First, PA14 Data Import and Export Security

Data security has risen to the level of national security strategy, and the governance of the data security lifecycle has become an essential practice in the big data era!

First, PA14 Data Import and Export Security

1. Fully defining the level of capability description

• Organizational Construction

1) The organization establishes a unified data import and export security management position and personnel, responsible for formulating rules and providing technical capabilities, and promoting the implementation of business scenarios within the organization.

• Institutional Processes

1) Establish data import and export security strategies that meet the requirements of data classification and hierarchy, such as authorization strategies, process control strategies, and inconsistency handling strategies.

2) Establish a data export security assessment and authorization approval process to assess the security risks of data export and authorize and approve the export of large amounts or sensitive data.

3) If data is exported using storage media, it is necessary to establish identification specifications for the export medium, clearly defining the naming rules, identification attributes, and other important information of the medium, and regularly verify the integrity and availability of the exported data.

4) Establish import and export audit strategies and log management specifications, and save records of error data processing during the import and export process.

• Technical Tools

1) Record and regularly audit the internal data import and export behavior of the organization to ensure that it does not exceed the scope of data authorized use.

2) Implement effective access control over the data import and export terminals, users, or service components to ensure the authenticity and legality of their identity.

3) Clear the cached data of the data import and export channel after the import and export is completed to ensure that the data involved in the import and export process is not maliciously restored.

• Personnel Capabilities

1) Personnel responsible for data import and export security can fully understand the organization's data import and export strategy and execute corresponding risk assessments according to the business scenarios of data import and export, thereby proposing practical solutions.

2. Interpretation of Standards

Data import and export are widely present in the process of data exchange. Through data import and export, data is processed in batches, accelerating the realization of the value of data application. Without security measures, unauthorized personnel may use illegal technical means to export unauthorized data, import malicious data, etc., leading to major accidents such as data tampering and data leakage. Since the amount of data involved in general data import and export is usually very large, the relevant security risks and hazards will also be magnified many times. In this process area, effective systems and tools need to be adopted to control the security risks of data import and export. Managing the security of data during the import and export process can effectively prevent harm to the availability and integrity of the data itself during the import and export process, as well as reduce the potential risk of data leakage.

3. Organization and System Processes

Organizations should establish data import/export security specifications, as well as corresponding permission approval and authorization processes, and at the same time, they need to establish safety technical standards for exported data storage media to ensure the legal and compliant use of exported media.

Establish security system specifications for data import/export, fully and reasonably analyzing the security requirements of import/export scenarios in various businesses, and can define data import/export security strategies based on different scenarios and data classification and grading requirements, such as access control strategies, inconsistent handling strategies, process control strategies, audit strategies, and log management strategies.

Establish a standardized security verification and authorization process for data import/export, including but not limited to the business parties involved in data import/export, the management parties within the organization, the corresponding security management team, and relevant parties required to participate in specific risk assessment according to the standardized requirements for data import/export in the organization, such as legal teams, public relations teams, financial data external management teams, and other important teams related to the protection of data value.

Establish a specification for identifying export data media, clearly defining important information such as naming rules and identification attributes of the media, and regularly verifying the integrity and availability of exported data.

Key content of the case 'Import/Export Security Management Specification of XXX Company':

• Overall description (purpose)
• Import/export scenarios
• Safety requirements (including tools, media, etc.) job description
• Import/export tools
• Import/export process

4. Technical Tools

Establish an independent data import/export security control platform, or support data import/export security control functions in a unified user authentication platform, permission management platform, process approval platform, and monitoring and audit platform. Specifically, under the core functions:

• Data import/export permission management: Permission management sets the access permissions for the import/export of data catalogs or data assets, including but not limited to access scope, personnel group, access time, and frequency.
• Data import/export approver management: Supports setting approvers and reviewers for data access permissions, and supports setting multi-level approvers.
• Data import/export workflow management: Establish a data import/export workflow mechanism for the review and authorization of data import/export.
• Data operators apply for data import/export permissions through workflows, and after approval and authorization, only the data import/export that complies with the data import/export permission management can be allowed to be executed.
• Data import and export identity authentication: Perform multiple identity verifications for the operators of data import and export operations, including two-factor authentication, etc., to ensure the legality of the operators' identities.
• Data import and export integrity verification: To prevent data from being tampered with during the import/export process, data import and export adds integrity protection, and integrity verification is required after the import/export is completed to ensure the legality of the data.
• Data import and export logging and risk control: Record all operations and behaviors of data import and export, and identify risks for high-risk behaviors. In the event of a security incident, it can quickly perform a retrospective analysis through security logs.
• Clear cache data of import/export channels: Clear the cache data of the data import/export channels after the import/export is completed to ensure that the data involved in the import/export process is not maliciously recovered.

Data import and export process

The process of data import and export generally includes defining the data for import and export, providing applications for data import and export, assessing the scope and content of data import and export, approval authorization, data import and export, defining the security requirements for the storage medium of exported data, auditing and tracing, and other steps.

Define the data for import and export clearly:

• Identify and record specific data to be imported or exported, including files, database records, datasets, etc. Ensure that the sensitivity and value of the data are understood. It is best to label the data, including the scope, content, and format of the data, for subsequent tracking and supervision of data access and import/export operations. The method of data labeling should ensure that the data labeling information can flow with the data import/export operations and is not easily deleted or tampered with, thus enabling effective tracking of data import/export records, and should support sensitive labeling of both static and dynamic data streams.

Provide applications for data import and export:

• Establish a standardized application process for data import and export, allowing relevant personnel to submit import and export requests. Submit the 'Data Import and Export Application Form' to the data import and export security management department, which should include applicant information, department, position, reason for application, and application content, etc.

Assess the scope and content of data import and export:

• Review import and export applications to determine whether the requests are reasonable and in line with the organization's policies and compliance requirements.

• Assess the sensitivity of the data and determine whether special security measures are required.

• Ensure that the purpose of data import and export is clear and related to the organization's business needs.

Approval authorization:

• Establish an approval process to ensure that each import and export request is appropriately reviewed. Adhere to the principle of minimum authorization,

• Consider security risks and compliance requirements during the approval process.

Data import and export:

• Once approved, carry out data import or export operations. This may include migrating data from one system to another, copying data to portable media, or providing data to partners.

• Ensure the security of data transmission by using encryption or other security measures. Clarify the specifications for data import and export:

• The data import and export security management department needs to set up a special full-time personnel responsible for data import and export work and be responsible for the security of data import and export.

• Take necessary authentication measures for the dedicated personnel in charge of data import and export to prevent impersonation. Identity authentication is the foundation of data security protection.

• Take necessary security technical measures for the imported and exported data, such as trojan detection, encrypted transmission, encrypted storage, integrity verification, etc., to ensure the security of the imported and exported data.

• Perform dual checks of machine and manual verification on the imported and exported data to ensure the integrity and availability of the data.

Clearly specify the security requirements for the exported data storage media:

• If data is exported to storage media (such as USB drives, hard disks, etc.), clarify the security requirements, such as encrypted storage media, access control passwords, etc.

• Ensure that the storage medium can trace the source and destination of the data.

• Clearly identify the medium identification, storage environment, and anti-leakage measures.

Audit and Traceability:

• Establish an audit mechanism for data import and export to ensure the detailed recording of data movement, including time, location, personnel, and purpose.

• Use the Security Information and Event Management (SIEM) system or log audit tools to track data flow.

• Data watermarking溯源 technology can be used to identify data.

The technical tools for data import and export security should be designed from two aspects: on the one hand, data import security, which is to prevent the import of malicious data, causing data to be tampered with or destroyed; on the other hand, data export security, which is to prevent the export of unauthorized data, causing sensitive information leaks. A complete data import and export security tool should include both aspects. Secondly, due to the fact that the data volume of import and export tasks is generally large, the technical tools for data import and export security also need to have the function of verifying the availability and integrity of the import and export data.

The essential procedures for ensuring the security of data import and export include:

• Identity Authentication: Only users who pass identity authentication can use the data import and export management platform/tool to perform subsequent data import and export tasks, and identity authentication should be multi-factor authentication (mandatory multi-factor and dynamic multi-factor).

• Access Control: Different identities accessing the data import and export management platform/tool will obtain different data import and export permissions, and the allocation of permissions should follow the principle of 'minimum necessary'.

• Task Approval: In the access control process, control the data import and export tasks initiated by different identities. After initiating the task, only after passing the first-level or above manual approval can the data import and export tasks be formally executed.

• Data Validation: When performing data import operations, before the final import, the format, security, and integrity of the data need to be verified. Only data that passes the verification is allowed to execute the final import action; when performing data export operations, the integrity of the exported data needs to be verified first before the export job can be completed.

• Log Audit: All operations of the above four processes require log recording, and log audit should cover the entire lifecycle of data import and export.

Data preprocessing technology

For data import/export security, data preprocessing is a critical step. Preprocessing operations include all the pre-processing and verification work performed on the data before the final data import/export operation.

Since data import jobs involve importing data from external systems into internal systems, security checks for data import are particularly important. Data preprocessing operations for data import jobs generally involve checking the data format first, and if the data format is incorrect or incompatible with the import target, the data import job will not pass in the preprocessing stage; if there are no problems with the format check, malicious code detection will be performed on the data to prevent attackers from embedding malicious code in the data; if there are no problems with both format check and security check, the final integrity check must still be performed to prevent attackers from tampering with the data through man-in-the-middle attacks or other means. After all the format, security, and integrity checks have passed, the final data import operation will be performed.

Compared to data import jobs, the preprocessing for data export jobs is much simpler. Because after authentication and access control, the main thing to ensure during data export is that the exported data is available and complete, so the preprocessing operations for data export jobs usually only need to perform integrity checks.

Data import/export preprocessing technology is a key part of ensuring the quality and integrity of data during transmission. The following are some common preprocessing methods used in data import/export:

• Data cleaning: Before data import, clean the data to remove incomplete, duplicate, erroneous, or invalid data. This can include deduplication, filling missing values, and validating data formats, etc.
• Data transformation: If the data format does not match or is inconsistent, data transformation is required. This may include data type conversion, date format standardization, unit conversion, etc.
• Data encryption: For sensitive data, appropriate encryption techniques should be used to ensure the confidentiality of the data during transmission. This can include TLS/SSL encryption or other encryption protocols.
• Data compression: During the export and import process, data compression techniques can be used to reduce the size of data transmission, improving efficiency. Compression techniques usually reduce the bandwidth requirements for data transmission.

• Data format specification: Ensure that the data imported and exported follows specific data formats and structures to ensure interoperability. This includes using standard data markup languages (such as XML, JSON) or CSV format.

• Data validation and verification: Before importing and exporting, perform data validation and verification to ensure the integrity and accuracy of the data. This includes checking whether the data conforms to the expected data patterns and value ranges.

• Data partitioning and batch processing: For large amounts of data, the data can be partitioned into smaller blocks and processed in batches to reduce the load and risk of data import and export.

Second, PA15 data sharing security

1. Fully defining the level of capability description

• Organizational Construction

1) The organization establishes unified positions and personnel for the security management of data sharing and exchange, responsible for providing relevant principles and technical capabilities, and promoting the implementation of relevant requirements in related business scenarios.

• Institutional Processes

1) Develop principles and security specifications for data sharing, clarify the scope of data sharing content and control measures for data sharing, as well as the responsibilities and authorities of relevant users and departments involved in data sharing.

2) Clarify the data security responsibilities of data providers and users of shared data, ensuring that the users of shared data have sufficient or equivalent security protection capabilities as the data providers.

3) Develop data sharing audit strategies and specifications for the management of audit logs, clarify the requirements for audit records, and provide assistance for the handling of data sharing security incidents, emergency response, and post-investigation.

4) Conduct a security assessment before using external software development packages/components/source code, and ensure that the data obtained meets the data security requirements of the organization.

• Technical Tools

1) Take various measures to ensure the security and compliance of personal information in scenarios such as entrusted processing, sharing, and transfer, such as data desensitization, data encryption, secure channels, and shared exchange areas.

2) Monitor and audit the data sharing process of shared datasets to ensure that the shared data belongs to the shared business scenario requirements and does not exceed the authorized scope of data sharing use.

3) Establish specifications for shared data formats, such as providing machine-readable format specifications.

• Personnel Capabilities

1) The personnel responsible for this work should fully understand the data sharing strategy of the organization and execute corresponding risk assessments according to the business scenarios of data sharing, thereby proposing practical solutions.

2. Interpretation of Standards

During the data exchange process, business systems share data with external organizations or exchange data with third-party partners in a cooperative manner. After sharing, data releases greater value and supports the in-depth development of data business. The data sharing process faces significant security risks, as data itself is sensitive, and improper protection measures may lead to the leakage of sensitive and important data. Therefore, in this process domain, it is necessary to adopt security protection measures to ensure the integrity, confidentiality, and availability of data after sharing, and prevent data loss, tampering, forgery, and leakage.

3. Organization and System Processes

The organization should clarify the security specifications for data sharing, which proposes requirements for risk control in data sharing from aspects such as national security, protection of the core values of the organization, and personal information protection. It clarifies the relevant responsibilities and authorities of the institutions or departments involved in data sharing, defines the data protection responsibilities of the users related to shared data, and ensures that the relevant parties have sufficient protection capabilities for shared data, thereby ensuring the effectiveness of the data sharing security strategy.

The organization establishes detailed specification requirements based on the fundamental principles, considering data types, content, format, and common scenarios of data sharing, in order to meet the business needs of data sharing, improve efficiency, and guide the risk control in specific data sharing scenarios.

The organization has established a standardized data sharing review process, which includes but is not limited to the business party of data sharing, the management party of shared data within the organization, the data sharing security management team, and relevant parties involved in specific risk assessment according to the organization's data sharing norms, such as legal teams, external public relations teams, financial data external management teams, and other important teams related to the protection of data value, to ensure that the shared data does not exceed the authorized scope.

The organization has formulated data sharing audit strategies and audit log management specifications, clearly defining the requirements for audit records, to provide assistance for the handling of data sharing security incidents, emergency response, and post-investigation.

For scenarios involving third-party data exchange and processing platforms in the data exchange process, the organization has formulated clear security assessment requirements and procedures to ensure that the data exchange and processing platform has met the organization's data security requirements during the data exchange process.

4. Technical Tools

In the data exchange process, due to business needs, it is often necessary to carry out data sharing operations, and in the process of data sharing, there may be huge security risks. Once the protection measures for sharing are not appropriate, it may lead to the leakage of sensitive and important data. Therefore, in the process of data sharing, security protection measures should be taken to ensure the integrity, confidentiality, and availability of the shared data, and prevent data loss, tampering, forgery, and leakage. The process of data sharing includes the approval and desensitization before data sharing, encryption operations during the sharing process, and logging and auditing of the sharing process. Three ways of data sharing security:

• Online Service Browsing: Mainly aimed at application departments with weak needs, which can directly access the platform's portal website through a browser, and applications can view various data resource services provided by the platform online, such as browsing of various geographic information and thematic information, place name search, address positioning, spatial query, location marking, and data selection, etc.

• Using online service interfaces: Mainly aimed at application departments with development capabilities. In response to the online service interfaces provided by the platform, application departments can carry out secondary development and build their own business application systems. Service interfaces include data service interfaces and functional service interfaces. Through data service interfaces, application departments can obtain the latest data results of the platform, as well as obtain thematic shared information data published on other nodes. Through functional service interfaces, application departments can obtain various service functions, such as statistical functions.

• Offline Service: Mainly aimed at departments that do not have network access conditions or whose needs cannot be met by the online service mode of the provincial platform. The offline service mode is a non-online service mode, through hard disk copying, data providers provide data to the application departments, and applications