Three-member management of system design

The duties of "three members"

System administrator: mainly responsible for the daily operation of the system maintenance work. Including network equipment, security and confidentiality products, servers and user terminals, operating system database, confidential business system installation, configuration, upgrade, maintenance, operation and management, network and system users to increase or remove, network and system data backup, run log review and operation monitoring, emergency conditions for the safe recovery.

Security Manager: Responsible for the daily security and secrecy management of the system. Including the network and system user rights GRANT and revoke, user operation behavior of the security design, security equipment management, system security incident audit, analysis and treatment, emergency conditions for the safe recovery.

Security Auditor: Mainly responsible for the operation of system administrators and security agents to carry out audit tracking, analysis and supervision and inspection, timely detection of irregularities, and regularly to the system security and confidentiality management Agency reporting.

Second, "three member" configuration requirements

1. System administrators, security administrators and security auditors cannot log on to the system as other users, cannot view and modify information in any business database;
2, the three members of the secret information system should be held by the internal personnel of the unit, the requirements of political reliability, familiar with the confidential information system management procedures, with a strong sense of responsibility and risk prevention and control awareness, and signed a confidentiality commitment.
3, the System management personnel and security management personnel can be from the information sector professional and technical personnel, for the business of a strong information system can be related to the business sector; The security auditor shall be held by a confidential department or other person competent to work as a security auditor in accordance with the requirements of the work.
4. System administrators and security auditors of the same device or system cannot be part of the same person, and security administrators and security auditors shall not be part of the same person concurrently.

Three, "three members" rights management process

When the user needs to use the confidential information system, should first in the Department of the written application, the head of the Department of approval, according to the actual situation of the user in the system of the authority to explain, and the entire situation reported to the Unit's secret work organization for the record.
After receiving the user's written application, the system administrator generates an identifier for the user in the system and creates a user account based on the approval results of the department's supervisor and the approval of the organization's confidential work organization.
After receiving the user's written application, the security and confidentiality manager configures the appropriate permissions and activates the account according to the audit results of the confidential work organization. At this point, the account can be used. When the user's work changes or permissions change, by the user's department leader in writing to inform the security manager, and reported to the unit's confidential work organization for the record. After receiving the notification, the security administrator logs off the user account or makes permission adjustments based on the result of the change.
The security auditor should periodically review the audit logs related to system administrators, security and confidentiality administrators, check the relevant formalities documents in case of the increase, deletion and change of user's privileges, and determine whether the operation of system administrator, security and secrecy administrator has been authorized and approved.
In the actual work, through similar to the above management process, so that 3 types of security management personnel to perform their respective roles, full play the role, coupled with a sound security and confidentiality examination and approval mechanism, will be able to deeply implement the security and secrecy management measures to fully achieve the system's security and confidentiality objectives.

Four, the secret information system to provide "three members" authority classification and other security protection measures

(i) "three members" and other rights set
Whether system administrators, security administrators, and security auditors can play an effective role, in addition to staffing and management, depends on whether the system uses business applications and security-related products to provide the appropriate administrator account, as well as permission demarcation and audit logging capabilities. Therefore, in the design and development of business application systems and security products, should take full account of this aspect of the needs, to provide users with appropriate functions.
Administrator Role Division
Ordinal role Responsibilities
1
System administrator
1. Responsible for system parameters, such as process, form configuration, maintenance and management. 2. Responsible for user registration, deletion, to ensure that the user identifier in the system life cycle of uniqueness;
3. Responsible for the change of organizational structure, responsible for the user rights related to the various roles of the settings.

2 Security and Confidentiality Manager
1. Responsible for personnel related to the level and position of information adjustment and user rights distribution; 2. Responsible for keeping all ID identifier files for all users except system administrators. The security administrator cannot log in to the system as a different user; 3. You cannot view and modify the information in any business database; 4. Responsible for user audit log and security auditor log review, but can not delete the contents of the journal.

3 Security Auditor
1. Responsible for supervising the operation log of system administrator, Security Administrator and Security Audit administrator, but not adding or deleting the contents; 2. Responsible for regular backup, maintenance and export of logs.
In the application design process should avoid the superuser, that is, the user has full access to resources.
For ordinary users, the permissions should be divided according to the principle of minimum authorization, and set their permissions to the minimum authorization required to complete the work.

(ii) Security audit function
The audit function mainly records the process of the system user's business operation, and provides the basis for the security administrators and the security auditors to judge the legality of user operation.
1. Scope of audit. Includes: Startup and shutdown of audit functions, user additions, modifications and deletions, and changes in permissions, various operations implemented by system administrators, security administrators, security auditors, and users, including access, backup, maintenance, and export of audit logs.
2. Audit record contents. Should include the time, place, type, subject, object and result (start, end, failure, success, etc.) of the event.
3. Audit matters management. Audit event management refers to the definition and management of core business operations, the events that need to be audited, and the configuration and definition of all matters or actions that may require auditing.
4. Audit policy configuration. Audit policy configuration refers to the relationship between audit matters and auditors, set up relationships, that is, to set which key personnel of key operational matters need to be audited, and according to national standards, the increase and deletion of users, change of permissions, system administrators, audit administrators, security administrators and users to perform operations must be audited, Therefore, audit content audit is divided into two types of mandatory audit and configurable audit.
5. Storage of audit information. The system should design sufficient audit record storage space, and when the storage space will be full to timely alarm, the stored audit records must be protected, can detect or prevent the audit record modification and forgery, records should be kept for at least three months.

Three-member management of system design