Solution Architecture

• Secure communications network: In the secure communications network, the whole network must be divided into different network zones by actual business-access needs, and addresses assigned to zones by the principle of convenient management and control; to ensure high link availability, backbone links are designed as redundant dual links.

• Secure zone boundary: The secure zone boundary includes the external-network boundary and the computing-environment boundary;

• Secure computing environment: The secure computing environment mainly includes the OS following the principle of minimal installation, installing only needed components and applications, and keeping system patches updated in time via upgrade servers and similar; privilege separation of OS and database privileged users; restrict default-account access, rename system default accounts, and change their default passwords; audit scope should cover every OS user and database user on servers and important clients; audit content includes important user behavior, abnormal use of system resources, use of important system commands, and other important security-related events in the system;

• Security management center: Main construction of the security-management platform includes system management, audit management, and security management. Manage network-wide access-control, authentication, intrusion-prevention, and malware-protection policies. Unify management of servers, network products, security products, and other systems on the secure computing environment, secure zone boundary, and secure communications network. Centrally audit all network assets network-wide, including network audit, log audit, O&M audit, and database audit, with centralized management and presentation.