当前位置：网站首页>Business secret series -- Talking about the evaluation of commercial passwords from the perspective of Party A and Party B (I)

Business secret series -- Talking about the evaluation of commercial passwords from the perspective of Party A and Party B (I)

2022-07-26 07:08:00 【51CTO】

C0 Why write these articles

       
        Engaged in secret evaluation for more than one year , During this period, I engaged in many types of projects , provincial level IDC, Of each department OA And customized system . It's not the technology that takes time in this process , It is the docking with Party A or the evaluated party , Because secret reviews have emerged in recent years , All parties have insufficient understanding of it , As a result, people who want to pass the secret review don't know what to do . So it sprouted to write a series of articles , Help non insiders understand confidential comments .
      
1.

C1 Definition of terms 、 The structure of the series is

       
        This series of articles is written for non insiders to understand and understand confidential reviews , So I will introduce the corresponding technology , But it won't involve technical details , At the same time, try to use concise narration to make reading easy and clear . Here are some abbreviations and terms used for convenience ：
      
1.

Secret comments ： Full name “ Security evaluation of commercial password applications ”, Abbreviations are used in the series .
password ： Refers to encryption 、 Cryptographic techniques such as hashing , For login in daily concept “ password ” In the article, it is uniformly called password .
Party a ： Refers to the actual user of the system .
Party B ： Refers to the developer of the application system , Generally, it is a development company or an integration company .
The third party ： Refers to secret evaluation company .
Business secret certificate ： It refers to the certificate issued after passing the quality inspection of the State Password Administration , The full name is the commercial password product certification certificate （ or “ Commercial password product type certificate ”）, If you want to pass the secret evaluation, you must use software and hardware password products with business secret certificates , Otherwise, it may lead to high-risk items . The series of articles will be divided into three parts , The first is the basic introduction of this secret comment , The second is the indicators required by all levels of secret evaluation , Finally, it explains the quantitative evaluation rules of secret evaluation . Among them, the indicators at all levels of the secret evaluation will be interspersed with high-risk items guided by the high-risk judgment .

C3 Related concepts of secret evaluation

3.1 Why make secret comments

《 The code law of the people's Republic of China 》 Article 27 provides that ： law 、 Administrative regulations and relevant national regulations require the use of commercial passwords for the protection of key information infrastructure , Its operators should use commercial passwords to protect , Carry out the security evaluation of commercial password application by itself or by entrusting the commercial password detection agency . The security evaluation of commercial password application should be evaluated with the security detection of key information infrastructure 、 Network security level evaluation system is connected , Avoid double evaluation 、 Evaluation .

       
        In a nutshell ,《 Cryptology 》、《 Network security law 》、《 Network security level protection regulations 》 And other laws emphasize hierarchy 
       
 Protect level III and above information systems 、 Critical information infrastructure should be secretly evaluated .
      
1.
2.

3.2 Conditions for passing the secret evaluation

       
        Passing the secret evaluation needs to meet GB/T 39786-2021《 Information security technology   Basic requirements for password application of information system 》, Same as 
       
 According to the 《 Quantitative evaluation rules for security evaluation of commercial password application 》 score 60 above , And there is no 《 Information system password Application 
       
 High risk judgment guidelines 》 The high-risk item in is passing .
       
60 More than , And no high-risk items are the conditions for passing the secret evaluation .
      
1.
2.
3.
4.

References

3.3 Secret evaluation company 、 Password manufacturers, etc

       
        Maintained by the State Password Administration 《 Directory of pilot institutions for security evaluation of commercial password applications 》 Only institutions in China have implemented secret evaluation 
       
 Qualification of , total 48 home .（https://www.oscca.gov.cn/sca/xwdt/2021-06/11/content_1060863.shtml）
       
 Certified , Products with commercial secret certificates can be found on the commercial password authentication business network .（http://service.scctc.org.cn）
      
1.
2.
3.

3.4 Personnel who cooperate with the secret evaluation

       
        The implementation personnel of secret evaluation will ask about all aspects of the system in the early stage of secret evaluation and on site ：
       
1、 Physical condition of machine room , Need to enter the machine room for inspection ———— Computer room management personnel 
       
2、 Know the physical server location of the system , Management style , As well as network architecture and relevant password products adopted ———— System operation and maintenance personnel 
       
3、 The database used by the system , And the structure of the database and the form in which the corresponding data is stored , And the encryption method of data storage ———— Developer 
       
4、 Systems related to cryptographic equipment and key management ———— Party A's unit 
      
1.
2.
3.
4.
5.

Conclusion

       
        This article defines the terms and structures used in subsequent articles , At the same time, it expounds why we should conduct secret evaluation and pass secret evaluation 
       
 Conditions , And the basic knowledge related to secret evaluation . The follow-up meeting will be based on national standards GB/T 39786-2021《 Information security 
       
 technology   Basic requirements for password application of information system 》 Talk about the indicators at all levels of secret evaluation .
      
1.
2.
3.

原网站

版权声明
本文为[51CTO]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/201/202207181804295637.html