Land Insurance Information Security Construction Project

Business requirements

Terminal access control requirements:

1. Failure to authenticate the identity of terminal devices accessing the headquarters' intranet prevents timely detection and prevention of illegal users or terminal devices from accessing the network.

2. The terminal devices connected to the headquarters have not undergone host security monitoring checks, such as missing antivirus software and corresponding library version checks, as well as host security baseline checks.

Terminal security control requirements:

1. Lack of standardized management of terminals, such as weak passwords, simple sharing, guest accounts, etc., makes desktop computers a security vulnerability in the intranet.

2. Lack of unified management of terminal software, employees' unauthorized installation of software without security checks may result in backdoor cracking software, which may lead to information leakage.

Terminal data control requirements:

1. Lack of means to audit and control the outsourcing behavior of terminals, such as the lack of unified permission control and content audit for terminal printing behavior, USB copying behavior, and instant messaging, which poses a significant risk of data leakage.

2. Lack of means to scan and discover sensitive data on terminals, making it difficult to understand the distribution of sensitive data in enterprises.

Solution

1. Perform identity authentication on the access terminal, verify the legitimacy of the access terminal, and link the authentication account with the AD system.

2. Conduct device security checks on access terminals to verify their compliance, including antivirus software checks, terminal baseline checks, etc.

3. After the terminal is connected to the intranet, its permissions are minimized based on its access role to prevent unauthorized access.

4. Provide asset management, software distribution, remote assistance and other functions to improve the efficiency of operation and maintenance management; The software black and white list and terminal system self-test module ensure the security and stability of internal network terminals.

5. Conduct sensitivity testing and comprehensive content auditing on terminal printing, USB copying, and instant messaging software to effectively reduce the risk of leakage.

Program value

1. Regulatory compliance: Terminal security management must meet the security compliance requirements of the China Banking and Insurance Regulatory Commission and Level 3;

2. Efficient operation and maintenance: Achieving centralized management of terminal devices across the entire network can help administrators significantly reduce maintenance costs and improve operation and maintenance efficiency;

3. Security assurance: Strengthen the security of enterprise network computers, enhance security audits, effectively reduce various security risks in the office network, and improve the continuity of office network business;