MH/T 0069-2018Civil Aviation Cyber ??Security Level Protection Rating Guide (English PDF)

4.1 Safety protection level

The civil aviation network security protection level is divided into five levels in accordance with the provisions of 4.1 in GB/T 22240-2008.

4.2 Rating elements

4.2.1 GB/T 22240-2008 stipulates in 4.2 that the safety protection level of the graded protection object is determined by two primary grading elements. grade the object infringed when the object of protection is destroyed and the degree of infringement on the object.

4.2.2 According to the business information and system service characteristics of the civil aviation network and information system, the first-level element "degree of infringement on the object" it is further broken down into the following two secondary elements.

--Business importance;

--The scale of network and information system.

4.3 The relationship between first-level elements and safety protection levels the relationship between the first-level elements and the safety protection level is shown in Table 1.

4.4 Secondary elements

4.4.1 Business importance

4.4.1.1 Service importance refers to the importance of the services carried by the network and information system, which can be divided into three levels. general, important, and core.

The business importance of different types of networks and information systems is specifically analyzed in 6.2.

4.4.1.2 The importance of business is positively related to the degree of infringement on the object. The more important the business, the more serious the damage to the object.

4.4.2 Scale of network and information system

4.4.2.1 The scale of the network and information system can be evaluated by the available business volume or service range.

4.4.2.2 Business volume refers to the traffic volume carried by civil aviation networks and information systems that provide external services. According to the amount of business Less, divided into different levels. The business volume is positively related to the degree of infringement on the object. The greater the business volume, the more serious the infringement on the object.

4.4.2.3 The service scope refers to the geographic scope of civil aviation network and information system services, which is applicable to information with different geographic service scopes the system can be divided into national, regional, and provincial levels. The scope of service is positively related to the degree of infringement on the object. The wider the scope of service, the the more serious the infringement.

4.5 Rating process

The general process of civil aviation network and information system classification is as follows.

a) Determine the grading object;

b) Initially determine the grade;

c) Expert review;

d) Audit by the competent authority;

e) Record review by public security organs.

6.1 Method overview

For general civil aviation networks and information systems, the grading method shall be carried out in accordance with the description in this article; for basic information networks and cloud computing for supporting networks and information systems such as computing platforms, Internet of Things, mobile Internet, and big data platforms, the grading method should refer to 6.3.

The security of civil aviation network and information system includes business information security and system service security, related to the infringed object and the object the degree of violation may vary. Therefore, the security protection level should also be determined by two aspects. business information security and system service security.

The security protection level of the rated object reflected from the perspective of business information security is called the business information security protection level.

The security protection level of the rated object reflected from the system service security perspective is called the system service security protection level.

The grading method is as follows.

a) Determine the object infringed upon destruction, including.

1) Determine the object infringed when the business information is damaged;

2) Determine the object infringed when the system service is damaged;

b) Determine the degree of infringement on the object, including.

1) According to different infringed objects, two second-level elements are used to comprehensively assess the infringement process of business information security damage to the object.

degree;

2) According to different infringed objects, two second-level elements are adopted to comprehensively evaluate the process of the infringement of the service security to the object.

degree;

c) Determine the security protection level, including.

1) According to Table 2, obtain the business information security protection level;

2) Obtain the system service security protection level according to Table 3;

3) The higher of the business information security protection level and the system service security protection level is preliminarily determined as the security of the rating object Protection level.

6.2 Security protection level of civil aviation network and information system

Using the above method, the business information security level and system service security of various types of civil aviation networks and information systems can be determined respectively.

Level, and then determine its safety protection level. In order to save space, this standard omits the intermediate process and directly provides various types of civil aviation networks and information the grading recommendations of the system are shown in Table 4 to Table 11.According to the business function of the protection object of the unit's level, each unit will be classified and installed the full protection level should not be lower than the recommended level, that is to say, there should be at least one aspect of the business information security level and the system service security level not lower than the recommended level; for hierarchical protection objects carrying complex functions, the security level can be higher than the recommended level; for carrying multiple business functions the protection objects with the highest performance should be rated according to the highest recommended safety level; the protection objects not listed in the recommended table can be classified according to their the service functions of the bearer are graded with reference to this standard.

6.3 Rating instructions for specific rating objects

For supporting networks and information systems such as basic information networks, cloud computing platforms, Internet of Things, mobile Internet, big data platforms, etc., the security protection level shall be determined according to the importance of the level protection object that it carries or will be carried, and the security protection level should not be lower than its load the security protection level of the protection object.

For big data, factors such as data scale and data value should be considered comprehensively, based on data resources (integrity, confidentiality, availability) Factors such as the degree of infringement on national security, social order, public interest, and the lawful rights and interests of citizens, legal persons and other organizations after being destroyed Determine its safety protection level.

For those identified as critical information infrastructure, in principle, their security protection level shall not be lower than the third level.