Interpretation of the "Critical Information Infrastructure Security Protection Requirements" from a Security Validation Perspective — EISS 2022 Enterprise Information Security Summit Shanghai

In recent years, the "Cybersecurity Law" and "Data Security Law" have been promulgated successively, raising the requirements for practical, systematic, and normalized offensive and defensive drills. In August last year, the State Council officially released the "Regulations on the Security Protection of Critical Information Infrastructure", clarifying the importance of cybersecurity construction in key areas.

Recently, the "Information Security Technology - Security Protection Requirements for Critical Information Infrastructure" was released, putting forward 111 security requirements from 6 aspects: analysis and identification, security protection, detection and evaluation, monitoring and early warning, active defense, and incident handling. It explicitly proposes measures such as continuous offensive and defensive drills, and adopting simulated cyber attacks to detect actual protection and response capabilities.

Security validation technology has evolved from Breach and Attack Simulation (BAS) technology to examine and improve the security defense system from an attacker's perspective. According to Gartner's forecast, it will be widely adopted by markets in various fields globally in the next 2-5 years. In response to several key points raised in the "Security Protection Requirements for Critical Information Infrastructure", security validation can meet all the requirements.

Security validation can simulate various real APT attacks, covering all stages of APT attacks, and can be simulated in production environments to verify the effectiveness of the defense system while ensuring zero impact on business.

Compared with traditional penetration testing and other methods, security validation is an innovative approach. It can be assessed voluntarily or by commission, enabling 24/7/365 continuous validation. Security validation can target systems, but is more focused on the protection and response capabilities of the entire defense system, reducing the impact of human factors.

Existing defense measures, posture, and SOC can provide post-incident analysis, while security validation can help enterprises simulate APT attacks beforehand, verifying and exercising the analysis of attack activities by existing defense measures, platforms, and personnel to achieve "knowing both the enemy and oneself". It can also serve as a supplement to manual offensive and defensive drills, realizing the practical, systematic, and normalized nature of cyber attacks.

SecVerify is the pioneer in proposing the concept of security validation in China. It possesses an attack library covering different attack stages of the complete kill chain, and the attack library also covers all technologies and tactics of ATT&CK, providing strategic and technical support for enterprise security construction and compliance with industry regulations, and continuously validating the effectiveness of the defense system.

Security validation technology can continuously validate the effectiveness of security construction in various industries currently heavily targeted by cybercriminals, such as healthcare, critical infrastructure, education, manufacturing, and energy. SecVerify will track internet hacker groups and vulnerabilities 24/7, providing customers with classic and popular APT attack techniques collected from the internet, allowing customers to use these real attack scenarios to validate the effectiveness of their defense systems.