Solution Overview

This proposal is primarily based on the "Basic Requirements for Information Security Technology - Network Security Protection Level" (GB/T 22239-2019) (hereinafter referred to as "Basic Requirements"), "Technical Requirements for Security Design of Information Security Technology - Network Security Protection Level" (GB/T 25070-2019), and the "Guidelines for Security Protection Leveling Work in the Education Industry Information System (Trial)" and other relevant standards and policies. According to the actual conditions and business characteristics of university networks, adhering to the principle of "moderate security, protection **", and following the concept of "one center, three levels of protection", the information network of universities is reasonably divided into security domains. Protection measures and security strategies are designed specifically for the characteristics of each security area, maximizing the defense capabilities of network security, while also meeting the construction requirements of "overall protection".

Design of Security Technical Measures

1. Universal Safety Design

The design content of the university's cybersecurity technology system mainly includes Security Management Center, Secure Communication Network, Secure Zone Boundary, and Secure Computing Environment:

Secure Communication Network Design

Critical network nodes, equipment, and links must be designed with redundancy to ensure high availability.

Deploy firewalls to provide reliable domain isolation for secure access.

Utilizes a system compliant with national encryption standards to ensure data confidentiality and integrity during remote communication processes.

Safety Zone Boundary Design

Implement network access control systems to manage unauthorized devices from私自 accessing the internal network.

Implement host monitoring and auditing systems to control illegal external connection behaviors of internal users.

Deploy firewalls and network DLP to implement access control based on application protocols and content.

Deploy anti-DDoS and IPS features (integrated into Qiantian Firewall), WAF, IDS, APT security monitoring, etc., to detect, analyze, alert, and prevent network attacks, especially new types of cyber attacks.

Deploy anti-virus gateway (integrated with Qiantian Firewall) and anti-malware system to detect and prevent malicious code at critical network nodes.

Deploy a network audit system to monitor and analyze users' network access behavior.

Secure Computing Environment Design

Deploy fortress hosts for managing user permissions.

Deploy a database auditing system to centrally audit important user actions and critical security incidents.

Deploy vulnerability management, baseline management, EDR, and other systems to ensure the security of endpoints and servers.

Utilize encryption technology to ensure the integrity and confidentiality of critical data.

Deploy disaster recovery and backup systems to ensure the availability of critical data.

We offer protection mechanisms such as web tamper prevention and website security monitoring for key websites and systems.

Safety Management Center Design

Implement centralized identity authentication, access authorization, and operation auditing through Fortress Hosts.

Deploy network management systems for centralized monitoring of the operation status of the network and information infrastructure.

Deploy a log audit system to collect, aggregate, and centrally analyze audit data dispersed across the network.

Deploy a threat intelligence and security operations platform to support security monitoring, analysis, early warning, response, handling, and traceability for security management and operations.

2. Cloud Computing Security Design

Deploy virtualized security devices or security resource pools to detect and protect north-south traffic for cloud tenants.

Deploy a virtualized distributed security protection system to detect and protect east-west traffic on cloud hosts.

Deploy EDR to achieve local threat detection and protection for cloud servers.

Deploy a cloud security management center to achieve unified strategy management, security monitoring, policy migration, and automated deployment.

3. Mobile Internet Security Design

Wireless Access Security Design

Achieve secure isolation by deploying firewalls at controlled boundaries and implementing wired networks.

Deploy wireless management platform, offering heatmaps of wireless signal coverage, and select wireless AP locations, quantities, and channels based on the heatmaps.

Identity authentication for mobile terminal devices connected to the wireless network is conducted via a wireless management platform, supporting password algorithms that meet national encryption standards.

Deploy a mobile terminal management system to locate and block unauthorized wireless access devices and unauthorized mobile terminal access behavior.

Mobile Terminal Security Design

Deploy EMM to remotely control and manage the entire lifecycle of registered mobile devices. In the event of a lost or stolen device, use network location to find the device, remotely lock the device, and remotely erase data on the device to prevent data leakage.

Mobile App Security Design

Implement EMM for pre-launch security scanning, reinforcement, and offering *features to control the installation and operation of the application software.