Secret comment-----

Business code It refers to the password technology and password products used for encryption protection or security authentication of information that does not involve state secrets .

Commercial password security assessment （ Short for secret comment ）
– Compliance
– correctness
– effectiveness
20191026《 The code law of the people's Republic of China 》

Cipher interpretation

1. Specification promotes password application
2. Administrative licensing system
3. Password requirements
4. Evaluate the review mechanism
5. The service agency recognizes that

Breach of clause
Password law of the people's Republic of China Article 37 - Article 1

Real threats

1. Passwords are not widely used
2. Password application is not standardized
3. Password application is not secure （MD5,SHA-1,RSA-512,DES

Three tier requirements
4. Legal needs
5. Waiting for insurance
6. System security requirements

Management organization
– State Password Administration
– Chinese cryptology society
– Institutions

Guidance document

1. Information system password application evaluation requirements
2. Information system password application evaluation process guide
3. Guidelines for high risk determination of password application in information system
4. Quantitative evaluation standard for security evaluation of commercial cryptographic applications
5. Commercial password application security assessment report template

service content
System grading and filing
Field gap analysis
Safety construction rectification
Formal evaluation
Safety self inspection, supervision and inspection

Secret rating
4

Evaluation methods

GMT Basic requirements for password application of information system

1. Physical and environmental security
2. Network and communication security
3. Device and computing security
4. Application and data security