GB/T 28454-2012 in English

《GB/T 28454-2012信息技术 安全技术 入侵检测系统的选择、部署和操作》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会。

Scope

This standard gives guidance to help organizations prepare to deploy IDS. In particular, the selection, deployment, and operation of IDSs are detailed. Background information on the sources of these guidelines is also given. The purpose of this standard is to help organizations: a) Meet the following requirements of GB/T 22080-2008: Organizations should implement procedures and other control measures that can improve the ability to detect and respond to security incidents; Organizations should implement monitoring and review procedures and other control measures , to identify potential or existing security vulnerabilities and incidents. b) In terms of implementing control measures, meet the following security objectives of GB/T 22081-2008: Detect unauthorized information processing activities; should monitor the system and record information security events; operation logs and fault logs should be used to ensure the identification of information system problems ; The organization should comply with all relevant legal requirements for monitoring and logging activities; The monitoring system should be used to check the effectiveness of the controls adopted and to verify compliance with the access control policy model. Organizations should recognize that IDS deployments are not the only or perfect solution to meeting the above requirements. Furthermore, this International Standard is intended to serve as a criterion for conformity assessment, such as information security management system (ISMS) certification, IDS service or product certification.