Wait for the new 2.0 standard officially released, how much do you know about the new changes in 2.0

On May 13, the State Administration for Market Regulation and the National Standardization Administration held a press conference to inform about the reform of the national standard-setting process, and at the same time released a number of important national standards.

In the field of network security, such national standards as "Information Security Technology Network Security Level Protection Basic Requirements", "Information Security Technology Network Security Level Protection Evaluation Requirements", "Information Security Technology Network Security Level Protection Security Design Technical Requirements" and other national standards related to the security 2.0 It was officially released today and will be implemented on December 1, 2019. This series of standards can effectively guide network operators, network security companies, and network security service organizations in the design and implementation of network security grade protection security technical solutions, guide evaluation organizations to carry out grade evaluation work in a more standardized and standardized manner, and thus comprehensively improve network operators Network security protection capabilities to ensure the stable operation of the network.

Some of the new changes regarding the Equal Insurance 2.0 are as follows:

1. Structural changes:The safety management center is upgraded from the management level to the technical level.

2. Changes in the number of requirements

3. Changes in coverage

On the basis of the 1.0 standard, the Equal Guarantee 2.0 standard achieves full coverage of protection objects such as traditional information systems, basic information networks, cloud computing, big data, Internet of Things, mobile internet, and industrial control information systems.

Information systems that use new technologies need to meet the requirements of "general requirements + security extensions" at the same time.

4. Changes in protection concepts

In terms of general requirements, the core of the Equal Guarantee 2.0 standard is "optimization." The outdated evaluation items were deleted, the evaluation items were rationally rewritten, and new requirements such as protection against new types of cyber attacks and personal information protection were added. The Equal Guarantee 2.0 standard still adopts the concept of "one center, triple protection". It has shifted from the passive defense security system of the Equal Guarantee 1.0 standard to a dynamic guarantee system of pre-prevention, response during the event, and post-event audit, focusing on all-round active defense and security. Trust, dynamic perception and comprehensive auditing.

5. Changes in the grading process:

The Equal Guarantee 2.0 standard is no longer self-grading, but through "Determining the object of the classification -> Preliminary determination of the grade -> Expert review -> Competent department review -> Public security agency filing review -> Final determination of the grade" This is a linear grading process. System grading must be reviewed by experts and competent authorities before it can be filed with the public security organs. The overall grading is more stringent, which will promote a more standardized grading process and a more reasonable system grading.

6. Changes in the evaluation cycle:

Compared with Dianbao 1.0, the evaluation period and evaluation results of Dianbao 2.0 have been adjusted. As required by the Equal Insurance 2.0 standard, systems above the third level shall conduct an evaluation once a year. The original 1.0 period requires that the four-level system conduct an equal protection evaluation every six months.

7. Changes in evaluation results

In the P2P 2.0, the test scores above 75 can be considered as basic compliance. The basic score is higher and the requirements become higher. Compared with the past, the insurance is not so easy, and the other point requires more investment.

8. Changes in centralized management and control

The security management center has made clear requirements for centralized management and control, and a unified centralized management platform will become a rigid demand in the future. The specific requirements for centralized control are as follows:

a) Specific management areas should be divided to manage and control the security devices or security components distributed in the network;

b) It should be able to establish a secure information transmission path to manage the security equipment or security components in the network

c) Conduct centralized monitoring of the operation status of network links, security equipment, network equipment and servers;

d) The audit data scattered on each device should be collected, summarized and analyzed, and the retention time of audit records should be in compliance with laws and regulations;

e) Centralized management of security-related matters such as security policies, malicious code, patch upgrades, etc.;

f) It should be able to identify, alarm and analyze various security events that occur in the network;

9. Changes in new technical requirements

It puts forward clear requirements for the application of trusted computing and cryptographic technology in the security 2.0, which will greatly promote the popularization and application of trusted computing and cryptographic technology.