.

A.2.3 Different accounts should be set with different permissions. on the one hand, they are divided according to functions, and on the other hand, they are divided according to management permissions.

They form a restrictive relationship.

A.2.4 The type of uploaded file or the path and type of accessed file should be defined in the code.

A.2.5 The user's authority should be restricted in the module code logged in the background to prevent vertical and horizontal unauthorized access.

A.2.6 Access control should also refer to the requirements of host security access control in the basic requirements of level protection.

A.3 Security audit (after backup) A.3.1 The operation log audit module should be designed in the Web application system.

A.3.2 The content of the operation log should cover each user.

A.3.3 The content of the operation log should include operation type, time, account, operation result, etc.

A.3.4 It shall have the functions of operation log for statistics, query, analysis and report generation.

A.3.5 The log retention period is not less than 6 months.

A.4 System Information Protection A.4.1 The error file should be configured to prevent the exposure of sensitive information.

A.4.2 Sensitive information, such as system backup files and system configuration information, should not be stored in the system.

A.4.3 The configuration file should be set, try not to expose system information, such as operating system, web container, etc.

A.4.4 If open source components are used, necessary modifications should be made to prevent relevant information from being exposed.

A.4.5 After the system stops using, all information should be completely cleared.

A.4.6 Encrypted storage of sensitive information in the database.

A.5 Security of communication A.5.1 For important modules, it is recommended to use encryption for information exchange.

A.5.2 The originator and receiver of the data shall be provided with the non-repudiation function of data reception and transmission.

A.6 Software fault tolerance the data entered by the user should be effectively verified, including the validity of the content and the detection of the attack code.

A.7 Resource control A.7.1 The maximum connection time should be limited in the web container.

A.7.2 The maximum number of concurrent connections to the system should be limited in the web container.

A.7.3 The multiple sessions of a single user should be restricted during system code design.

A.7.4 For important Web application systems, a running status monitoring system should be deployed to detect and alarm the status of system resources.