Shulou(Shulou.com)06/01 Report--

I. Overview

1. Construction background

With the rapid development of computer network technology, information technology has been integrated into all aspects of social life, profoundly changing people's production and way of life. At the same time, the problem of information security has become increasingly prominent, how to ensure data security has become the most serious challenge for enterprises.

In order to better serve taxpayers, xx Taxation Bureau has developed a tax online invoice system to meet the invoice needs of intelligent mobile devices. The online invoicing system of tax affairs provides great convenience for the online invoicing of tax payers, but how to ensure the data security of the online billing system has become an urgent topic to be solved.

2. System overview

Xx tax Bureau online billing system is deployed in the Internet area, which provides a variety of services such as desktop billing and mobile phone billing. The schematic structure of the system is shown below:

Xx tax Bureau online invoice system has provided desktop billing, mobile phone billing, information recording and other services for tax-paying enterprises in the jurisdiction since it was officially put into operation, which greatly improves the invoice efficiency, facilitates the enterprises in the jurisdiction, and has been well received by the tax-paying enterprises.

II. Demand analysis

1. Our government attaches great importance to information security. Since the establishment of the Office of the Central Network Security and Informatization leading Group in 2014, dozens of regulations and standards have been presented, such as "decision on strengthening Network Information Protection", "measures for the Management of Information Security level Protection 2.0", "provisions on the Protection of personal Information of Telecommunications and Internet users", "Network Security Law" and so on. And carried out security evaluation and inspection focusing on data security management, and put forward high standards for the security management and operation of information systems.

2. The Network Security Law makes it clear that operating units shall, in accordance with the requirements of the network security level protection system, perform security protection obligations to protect against interference, destruction or unauthorized access, prevent network data from leaking or being stolen or tampered with, and clearly put forward the need to take measures such as data classification, important data backup and encryption. It is clear that the personal information collected shall not be disclosed, tampered with or destroyed, except where specific individuals cannot be identified and cannot be recovered after processing; the legal obligations and responsibilities of subjects such as network operators have been comprehensively stipulated, and network security monitoring, early warning, notification and emergency response mechanisms will be established at the national level. Isobao 2.0 also makes clear requirements for the above requirements.

3. The online invoice system of xx Taxation Bureau runs in the Internet area, and the taxpayer information database includes all the tax payer information in this area, including sensitive information such as address, contact number and so on. Today, with the increasingly severe network security situation, it is imperative to strengthen the core data security of the system to meet the requirements of national policy and security situation.

1. Security risk analysis

Judging from the application framework of the online billing system of the xx Inland Revenue Bureau, its security risk points include:

1) the security risk of plaintext storage of taxpayer information data

2) the security risk of finding and patching database vulnerabilities in time

3) Application vulnerabilities lead to security risks of backdoor and privilege abuse

4) Compliance risk of lack of database operation and access security audit

2. Potential risks brought by data plaintext storage

1) the online invoice system of xx Inland Revenue Bureau is deployed in the Internet DMZ area, and the taxpayer information in the database is stored in clear text. Although the current system provides application security protection through network layer security devices, once lawbreakers attack into the system, they can copy away the taxpayer information database files and obtain taxpayer information in batches.

2) in a complete information system security management mode, external defense is only one aspect, and internal information leakage is also a problem that can not be ignored. Plaintext storage of sensitive information also brings risks to internal security management, which makes security operation and maintenance management problems such as authority abuse and curiosity may become potential security risks.

3) the Network Security Law clearly requires operators to fulfill their security protection obligations and encrypt sensitive information. Only by transparently encrypting the important data of the database can the security of data storage be completely guaranteed without affecting the architecture of the application system.

4) therefore, it is necessary to encrypt the key information in the taxpayer information, and only after certain authentication can the designated taxpayer information be decrypted to prevent the batch disclosure of the information; to meet the requirements of "encrypted storage of important data and citizen information" of "equal protection level 3" and "network security law".

3. The risk that database loopholes can not be found in time

The main contents are as follows: 1) at present, the structure of all kinds of information systems is becoming more and more complex, which makes it more and more difficult to find all kinds of system vulnerabilities in the testing stage, but only in the user application stage. These vulnerabilities include Windows vulnerabilities and Office vulnerabilities that we are familiar with. Similarly, database system vendors continue to release security vulnerabilities and patches in the process of system application. Only by mending the database system in time can the database application units effectively put an end to the possibility of illegal elements invading and ultra vires access.

4. Risk of application vulnerabilities and rights abuse

1) there may be some insecure vulnerabilities in the development process of information systems, such as SQL injection, and the risk of injecting Hibernate data access architecture due to the risks brought by open source architecture applications; such vulnerabilities are usually difficult to be fully found and repaired, which makes these vulnerabilities may be exploited by lawbreakers to carry out destructive operations on the database or drag libraries.

2) similarly, lax control of user permissions for database access may lead to the abuse of permissions by operators and developers, which is very risky and will lead to batch leakage of data or destructive operations. This kind of event has happened in many systems. Therefore, it is necessary to control the access of the application system to the database to prevent ultra vires operation, so as to prevent the loopholes of the system and the destruction of data and batch theft by the back door.

3) therefore, it is necessary to control the access of the application system to the database to prevent ultra vires operation, so as to prevent the loopholes of the system and the destruction of data and batch theft by the back door.

5. Lack of compliance risk of access audit

The main results are as follows: 1) both the network security law and the hierarchical protection system of information system put forward clear requirements for data access behavior. The network security law requires that records of data access must be kept for more than 6 months; the hierarchical protection system of information systems requires data audit for both secondary and tertiary information systems.

2) therefore, it is necessary to build a database audit system to meet the needs of security compliance; at the same time, when a security incident occurs, it can be traced back to the source.

III. Solutions

1. Overall structure

For the online invoice system of xx Inland Revenue Bureau, our data security solution is as follows:

The solution consists of deploying database encryption, deploying database firewall and deploying database audit. The corresponding relationship with the requirements is shown in the following table:

strategy

Main role

Response point of demand

Deploy database encryption

Selective encryption of sensitive fields

2.2, 2.3, 2.4

Deploy database firewall

Fine-grained control of all data access behavior

2.3, 2.4

Deploy database audit

Audit all data access activities and provide traceability

2.3, 2.5

2. Deploy the database encryption system

1) encrypt the key information such as phone number and address in taxpayer information to prevent sensitive data from being leaked in batches when dragging incidents occur.

2) provide an access interface, and only when the caller provides a certain line of information, can the taxpayer information with a limited number of entries be decrypted to prevent batch disclosure of information.

3. Deploy the database firewall

1) make use of the virtual patch function of the database firewall to prevent database vulnerabilities from being scanned and exploited without really installing patches to the database. At the same time, it is beneficial to pass the penetration check of database vulnerabilities in the equal guarantee evaluation.

2) using the user portrait function of the database firewall and the custom access control policy, the legal operation behavior of the data is accurately defined, the access behavior of the application system to the database is controlled, and the ultra vires operation is prevented, so as to prevent the system loopholes and backdoor destruction and batch theft of data.

4. Deploy the database audit system

1) obtain and record the access to data by bypass or from the database firewall.

2) intelligently analyze and portray the data access behavior, automatically discover the risk of data access, and give early warning and intervention before a major data security event is formed.

IV. Value of the scheme

1. Starting from the real requirements and grade protection of data security and the compliance requirements of network security law, this scheme analyzes the current situation of the system, the risks and requirements of data security faced by the system, and gives a data security solution with database firewall, database encryption and database audit as the core components. This scheme can not only effectively prevent the batch leakage of data, but also help the system pass the grade protection evaluation and reduce the relevant responsibilities in the Network Security Law.

2. Today, with the increasingly severe network security, China an Visa, with its advantages in technology research and development for many years, through systematic security solutions, provides a safe and reliable guarantee for user units to comply with the requirements of the Network Security Law and grade protection laws and regulations. protect core data security and jointly safeguard network security!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.