MH/T 0068-2018Civil Aviation Mobile App Security Assessment Guide (English PDF)

4.1 Identification

The identification requirements are as follows.

a) When logging in with a password, check the complexity of the user's authentication information;

b) When the user identification information is lost or invalid, the authentication information reset or other technical measures should be adopted to ensure system security;

c) The user who logs in should be identified and authenticated. The identification is unique and the authentication information has complexity requirements;

d) The civil aviation mobile application should provide and enable the login failure handling function, and take necessary protective measures after multiple login failures.

Shi;

e) Two or more combinations of authentication technologies should be used for the same user to realize user identity authentication;

f) When the user changes the mobile device, the legitimacy of the user's identity should be re-verified.

4.2 Access Control

The access control requirements are as follows.

a) Necessary measures should be taken to restrict and protect account login;

a) Only the necessary system permissions should be applied to prevent the risk of deduction and privacy leakage;

b) Should meet the principle of minimum authorization, different user types (ordinary users, administrators, operators, auditors) and other roles the authority possessed is the minimum authority necessary for its operation;

c) The civil aviation mobile application should not limit the user's authority only through the interface, and should prevent attackers from bypassing the interface restrictions directly.

Submit a request;

d) All requests submitted by users and administrators should first be identified and verified to prevent unauthorized access.

4.3 Security Audit

The security audit requirements are as follows.

a) The security audit function should be enabled, and the audit covers every mobile terminal, and important terminal behaviors and important security events are audited;

b) It should be able to conduct individual behavior audit and data analysis of user behavior;

c) The log retention period is not less than 6 months.

4.4 Protection of Sensitive Information

The sensitive information protection requirements are as follows.

a) The instructions for using mobile application user data should be reviewed to determine the necessity of data collection and use;

b) Cryptographic technology should be used to ensure the integrity of data during communication;

c) Verification technology or cryptographic technology should be used to ensure the integrity of important data during storage, and necessary measures should be taken when integrity errors are detected.

Recovery measures;

d) Checking technology should be used to ensure the integrity of the code;

e) Encryption technology should be used to ensure the confidentiality of important data when stored locally;

f) Important data between mobile applications should not be unauthorized interoperability;

g) The storage space where the data files of the civil aviation mobile application are located should be completely cleared before being released or reallocated;

h) Encrypt the sensitive information fields or the entire message in the communication process;

i) The related cryptographic algorithms used for data storage and transmission shall comply with relevant national requirements.

4.5 Security of communication

The security requirements for communication are as follows.

a) Encryption technology should be used to ensure the integrity of data during wireless communication;

b) The confidentiality of sensitive information fields or the entire message should be guaranteed during wireless communication;

c) The relevant cryptographic algorithms used in the wireless communication process should meet the relevant national requirements;

4.6 Software fault tolerance

Civil aviation mobile applications should be fault-tolerant.

4.7 Software protection

The civil aviation mobile application program should be protected to prevent others from easily obtaining the source code of the civil aviation mobile application program.

4.8 Data backup and recovery

Should provide the mobile terminal important data backup and recovery functions.

Important data should be sent to the standby location in batches at regular intervals.

5.1 Basic principles of evaluation

5.1.1 Standard principles

The security evaluation of civil aviation mobile applications shall comply with the relevant requirements in GB/T 20984, GB/T 25058, GB/T 28448 and GB/T 31509.

Close requirements.

5.1.2 Controllability principle

During the implementation of the safety evaluation project, the service process, personnel and tools should be controlled in strict accordance with the standard project management method.

To ensure the controllability and safety of the evaluation implementation process, the specific measures are as follows.

a) Personnel and information controllability. The personnel participating in the evaluation should sign a confidentiality agreement to ensure the safety of the evaluation project information;

The data generated in the process should be strictly managed to prevent data leakage;

b) Process controllability. in accordance with project management requirements, a project implementation team should be set up, and the project team leader should be responsible for the project process.

control;

c) Tool controllability. Relevant tools tested and approved by the state or civil aviation department should be used in the evaluation process.

5.2 How the assessment works

5.2.1 Manual interview

Professional information security personnel should communicate and communicate with civil aviation mobile application system management, operation and maintenance personnel, and fully grasp the mobile application system.

The business process, data process, network architecture, host system, operation and maintenance situation, management organization and management system of the mobile application Provide a comprehensive understanding of the security status of mobile applications.

5.2.2 Manual inspection

The security test of civil aviation mobile application systems should be conducted with the expertise and experience of professionals.

5.2.3 Tool test

Automated evaluation tools should be used to conduct safety tests on evaluation targets, which can fully understand the current safety status of civil aviation mobile application systems, Vulnerabilities, potential threats, possible impacts and risks, etc.

5.2.4 Penetration test

The security test of the civil aviation mobile application system should be carried out by simulating hackers' attack methods.

6.1 Evaluation process

Civil aviation mobile application security evaluation is generally divided into four stages. evaluation preparation stage, evaluation plan preparation stage, and specific evaluation Implementation phase and evaluation report preparation phase.

6.2 Evaluation preparation stage

6.2.1 Main tasks in the preparation phase of the evaluation

The main task of the evaluation preparation stage is to determine the goal and scope of the evaluation, set up an evaluation team and master the civil aviation mobile being evaluated Information about the application.

6.2.2 Determine the purpose of the evaluation

The goal of the civil aviation web application system evaluation is to understand the security risks of the web application system, and make corresponding suggestions for the security risks found Security hardening recommendations.

6.2.3 Determine the evaluation object

To evaluate the civil aviation mobile application, the evaluation object is first clarified, and the evaluation object refers to the second level in GB T 22240.

The third-level civil aviation mobile application.

6.2.4 Establish an evaluation team

For the evaluation project, the evaluation team is formed. The project team is composed of the evaluation party and the evaluated party to clarify the responsibilities of the project team members.

6.2.5 System research

Investigate the civil aviation mobile applications to be evaluated, and master the basic information of the evaluated targets.

6.2.6 Determine the principles of evaluation tools

The selection and use of assessment tools should follow the following principles.

a) The evaluation tool should have a relatively comprehensive vulnerability evaluation capability;

b) The evaluation strategy and evaluation method used by the evaluation tool should not cause abnormal effects on civil aviation mobile applications;

c) Manual verification of tool evaluation results should be carried out to minimize false positives;

d) The selection and use of evaluation tools should comply with relevant national regulations.

6.3 Preparation stage of evaluation plan

The evaluation plan shall be formulated based on the information obtained during the preparation phase of the evaluation. The main contents include.

a) The objectives, scope and basis of the evaluation;

b) Evaluation team members and responsibilities;

c) Evaluation work plan. project implementation schedule and work content, form and work results of each stage;

d) Risk avoidance measures. including confidentiality agreements, assessment of working environment requirements, assessment methods, tool selection, emergency plans, etc.;

e) Project acceptance method. including acceptance method, basis and conclusion definition.

6.4 The specific implementation stage of the evaluation the main task of the specific implementation stage of the evaluation is to evaluate the target under evaluation in accordance with the evaluation plan. It should be in accordance with the civil aviation mobile application process.

The content in the basic network security requirements is tested, and the evaluation process data is recorded in detail.

6.4.1 Implementation of evaluation

6.4.1.1 Identity authentication

6.4.1.1.1 Evaluation Unit 01

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Implementation of evaluation.

1) The civil aviation mobile application should be checked to see if it provides identification and authentication functions;

2) The civil aviation mobile application should be checked to see if measures have been taken to ensure the uniqueness of the identity and whether it is mandatory the initial password is modified when the user logs in for the first time, and whether the minimum length, complexity, and replacement cycle of the login user's password are adjusted.

The requirements and restrictions are fulfilled to ensure that the identification information is not easy to be fraudulently used;

c) Unit judgment. if 1) ~ 2) are all affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet or partially meets Index requirements for this evaluation unit.

6.4.1.1.2 Evaluation Unit 02

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be tested. The authentication information can be reset to check whether it is successful and verify the authentication letter.

Whether the information reset is effective;

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.1.3 Evaluation Unit 03

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Implementation of evaluation.

1) The civil aviation mobile application should be tested. It is possible to verify the identity by trying to log in to the system as legal and illegal users.

Whether the identification and identification functions are effective;

2) Civil aviation mobile applications should be penetration tested, such as multiple guesses of user passwords, verification of application system identity and authentication Whether the function has no obvious weakness;

c) Unit judgment. if 1) ~ 2) are all affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet or partially meets Index requirements for this evaluation unit.

6.4.1.1.4 Evaluation Unit 04

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Implementation of evaluation.

1) The civil aviation mobile application should be checked to see if it provides the login failure handling function and whether it is set according to the security policy Parameters such as the number of failed logins;

2) The civil aviation mobile application should be tested. You can verify whether the login failure handling function is effective;

c) Unit judgment. If 1)-2) are both affirmative, it meets the index requirements of this evaluation unit; otherwise, it does not meet or partially meets the requirements of this evaluation unit.

Evaluation unit index requirements.

6.4.1.1.5 Evaluation Unit 05

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be checked to see if two or more combinations of identification techniques are used to perform identity authentication;

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.1.6 Evaluation Unit 06

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be checked to see if it is re-verified on the replaced equipment when the equipment is replaced the identity of the user;

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.2 Access control

6.4.1.2.1 Evaluation Unit 01

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be checked to see if the same account is restricted from being accessed on different devices at the same time.

Line login

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.2.2 Evaluation Unit 02

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be checked to see if the civil aviation mobile application has applied for the following permissions but not used, the specific requirements are as follows.

1) Restrict/allow the use of mobile phone functions to access the Internet;

2) Restrict/allow the use of mobile phones to send and receive information;

3) Restrict/allow applications to register to automatically start applications;

4) Restrict/allow the use of mobile phones to take pictures or record;

5) Restrict/allow the use of mobile phones to read user data;

6) Restrict/allow the use of mobile phones to write user data;

7) Others.

c) Unit judgment. If the above evaluation implementation content is affirmative, it does not meet the requirements of the evaluation unit indicators, otherwise, it meets the evaluation Unit index requirements.

6.4.1.2.3 Evaluation Unit 03

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. The civil aviation mobile application should be checked, and the different user types in the civil aviation mobile application (general Users, administrators, operators, auditors) the operating authority of the software is the minimum authority of the functions that the user group can access;

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.2.4 Evaluation Unit 04

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. It should be checked whether the civil aviation mobile application program is used to restrict the user's access to different interfaces Restrictions are not just limited by the interface;

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.2.5 Evaluation Unit 05

The content of the evaluation is as follows.

a) Evaluation object. civil aviation mobile application;

b) Evaluation implementation. It should be checked whether there is a civil aviation mobile application that can be accessed by ordinary users and administrator users.

Data and interface;

c) Unit judgment. If the above evaluation implementation content is affirmative, it does not meet the requirements of the evaluation unit indicators, otherwise, it meets the evaluation Unit index requirements.

6.4.1.3 Security audit

6.4.1.3.1 Evaluation Unit 01

The content of the evaluation is as follows.

a) Evaluation object. safety audit equipment;

b) Implementation of evaluation.

1) Check whether the relevant equipment has the security audit function enabled, and check whether the audit strategy includes equipment operating status, network traffic, Management account login and important operations, etc.;

2) It should be checked whether audit measures are deployed in the network, and important behaviors and important security incidents of each mobile terminal should be audited.

c) Unit judgment. if 1) ~ 2) are all affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet or partially meets Index requirements for this evaluation unit.

6.4.1.3.2 Evaluation Unit 02

The content of the evaluation is as follows.

a) Evaluation object. safety audit equipment;

b) Evaluation implementation. It should be checked whether the audit measures can audit and analyze the user behavior of mobile terminals.

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.3.3 Evaluation Unit 03

The content of the evaluation is as follows.

a) Evaluation object. safety audit equipment;

b) Evaluation implementation. It should be checked whether the audit equipment can meet the requirements of keeping log information for 6 months.

c) Unit judgment. If the implementation of the above evaluation content is affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet the evaluation Unit index requirements.

6.4.1.4 Protection of sensitive information

6.4.1.4.1 Evaluation Unit 01

The content of the evaluation is as follows.

a) Evaluation objects. mobile application design documents and civil aviation mobile applications;

b) Implementation of evaluation.

1) The civil aviation mobile application design document should be checked to see if there is a description of the user data type, and collection and use Necessity description of data type;

2) The integrity of the communication data of the civil aviation mobile application should be tested, and the communication can be checked by obtaining the data packets of the communication parties Whether cryptographic technology is used in the message to ensure the integrity of the data in the communication process;

c) Unit judgment. if 1) ~ 2) are all affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet or partially meets Index requirements for this evaluation unit.

6.4.1.4.2 Evaluation Unit 02

The content of the evaluation is as follows.

a) Evaluation objects. mobile application design documents and civil aviation mobile applications;

b) Implementation of evaluation.

1) The civil aviation mobile application design documents should be checked to see if there are any cryptographic technologies used to ensure data in the communication process.

Complete description

2) The integrity of the communication data of the civil aviation mobile application should be tested, and the communication can be checked by obtaining the data packets of the communication parties Whether cryptographic technology is used in the message to ensure the integrity of the data in the communication process;

c) Unit judgment. if 1) ~ 2) are all affirmative, it meets the requirements of the evaluation unit index; otherwise, it does not meet or partially meets Index requirements for this evaluation unit.

6.4.1.4.3 Evaluation Unit 03

The content of the evaluation is as follows.

a) Evaluation objects. mobile application design documents and civil aviation mobile applications;

b) Implementation of evaluation.

1) The civil aviation mobile application design documents should be checked to see if there are verification techniques or cryptographic techniques to ensure important data According to the desc...