MH/T 0067-2018 in English
VALIDSecurity testing guide for Web application system of civil aviation
- Issued on:2018-12-14
- Implemented on:2019-04-01
- File Format:PDF
- Delivery:Via email within 1~3 business days
$214.00
| Standard No: | MH/T 0067-2018 |
| Document status: | VALID |
| Title in English: | Security testing guide for Web application system of civil aviation |
| Title in Chinese: | 民航Web应用系统安全检测指南 |
| Language: | English |
| File Format: | Electronic (PDF) |
| Delivery: | Via email within 1~3 business days |
| Issued on: | 2018-12-14 |
| Implemented on: | 2019-04-01 |
| Professional Classification: | MH-Civil Aviation |
| Related Keywords: | web application system
web application systems civil aviation business civil aviation industry civil aviation introduction standard background |
| Related Topics: | safety inspection
Civil Aviation Safety civil aviation The role of the detection system Detection system function Testing Guide operating system mh/t 4049-2018 web embolization system Southeast Asia System Security |
Introduction
Standard Background and Technology Evolution
With the acceleration of digital transformation in the civil aviation industry, Web application systems have become key business carriers. This standard is based on the GB/T 22239 security level 3 requirements and is formulated in accordance with the characteristics of civil aviation business, reflecting the technical evolution path from basic protection to active defense.
Comparison of core detection frameworks
| Detection dimensions | Traditional methods | Requirements of this standard | Strengthening points |
|---|---|---|---|
| Identity authentication | Single-factor authentication | Dual-factor + anti-brute force cracking | Clause 5.4.2.1 requires combined identification technology |
| Access control | Coarse-grained role | Minimum authority + separation of authority | Appendix A.2.3 Clarify the authority restriction mechanism |
| Audit traceability | Basic log records | Full operation audit + 6 months retention | 5.4.2.3 stipulates 14 types of events that must be reviewed |
Key points for the implementation of key clauses
4.1.2 Practice of the controllability principle
When a certain airline company tested the ticket booking system:
- Personnel control: Sign a confidentiality agreement + two-person operation
- Tool filing: Use the certified Acunetix scanning tool
- Process recording: Use JIRA to track the entire process
Analysis of typical detection scenarios
Identity authentication test case: According to the requirements of 5.4.2.1.8, simulate the following test process:
- Construct a weak password dictionary to implement brute force testing
- Verify the effectiveness of the locking mechanism if verification fails
- Check the session timeout reset function
Industry implementation recommendations
Phase-based implementation path
| Phase | Work content | Output |
|---|---|---|
| Preparation period | System asset sorting + detection tool selection | Detection Scope Statement |
| Implementation period | Manual inspection + tool scanning + penetration testing | 《Testing Process Record Form》 |
| Improvement Period | Vulnerability Repair + Configuration Reinforcement | 《Safety Rectification Report》 |
Note: Key business systems should be fully tested twice per year, and closed-loop management should be formed by referring to Chapter 5.5.
Loading PDF document...
Error loading PDF. Please make sure the file is valid and try again.
We also recommend
-
MH/T 9008.3-2016 in English
Wireless local area network in-flight entertainment system. Part 3: Cabin wireless access point specification
2016-03-28 -
MH/T 5112-2016 in English
Guidelines for energy efficiency evaluation on civil airport terminals
2016-01-27 -
MH/T 4030-2011 in English
Specifications of notam origination for civil aviation
2011-03-25 -
MH/T 7013-2017 in English
Medical specification for recruitment of civil aviation airman trainees
2017-09-07 -
MH 5012-2010 in English
Code of Acceptance of Contruction Quality of Civil Airport Visual Aids
2009-11-30 -
MH 5006-2015 in English
Specifications for construction of aerodrome cement concrete pavement
2015-10-12 -
MH/T 0059.4-2015 in English
Specification for electronic data of air freight. Part 4: The transmission and application of loading and unloading electronic data
2015-12-31 -
MH/T 3010.20-2011 in English
Maintenance for civil aircraft-management specification-part 20:structure maintenance & repair records requirement for civil aircraft
2011-05-10 -
MH/T 0048.1-2014 in English
Specification of common use passenger processing systems in civil aviation airports Part1: System architecture
2014-12-03 -
MH/T 1049-2012 in English
Design specification for spraying equipment of aircraft
2012-10-10
