GB/T 20273-2019 PDF English
US$610.00 · In stock · Download in 9 secondsGB/T 20273-2019: Information Security Technology - Security Technical Requirements for Database Management System Delivery: 9 seconds. True-PDF full-copy in English & invoice will be downloaded + auto-delivered via email. See step-by-step procedureStatus: Valid GB/T 20273: Evolution and historical versions
| Standard ID | Contents [version] | USD | STEP2 | [PDF] delivery | Name of Chinese Standard | Status |
| GB/T 20273-2019 | English | 610 |
Add to Cart
|
0-9 seconds. Auto-delivery
|
Information Security Technology - Security Technical Requirements for Database Management System
| Valid |
| GB/T 20273-2006 | English | 150 |
Add to Cart
|
0-9 seconds. Auto-delivery
|
Information security technology -- Security techniques requirement for database management system
| Obsolete |
Excerpted PDFs (Download full copy in 9 seconds upon purchase)PDF Preview: GB/T 20273-2019
GB/T 20273-2019: Information Security Technology - Security Technical Requirements for Database Management System
---This is an excerpt. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.), auto-downloaded/delivered in 9 seconds, can be purchased online: https://www.ChineseStandard.net/PDF.aspx/GBT20273-2019
NATIONAL STANDARD OF THE
PEOPLE’S REPUBLIC OF CHINA
ICS 35.040
L 80
Replacing GB/T 20273-2006
Information Security Technology - Security Technical
Requirements for Database Management System
Issued on. AUGUST 30, 2019
Implemented on. MARCH 1, 2020
Issued by. State Administration for Market Regulation;
Standardization Administration of the People’s Republic of
China.
Table of Contents
Foreword... 3
1 Scope... 5
2 Normative References... 5
3 Terms, Definitions and Abbreviations... 6
3.1 Terms and Definitions... 6
3.2 Abbreviations... 6
4 Description of Evaluation Target... 7
4.1 An Overview of Evaluation Target... 7
4.2 Security Features of Evaluation Target... 8
4.3 Evaluation Target Deployment Mode... 9
5 Definition of Security Issues... 10
5.1 Data Assets... 10
5.2 Threats... 10
5.3 Organization Security Policy... 13
5.4 Hypotheses... 15
6 Security Objectives... 18
6.1 TOE Security Objectives... 18
6.2 Environment Security Objectives... 22
7 Security Requirements... 25
7.1 Extension Component Definition... 25
7.2 Requirements of Security Function... 27
7.3 Requirements of Security Assurance... 46
8 Fundamental Principle... 69
8.1 Fundamental Principle of Security Objectives... 69
8.2 Fundamental Principle of Security Requirements... 83
8.3 Component Dependency... 93
Appendix A (informative) Instruction of Standard Amendment and Application
... 96
Bibliography... 101
1 Scope
This Standard stipulates the description of database management system evaluation
target; the definition, security objectives and requirements of security issues of different
evaluation assurance levels of database management system; the fundamental
principles between the definition of security issues and security objectives, and
between security objectives and security requirements.
This Standard is applicable to the test, evaluation and procurement of database
management system. It may also be applied to the guidance of the research and
development of database management system.
NOTE. Level-EAL2, Level-EAL3 and Level-EAL4 security requirements stipulated in this
Standard are applicable to not only the security evaluation of database
management system based on GB/T 18336.1-2015, GB/T 18336.2-2015 and
GB/T 18336.3-2015, but also GB/T 17859-1999-based database security
evaluation of second-level database system audit protection, third-level security
label protection, fourth-level structural protection. Please refer to A.1 in Appendix
A for relevant correspondences.
2 Normative References
The following documents are indispensable to the application of this document. In
terms of references with a specified date, only versions with a specified date are
applicable to this document. In terms of references without a specified date, the latest
version (including all the modifications) is applicable to this document.
GB/T 18336.1-2015 Information Technology - Security Techniques - Evaluation Criteria
for IT Security - Part 1.Introduction and General Model
GB/T 18336.2-2015 Information Technology - Security Techniques - Evaluation Criteria
for IT Security - Part 2.Security Functional Components
GB/T 18336.3-2015 Information Technology - Security Techniques - Evaluation Criteria
for IT Security - Part 3.Security Assurance Components
GB/T 25069-2010 Information Security Technology - Glossary
GB/T 28821-2012 Technical Requirements of Relational Database Management
System
3 Terms, Definitions and Abbreviations
3.1 Terms and Definitions
Terms and definitions defined in GB/T 25069-2010, GB/T 18336.1-2015 and GB/T
28821-2012 are applicable to this document.
3.2 Abbreviations
The following abbreviations are applicable to this document.
ACID. Atomicity, Consistency, Isolation and Durability
CM. Configuration Management
DBMS. Database Management System
EAL. Evaluation Assurance Level
IT. Information Technology
JDBC. Java DataBase Connectivity
LBAC. Label Based Access Control
ODBC. Open Database Connectivity
PP. Protection Profile
RDBMS. Relational DataBase Management System
SFP. Security Function Policy
SFR. Security Functional Requirements
SQL. Structured Query Language
4 Description of Evaluation Target
4.1 An Overview of Evaluation Target
In this Standard, target of evaluation (TOE) refers to management software and
database object that it manages included in the database management system
(DBMS).
4.2 Security Features of Evaluation Target
DBMS provides multiple security control measures to guarantee its management data
asset security. TOE security features may be directly provided by DBMS itself, or,
indirectly supported by the information technology (IT) environment of DBMS operation.
4.3 Evaluation Target Deployment Mode
If any internal and external entity of DBMS needs to obtain data assets of TOE
management, firstly, it shall satisfy corresponding security policies of TOE and the
operating environment.
5 Definition of Security Issues
5.1 Data Assets
Data assets that need to be protected by DBMS include.
5.2 Threats
5.2.1 Overview
TOE is confronted with security threats, such as. excessive or legitimate abuse of
privileges; exploited software vulnerabilities and potential application security attacks
(such as. SQL injection, denial of service and elevation of privileges, etc.). Table 1
provides different threats confronting evaluation assurance level (EAL) of DBMS. EAL2,
EAL3 and EAL4.
5.2.9 Masqueraded authorized user (T.MASQUERADE)
Malicious user or process might masquerade as authorized administrator or authorized
user to access database dictionary, system security configuration parameters or data
assets protected by DBMS.
5.2.10 Flawed test (T.POOR_TEST)
Development or testing personnel’s unthorough test of TOE (including database
security options and supporting environment), which leads to undetected TOE
weaknesses (logic errors). Malicious user might take advantage of these unknown
loopholes to attack TOE.
5.2.11 Residual data usage (T.RESIDUAL_DATA)
Malicious user or process might utilize flaws in the processing of database instance
shared cache or residual data on the disk; take advantage of residual data that is not
deleted during the execution of database instance, so as to obtain sensitive information
or abuse the security functions of TOE.
5.3 Organization Security Policy
5.4 Hypotheses
5.4.1 Overview
In accordance with the security objectives of DBMS, continuously identify more
hypotheses. ST author extends evaluation assurance level (EAL) of DBMS. EAL2,
EAL3 and EAL4 listed in Table 3.
5.4.2 Directory server protection (A.DIR_PROTECTION)
Directory server (for example, LDAP) that TOE adopts can defend against
unauthorized access to TSF data that is stored in the directory, including
6 Security Objectives
6.1 TOE Security Objectives
6.1.1 Overview
The security objectives defined in this Standard may be explicitly traced back to TOE-
related threats or organization security policies. Table 4 provides TOE security
objectives of evaluation assurance level (EAL) of DBMS. EAL2, EAL3 and EAL4.
6.1.4 Administrator guidance (O.ADMIN_GUIDANCE)
6.1.7 Audit data protection (O.AUDIT_PROTECTION)
TOE shall have the capability of securely storing audit data and protecting audit events
being stored.
6.1.8 Available database service (O.AVAIL)
TOE shall provide data recovery mechanism for affairs, database instance and storage
medium failures; provide the capability of self-maintenance of database storage
structure in DBMS updates; guarantee the restorability of TOE management data assets.
6.1.9 Configuration identification (O.CONFIG)
TOE shall identify product component configuration and evaluation configuration items
of its documents, so as to provide methods of correcting and tracing them when DBMS
is re-distributed and correction errors are corrected.
6.2 Environment Security Objectives
6.2.4 Operating environment management (OE.CONFIG)
6.2.5 Directory access control protection (OE.DIR_CONTROL)
DBMS operating environment that supports directory service (for example, LDAP
server) shall provide mechanisms like user identification, identity authentication and
access control, so as to prevent illegal user from accessing TSF data stored under the
directory service.
6.2.6 IT domain separation (OE.DOMAIN_SEPARATION)
TOE operating environment under distributed deployment shall provide TOE operation
nodes with one separable security execution domain. Communication among different
DBMS nodes shall be conducted through a secure mode.
6.2.7 Administrator Integrity (OE.NO_HARM)
Organization that adopts TOE shall guarantee that authorized administrator is
trustworthy, well-trained, and can comply with organization security policy and relevant
database administrator guidance.
6.2.8 Exclusive for database server (OE.NO_GENERAL_PURPOSE)
Apart from providing necessary service components for TOE operation, management
and support, database server shall not have computation or storage functional
components (for example, compiler, editor or application program) that are irrelevant
with database instance operation.
7 Security Requirements
7.1 Extension Component Definition
7.2 Requirements of Security Function
7.2.1 Overview
Table 7 lists TOE security functional components of evaluation assurance level (EAL)
of DBMS. EAL2, EAL3 and EAL4.In the description of security functional component
elements, in square brackets [], bold font signifies already completed operations; bold
italics signifies assignment and options that still need to be determined by ST author
in the security objectives.
7.2.2.4 Restriction of audit review (FAU_SAR.2)
FAU_SAR.2.1 authorizes specific permission of reading and accessing audit data to
authorized administrator. Apart from this, TSF shall prohibit all the authorized users
from reading or accessing audit record.
7.2.2.5 Optional audit review (FAU_SAR.3)
FAU_SAR.3.1 TSF shall provide the capability of [searching and sequencing]
reviewed audit data in accordance with [searching and classification conditions of
the value in audit data field].
7.2.3 Cryptographic support (Type-FCS)
7.2.5 Identification and authentication (Type-FIA)
7.2.5.1 Authentication failure processing (FIA_AFL.1)
FIA_AFL.1.1 TSF shall detect [assignment. log in DBMS user] command policy
[option. [number of authentication attempts, command expiration, number of
command reuses, [assignment. range of acceptable value]] that does not satisfy
authorized administrator’s definition; process unsuccessful authentication attempts
related with [option. authorized user authentication, authorized administrator
authentication, [assignment. list of other authentication events]].
7.2.5.2 User attribute definition (FIA_ATD.1)
FIA_ATD.1.1 TSF shall maintain the following security attributes that belong to each
database user.
7.2.6 Security management (Type-FMT)
7.2.7 TSF protection (Type-FPT)
7.2.8 Resource utilization (Type-FRU)
7.2.9 TOE access (Type-FTA)
7.3 Requirements of Security Assurance
8 Fundamental Principle
8.1 Fundamental Principle of Security Objectives
8.1.1 Overview
Each threat, organization security policy and hypothesis shall at least have one or more
than one corresponding security objective, so as to guarantee that the solution to
security issue is complete. Undoubtedly, there is no security objective that has no
corresponding threat,
8.1.2 Security objectives corresponding with threats
Table 10 suggests that TOE security objectives can cope with all the possible threats.
8.1.4 Security objectives corresponding with hypotheses
Table 13 suggests hypotheses that TOE and its operation security objectives can cope with.
8.2.2 Security functional components
Table 14 demonstrates that each security functional component requirement of TOE
at least solves one security objective of TOE.
8.3 Component Dependency
When PP/ST author is selecting security functional components and security
assurance components in accordance with GB/T 18336, the mutual dependency
among the selected components shall be satisfied.
......
Source: Above contents are excerpted from the full-copy PDF -- translated/reviewed by: www.ChineseStandard.net / Wayne Zheng et al.
Tips & Frequently Asked QuestionsQuestion 1: How long will the true-PDF of English version of GB/T 20273-2019 be delivered?Answer: The full copy PDF of English version of GB/T 20273-2019 can be downloaded in 9 seconds, and it will also be emailed to you in 9 seconds (double mechanisms to ensure the delivery reliably), with PDF-invoice. Question 2: Can I share the purchased PDF of GB/T 20273-2019_English with my colleagues?Answer: Yes. The purchased PDF of GB/T 20273-2019_English will be deemed to be sold to your employer/organization who actually paid for it, including your colleagues and your employer's intranet. Question 3: Does the price include tax/VAT?Answer: Yes. Our tax invoice, downloaded/delivered in 9 seconds, includes all tax/VAT and complies with 100+ countries' tax regulations (tax exempted in 100+ countries) -- See Avoidance of Double Taxation Agreements (DTAs): List of DTAs signed between Singapore and 100+ countriesQuestion 4: Do you accept my currency other than USD?Answer: Yes. www.ChineseStandard.us -- GB/T 20273-2019 -- Click this link and select your country/currency to pay, the exact amount in your currency will be printed on the invoice. Full PDF will also be downloaded/emailed in 9 seconds. Question 5: Should I purchase the latest version GB/T 20273-2019?Answer: Yes. Unless special scenarios such as technical constraints or academic study, you should always prioritize to purchase the latest version GB/T 20273-2019 even if the enforcement date is in future. Complying with the latest version means that, by default, it also complies with all the earlier versions, technically. How to buy and download a true PDF of English version of GB/T 20273-2019?A step-by-step guide to download PDF of GB/T 20273-2019_EnglishStep 1: Visit website https://www.ChineseStandard.net (Pay in USD), or https://www.ChineseStandard.us (Pay in any currencies such as Euro, KRW, JPY, AUD).
Step 2: Search keyword "GB/T 20273-2019".
Step 3: Click "Add to Cart". If multiple PDFs are required, repeat steps 2 and 3 to add up to 12 PDFs to cart.
Step 4: Select payment option (Via payment agents Stripe or PayPal).
Step 5: Customize Tax Invoice -- Fill up your email etc.
Step 6: Click "Checkout".
Step 7: Make payment by credit card, PayPal, Google Pay etc. After the payment is completed and in 9 seconds, you will receive 2 emails attached with the purchased PDFs and PDF-invoice, respectively.
Step 8: Optional -- Go to download PDF.
Step 9: Optional -- Click Open/Download PDF to download PDFs and invoice.
See screenshots for above steps: Steps 1~3 Steps 4~6 Step 7 Step 8 Step 9
|