Security Standards and Deployment Scenarios
国际信息安全技术标准发展(英文版)
Activate BCP
Prepare & Test
Plan
Plan
Prepare & Test
Activate DCRP
Disaster Contingency & Recovery Planning
Disaster Events
IT Systems Failures
ICT Readiness for Business Continuity
• Why ICT Readiness focus on Business Continuity?
• ICT systems are prevalent in organizations • ICT systems are necessary to support incident, business continuity,
• What is ICT Readiness?
• Prepare organization ICT technology (infrastructure, operation, applications), process, and people against unforeseeable focusing events that could change the risk environment
Anti-Spyware, Anti-SPAM, Anti-Phishing, Cybersecurity-event coordination & information sharing
ISO 18028 revision; WD for new Part 1, 2 & 3; New Study Period on Home Network Security
C-TPAT最低要求和实施说明
C-TPAT最低要求和实施说明斜体加粗字为实施要点及实施范例最终文本（2006年8月29日）海关-商业伙伴反恐计划（C-TPAT）外国制造商安全标准本最低安全标准是为使外国制造商实施高效的安全实务以优化供应链绩效。
从而减少恐怖分子以及恐怖主义的实施行为，通过丢失、盗窃和走私货物渗入全球供应链的危险而设计的基本结构单元。
犯罪团伙通过内部阴谋破坏世界商贸活动的倾向和活动范围要求公司，尤其是外国制造商，提高它们的安全实务。
外国制造商至少必须每年一次，或者根据情况的需要，比如在高度警戒、发生安全违反或安全事故的期间，根据下面所述的C-TPAT安全标准对它们的国际供应链进行全面评估。
如果外国制造商将它们供应链的某睦部份外包或承包给比如另一个外国机构、仓库或其它部门。
则外国制造商必须与这些商业伙伴一起确保在整个供应链中的相关的安全措施都得以实施和遵守。
C-TPAT所定义的供应链是从原发点（制造商/供应商/卖主）一直到销售点的整个过程，并且适用于C-TPAT成员所使用的各种不同的商业模式。
C-TPAT 认识到国际供应链以及安全实务的复杂性，并且支持基本风险的存在而对安全措施的应用和实施注1。
因此，本计划允许基于成员的商业模式而灵活实施客户化的安全计划。
本文所列举的适当的安全措施必须基于风险的性质在外国制造商的整个供应链中得以实施和维持注2 。
注1：外国制造商应基于它们的商业模式对它们整个供应链中存在的风险应该有记录在案的、可核准的确定程序（运输量、原产国、航线、C-TPAT成员资格、通过公开信息渠道获悉的潜在威胁、存在的安全隐患、过去的安全事故等）。
注2：外国制造商应基于它们的商业模式对它们整个供应链中存在的风险应该有记录在案的、可核准的确定程序（运输量、原产国、航线、C-TPAT成员资格、通过公开信息渠道获悉的潜在威胁、存在的安全隐患、过去的安全事故等）。
商业伙伴要求外国制造商对于商业伙伴的选择，包括承运人、其他制造商、产品供应商和卖主（零件和原材料供应商等）必须有书面的、可核准的程序。
GSV 标准介绍
加入本计划的益处
¾ 通过减少反恐审核的次数节约时间及费用 ¾ 通过加入具有广泛认可度的GSV计划，减少在海关的通关时间，从而节约时间及成本。 ¾ 通过加入举世认可的计划来确认符合全球供应链要求，以增强公司美誉度。 ¾ 使进口商及供应商可以通过共同的行业平台和相互协作平衡各自投入 ¾ 此项全球安全计划已覆盖美国，加拿大及欧洲反恐标准（C-TPAT，PIP&AEO）的最佳实
要求 工厂应进行新员工入职培训。
实施细则
新员工入职培训的教材及记录应包括： 确认所有在工厂围墙范围内的人员在任何时候都要佩戴工厂的身 份识别证明 质疑并向保安或相关管理人员举报身份不明的人员 ° 识别内部阴谋
° 发现违法行为 ° 维护货物的完好无损 ° 维护电脑安全 ° 报告公共设施的安全隐患（断裂的锁具，破裂的窗户，计算机 病毒等） ° 识别和发现危险的建筑或设备。
员工应佩戴工厂身份识别证明，如厂证或电脑卡才能进入厂区。 新进员工应有临时通行证。
保安人员应在员工入厂时检查其身份识别证明 以确保只有佩戴工厂发放的身份识别证明的员 工才被允许进入工厂。 身份识别证明应具有唯一识别标示。
有专门的部门负责员工身份识别证明的发放和 管理。
工厂身份识别证明应不易涂改或复制。
适用于正式员工的人员招聘指南和规定应同时适用于合同共，临时 工和兼职员工。
良好范例 每六个月评估一次招聘指南以确保其有效性。
2.2人员筛查
必须建立筛选应聘员工,获取其背景资料的程序(例如,正式聘用前确认其工作经历 及家庭状况).同时除此以外，也必须执行针对敏感岗位的在职员工的定期背景调查。
警卫常用英语词汇
警卫常用英语词汇警卫局.....................SecurityGuardBureau警卫工作...................securityservice警卫人员...................securityagent警卫车队...................theguards'motorcade警卫部署...................securitydeployment警卫对象...................targetofsecurity随身警卫...................bodyguard安全系数...................safetyfactor危险评估...................dangerassessment情报信息...................intelligence/information 外宾.......................foreignguest领导人.....................leader政治局.....................politicalbureau国务院.....................theStateCouncil总统.......................President总理.......................premier常委.......................memberofthestanding committee议长.......................speaker部长.......................minister市长.......................mayor代表团.....................delegation随行人员...................entourage安全官.....................securityofficer公安局.....................PublicSecurityBureau局长(副局长)...............Chief(deputychief)处长.......................Director领导.......................superior同事.......................colleague警察.......................policeman交通警察...................trafficpolice武装警察...................armedpolice便衣警察...................plainclothespolice护照.......................passport大使馆.....................embassy领事馆.....................consulate消防.......................fireservice消防警官...................firefighter消防安全检查...............inspectionoffirecontrol work消防车.....................fireengine消防通道...................fireescape急救中心...................first-aidcenter应急医院...................emergencyhospital .....................ambulance救护车...................ambulancepersonnel救护人员药物.......................medicine直升机.....................helicopter通信munication设备/设施..................facility手枪.......................handgun微行冲锋枪.................minimachinegun爆炸.......................explosion查...................securityinspection安全检爆炸物品...................explosivearticle金属物品...................metalarticle托盘.......................tray口袋.......................pocket找出⋯的位置...............locate+d5m防爆安全检查...............anti-explosionsafety inspection防爆器材...................flame-proofequipment (xi)安全门封条.......................seal封闭区域...................restrictedarea人口.......................entrance安检通道...................metaldetectorway安检门.....................walk-throughmetal detector检查.......................examine证件.......................credentials专用通行证.................specialpermit请柬.......................invitation规章/规定..................rule/regulationX光行李检查仪..............luggageX-ray要人保卫...................dignitaryprotection 随身警卫...................bodyguard住地警卫...................residentialguard路线警卫...................routeguard现场警卫...................on-the-spotguard路线.......................route现场.......................site现场会.....................on-the-spotmeeting 开道车.....................leadingcar前卫车.....................convoy礼宾车.....................theprotocolcar后卫车.....................thefollow-upcar备用车.....................sparecar收尾车.....................thelastcar武装护卫车.................armedconvoycar救护车.....................ambulance班车.......................limousine行李车.....................luggagevan停车场.....................parkinglot地下停车库.................undergroundparkinglot 上车点.....................boardingarea下车点.....................alightingarea国有企业...................state-ownedenterprise 宾馆.......................hotel公园.......................park博物馆.....................museum大学.......................university幼儿园.....................kindergarten剧场.......................theatre故宫.......................theImperialPalace颐和园.....................theSummerPalace教堂.......................church交通法规...................trafficregulations机场.......................airport专机.......................specialplane班机.......................flight卫士长.....................chiefguard哨兵.......................sentry固定哨.....................fixedsentry临时哨.....................temporarysentry武装哨.....................armedsentry便衣哨.....................plainclothessentry要害部门...................importantdepartment 宾馆外围...................peripheryofhotel制高点.....................overlookingpoint备用路线...................sparecircuit备用通道...................sparepassageway紧急疏散通道...............emergencyevacuation passageway急救中心...................first-aidcenter急救药箱/药品..............first-aidkit/medicine 警卫值班室.................officefortheguardson duty对讲机.....................walkie-talkie警戒线.....................policeline紧急避险...................avoidimminentrisks国际恐怖主义...............internationalterrorism 恐怖活动...................actsofterrorism恐怖分子...................terrorist限制区域...................restrictedzone指定位置...................designatedplace宴会厅.....................banquethall门厅.......................lobby走廊.......................corridor衣帽间.....................cloakroom洗手间.....................restroom/washroom休息室.....................lounge服务台.....................receptiondesk电梯.......................lift/elevator楼梯.......................staircase自动扶梯...................lift新闻记者...................journalist摄影记者...................photographer新闻中心rmationcenter新闻发布会.................newsbriefing拍照.......................takephotograph采访.......................interview拥挤.......................rush往后退.....................stepback秘书处.....................secretariat观察团.....................observationgroup外事办公室.................foreignaffairsoffice 翻译主.....................interpreter访问.......................visit日程.......................itinerary/schedule 旅行.......................trip合作.......................cooperate讨论.......................discuss约会.......................appointment会谈.......................conference问题.......................issue提前.......................inadvance推迟.......................postpone调整.......................adjust邀请.......................invite服务.......................service准备.......................prepare安排.......................arrange具体方案...................concreteplan通知rm/notify暂定的.....................tentative预定的.....................reserved暂时的.....................temporary工作/职责..................business建议.......................recommendation协议.......................agreement要求.......................requirement联系.......................contact信赖/依靠..................counton认识.......................realize安置/安装..................install饮食习惯...................dietary确保.......................ensure/assure控制.......................control指挥.......................instruction周密部署...................tightmeasures确保安全...................ensurethesecurity 危险/冒险..................risk责任.......................responsibility威胁.......................threaten伤害/损害..................injure违背.......................violate失误.......................fault立即.......................immediately细节.......................detail打扰.......................bother许可/允许..................permission有效的.....................valid当然/一定..................certainly舒适的fortable特殊的/专门的..............special体谅的/体贴的..............thoughtful/considerate 必要的.....................necessary谈到/提到..................mention总的.......................general妥善地.....................properly可能的.....................possible完美的.....................perfect简单的.....................brief要员保护VIPPUveryimportant私营军事承包商PMCprivatemilitarycontractor私营安全承包商PSCprivatesecurity指挥官OCofficercommanding军需官QMquartermasterWORD格式通讯员messenger司机DRVdriver保镖bodyguard安全警卫，保安security驻地警卫RGresidentguard专业资料整理。
信息安全技术 操作系统安全评估准则
信息安全技术操作系统安全评估准则
信息安全技术:
信息安全技术是指为保护信息及其相关系统的安全而采用各种技术手段和方法的综合体系。
它包括网络安全、数据安全、应用安全、物理安全等多方面的内容。
信息安全技术的目的是保障信息的机密性、完整性和可用性。
操作系统安全评估准则:
操作系统安全评估准则是指一系列用于评估操作系统安全性的标准和规范。
它主要用于对计算机操作系统的安全性进行评估、测试和认证，以证明其满足特定的安全要求。
这些准则包括ISO 15408、CAPP、TCSEC等。
ISO 15408是一种国际标准，也称为“公共标准第1部分”（Common Criteria Part 1），它规定了一个一致的评估方法和评价标准，用于评估计算机安全产品的安全性。
CAPP（计算机辅助保护配置）是一种安全性评估方法，它是由美国国家安全局（NSA）开发的，用于评估和指导操作系统的安全性配置。
TCSEC（全球计算机安全评估准则）是一个用于评估计算机操作系统安全性的标
准，由美国国防部开发。
它将计算机操作系统分为四个级别，每个级别对应不同的安全需求和保护措施。
欧盟化妆品安全评估示例
欧盟化妆品安全评估示例【原创版】目录1.欧盟化妆品安全评估的背景和重要性2.欧盟消费者安全科学委员会（SCCS）的职责和作用3.《化妆品成分的检测及安全评估指南（第 12 版）》的主要更新内容4.非动物测试方法在化妆品安全评估中的应用5.欧盟化妆品 CPSR 安全报告和 CPNP 注册服务的相关要求6.对中国化妆品行业的影响和启示正文欧盟化妆品安全评估的背景和重要性随着人们对美的追求和化妆品使用的日益普及，化妆品安全问题越来越受到关注。
欧盟作为全球化妆品生产和消费的重要地区，一直重视化妆品的安全评估和监管。
欧盟化妆品法规 (EC) No 1223/2009要求所有化妆品进入欧盟市场都必须经过安全评估，以确保化妆品对消费者的安全性。
欧盟消费者安全科学委员会（SCCS）的职责和作用欧盟消费者安全科学委员会（SCCS）是欧盟负责化妆品安全评估的权威机构，其主要职责是评估化妆品成分的安全性，为欧盟化妆品法规的制定和修订提供科学依据。
SCCS 通过发布化妆品成分安全评估指南，为化妆品行业提供指导，确保化妆品在欧盟市场的安全性。
《化妆品成分的检测及安全评估指南（第 12 版）》的主要更新内容近日，SCCS 发布了《化妆品成分的检测及安全评估指南（第 12 版）》，对化妆品成分的检测和安全评估进行了更新和完善。
新版指南的重点更新内容包括：1.系统文献综述的重要性：加强对化妆品成分安全性的科学证据收集和评估，提高安全评估的准确性。
2.更新无动物替代方法：提倡采用非动物测试方法进行化妆品成分的安全评估，减少动物实验，提高伦理水平。
3.增加新的检测方法：引入更多先进的检测技术，提高化妆品成分检测的准确性和效率。
非动物测试方法在化妆品安全评估中的应用随着科技的发展，非动物测试方法在化妆品安全评估中的应用逐渐得到推广。
新版指南提倡采用细胞培养、计算机模拟等技术进行化妆品成分的安全评估，减少动物实验，提高伦理水平。
同时，非动物测试方法具有更高的效率和准确性，有助于提高化妆品安全评估的质量。
海关认证企业贸易安全标准 英文版
海关认证企业贸易安全标准英文版The Customs-Trade Partnership Against Terrorism (C-TPAT) is a voluntary supply chain security program led by U.S. Customs and Border Protection (CBP). It was established to strengthen the overall security of the international supply chain and to enhance the safety of imported goods into the United States.The C-TPAT program provides a framework and set of minimum security criteria for businesses engaged in international trade to follow. These criteria include physical security measures, personnel security procedures, and security-related business practices. By meeting these criteria and undergoing a thorough assessment by CBP, businesses can become certified as a C-TPAT member.Benefits of C-TPAT certification include expedited processing for shipments, reduced examination rates, andpriority access to CBP resources in the event of a disruption or disaster. Additionally, participating businesses are recognized as partners in the fight against terrorism and are seen as low-risk entities within the international trade community.In summary, the C-TPAT program is a customs certification program that aims to enhance trade security by establishing specific security standards and procedures for businesses engaged in international trade.。
安全管理国际信息安全技术标准发展英文版
Protect
Detect
React/ Response
Business Continuity Planning
Activate BCP
Prepare & Test
Plan
Plan
Prepare & Test
Activate DCRP
Disaster Contingency & Recovery Planning
27001
ISMS Requirements
27002
Code of Practice
27000
Fundamental & Vocabulary
27006
Accreditation Requirements
ISMS Family
27003
ISMS Implementation
Guidance
27005
Security breaches and compromises
安全管理国际信息安全技术标准发展 英文版
SC27 WG4 Roadmap
ICT Readiness for Business Continuity (27031)
Cybersecurity (27032)
Network Security (27033)
Disaster Events
IT Systems Failures
安全管理国际信息安全技术标准发展 英文版
ICT Readiness for Business Continuity
• What is ICT Readiness?
• Prepare organization ICT technology (infrastructure, operation, applications), process, and people against unforeseeable focusing events that could change the risk environment
SecurityStandards
236 17. Security Standards
Step 1 Define the Information Security Policy
Step 2
Define the Scope of the ISMS
Step 3
Undertake Risk Assessment
Step 4
Manage the Risk
Step 5 Step 6
Select Control Objectives and Controls to be Implemented
Prepare Statement of Applicability
FIGURE 17.1. The BS7799 Process Model
• Information Assets
BS7799-2:2002 instructs you how to apply ISO17799 and how to build, operate, maintain and improve an ISMS. The 1999 edition only instructed you to apply ISO17799 and build an ISMS.
BS7799 makes some assumptions. It assumes that you have already defined all of your key information assets that exist within an organisation. When performing a risk assessment, it assumes that you have also conducted a threat/vulnerability and impact study on your organisation and its key information assets. The most important part of BS7799 is that it requires senior management buy-in to the whole security standard process. It also does not mandate any security solution, but it does require that some person in the organisation has thought about each of the Best Practice sections. BS7799 also requires that the security policy is placed under constant review and becomes a living document that will evolve over time.
美国TSCA法规要求及应对措施
美国TSCA法规要求及应对措施美国TSCA法规是美国《有毒物质控制法》（Toxic Substances Control Act）的简称，它是美国联邦法律，于1976年通过并于次年开始实施。
该法规的目标是保护人类健康和环境，确保化学品的安全使用。
1.化学品登记：根据TSCA法规，所有生产、进口或使用化学品的企业都需要申请化学品登记。
登记过程要求提供化学品的相关信息，如化学物质的名称、用途、危害性评估和安全措施等。
2. 预先商业化通知（Premanufacture Notice, PMN）：在开始生产、进口或使用一种新的化学物质之前，企业需要向美国环境保护署（EPA）提供预先商业化通知。
EPA会对该化学物质进行评估，以确保其不会对人类健康和环境产生不可接受的风险。
3.化学品评估：根据TSCA法规，EPA有权对已经登记的化学品进行再评估，包括危害性、曝露和风险评估等。
如果发现其中一种化学物质存在危害或风险，EPA有权采取相应的管理措施，如限制或禁止其使用。
4.管理措施：如果化学品被确定为有危害或风险，EPA可以采取适当的管理措施来减少对人类健康和环境的影响。
这些措施可能包括限制使用、标识和通报要求、销售限制和管理计划等。
为了应对TSCA法规，企业可以采取以下措施：1.收集和评估化学品信息：企业应收集和评估其使用的化学品的相关信息，并确保其在TSCA法规要求的范围内。
这包括确保使用的化学品已经登记或申请了预先商业化通知。
2.建立和改进化学品管理体系：企业应建立合适的化学品管理体系，确保符合TSCA法规的要求。
这包括建立危害性评估、曝露评估和风险管理的程序，并实施相应的措施来减少危害和风险。
3.合规培训和意识提高：企业应向员工提供合规培训，使其了解TSCA法规的要求和相关责任。
此外，企业还应提高员工对化学品安全和环境保护意识，以促进遵守TSCA法规和减少危害和风险。
4.积极响应和配合EPA的评估和管理：企业应积极响应和配合EPA的评估和管理要求。
网络安全管理制度的国际标准与认证
网络安全管理制度的国际标准与认证随着信息技术的迅猛发展和互联网的普及应用，网络安全问题日益凸显。
无论是政府、企事业单位，还是个人用户，都需要建立一套完善的网络安全管理制度，以保护网络资源和信息安全。
在国际上，各个国家和组织都提出了各自的网络安全管理标准，并开展了相应的认证工作。
本文将介绍几种主要的国际网络安全管理制度标准和认证。
一、ISO 27001信息安全管理体系ISO 27001是国际标准化组织（ISO）发布的信息安全管理体系标准，旨在帮助组织建立、实施、运行、监控、审查、维护和持续改进信息安全管理体系。
该标准涵盖了信息安全风险评估、安全策略和目标的制定、组织内部沟通和培训、资源管理、信息安全事件的处理等多个方面。
通过实施ISO 27001标准，组织可以确保其信息资产得到充分的保护，提高网络安全管理水平。
二、NIST框架NIST（美国国家标准与技术研究院）发布的网络安全框架旨在帮助组织理解和应对网络安全风险，以提高网络安全管理的效果和可持续性。
该框架包括五个核心功能领域，即识别、保护、检测、响应和恢复。
组织可以根据自身需求选择和应用这些功能，以建立一个符合实际情况的网络安全管理制度。
NIST框架被广泛应用于美国政府和私营部门，也逐渐受到其他国家和组织的重视。
三、CC认证CC（Common Criteria）是一个国际性的安全认证评估标准，旨在确保信息技术产品和系统的安全性和可靠性。
CC认证体系基于一系列评估标准和检测方法，对产品和系统的安全性进行全面的评估和验证。
CC认证广泛用于网络设备、操作系统、数据库和应用软件等方面，被认为是一种国际通用的信息安全认证方式。
通过CC认证，组织可以获得外部权威的安全认证，提升其在网络安全领域的信誉和竞争力。
四、其他国际认证标准除了上述主要的网络安全管理制度标准和认证外，还有许多其他国际认证标准也对网络安全管理起到了重要的作用。
例如，PCI DSS （Payment Card Industry Data Security Standard）是一种金融行业的安全标准，旨在保护持卡人信息和支付数据的安全；HIPAA（Health Insurance Portability and Accountability Act）是美国医疗保健行业的安全与隐私保护法案，要求医疗机构加强对患者信息的保护；GDPR （General Data Protection Regulation）是欧盟的一项数据保护法规，要求组织在处理个人数据时采取一系列保护措施。
根据美国联邦法规第30篇第18部分批准或评估本质安全型装置及相关装置的..
MSHA矿山安全与健康管理局,批准和认证中心1.0目的旨在告知申请人怎样申请MSHA批准或对本质安全装置或相关装置进行本质安全性评估（及延期批准或评估）。
本文件同样明确了评估和测试产品以符合MSHA要求的必要文件，设备及元件；并注明了申请人在调查期间的责任。
2.0范围本标准应用程序适用于所有关于本质安全型装置及相关装置批准或本质安全性评估的申请（及延期），该批准或本质安全性评估是依据美国联邦法规第30篇第18部分进行。
3.0参考资料3.1.美国联邦法规第30篇第6部分“在独立实验室根据非MSHA产品安全标准进行测试和评估”3.2.美国联邦法规第30篇第18部分“电机驱动矿山设备及附件”3.3.ACRI2001“本质安全装置及相关装置的评估及测试准则”3.4.APOL1009“取消申请策略”3.5.程序通告PC-4812-0“瓦斯坑本质安全性现场布线的安装及维护”3.6.ASAP2029“根据美国联邦法规第30篇第22部分进行便携式甲烷指示探测器批准的标准应用程序”这些文件可在网站上找到或联系批准及认证中心，电话304-547-0400。
4.0定义4.1.申请人--任何设计，制造，组装或控制电器或附件的组装并获得批准的个体，合伙企业，公司，集团，组织或协会....（美国联邦法规第30篇第18部分第2条）。
据第6部分所述，申请人为任何制造或控制产品组装并向MSHA申请批准该产品的个体或组织。
ASAP20162008-03-17.doc打印日期：3/17/2008MSHA矿山安全与健康管理局,批准和认证中心4.2.批准--一种由MSHA出具的正式文件，用以声明某完整组装的电器及附件已达到本部分适用要求，并授权贴上认可标牌（标签）作为指示（美国联邦法规第30篇第18部分第2条）。
根据第18部分规定，只有完整的本质安全型仪器或系统才能获得MSHA的批准。
4.3.相关装置--这种装置中的电路本身不安全但却连接着本质安全电路。
cpsc认证模板 -回复
cpsc认证模板-回复什么是CPSC认证？CPSC认证是指美国消费品安全委员会（Consumer Product Safety Commission）对于产品安全的认证机制。
CPSC是美国联邦政府的独立机构，负责保障消费者在使用产品时的安全性和可靠性。
该机构的成立旨在确保制造商、进口商和零售商在提供产品给消费者之前遵守严格的安全规范。
CPSC认证适用于多个领域的消费品，包括但不限于儿童玩具、电子产品、纺织品、家具、运动用品等。
通过符合CPSC认证要求，产品制造商可以获得“质量认证”，表明其产品已经通过了严格的测试和评估，符合美国对于产品安全的法规要求。
CPSC认证的过程1. 确定适用的标准：首先，制造商需要确定适用于其产品的CPSC认证标准。
CPSC制定了一系列的标准和规范，包括对物理性能、电气性能、化学成分和相关标签的要求。
根据产品的不同类别，制造商需要选择适用的标准进行认证。
2. 实施测试和评估：一旦确定了适用的标准，制造商需要进行针对性的测试和评估。
这些测试和评估旨在验证产品是否符合CPSC的安全要求。
例如，在儿童玩具方面，测试可能包括抗拉力、耐磨性、小零件的强度等指标。
3. 提供测试材料和文档：制造商需要向认证机构提供测试材料和相关文档，以证明产品的合规性。
这些材料可能包括测试报告、技术规范、制造流程等。
认证机构会对这些材料进行评估，并在必要时进行现场检查。
4. 认证申请和支付费用：一旦所有测试和评估都完成，制造商可以向认证机构提交认证申请。
申请过程通常需要填写一份申请表格，并支付相应的费用。
认证机构会对申请进行审查，并进行最后的认证决定。
CPSC认证的市场价值CPSC认证对于产品制造商来说具有重要的市场价值。
首先，通过CPSC 认证，制造商可以增加消费者对产品的信任和满意度。
这对于品牌形象的建立和产品销售至关重要。
其次，CPSC认证可以帮助制造商满足市场准入的要求。
在美国市场，许多零售商和在线平台要求产品必须符合CPSC认证标准才能上架销售。
安全标准化二级 英文证书
安全标准化二级英文证书In the realm of industrial safety, achieving Safety Standardization Level II certification represents a significant milestone. This certification, often referredto as the "golden standard" in safety management, is a testament to a company's commitment to safety excellence. Obtaining this certification not only ensures compliancewith international safety standards but also serves as a powerful indicator of a company's dedication to creating a safe and secure work environment.The journey to achieving Safety Standardization LevelII certification is not a simple one. It requires a comprehensive approach that encompasses every aspect of a company's operations, from the smallest details of daily tasks to the broader strategies guiding its long-term goals. This certification process demands meticulous planning,strict adherence to safety protocols, and continuous improvement in all areas of safety management.The benefits of achieving Safety Standardization LevelII certification are numerous. Firstly, it ensures that employees are working in a safe and healthy environment,reducing the risk of accidents and injuries. This, in turn, leads to increased productivity and efficiency as employees can focus on their work without the constant worry of safety hazards. Secondly, this certification can enhance a company's reputation and credibility, attracting potential clients and investors who value safety and reliability. Finally, it provides a solid foundation for continuous improvement in safety management, ensuring that the company remains at the forefront of safety excellence.However, achieving Safety Standardization Level II certification is not an end in itself. It is rather a starting point for a journey of continuous improvement and refinement. Companies must maintain their commitment to safety excellence, regularly reviewing and updating their safety management systems to ensure they remain aligned with the latest international standards and best practices. Only by doing so can companies truly leverage the full potential of this certification and create a truly safe and secure work environment for their employees.In conclusion, achieving Safety Standardization LevelII certification is a crucial step towards ensuringindustrial safety excellence. It requires a comprehensive approach, strict adherence to safety protocols, and a commitment to continuous improvement. By doing so, companies can create a safe and secure work environment for their employees, enhance their reputation and credibility, and lay the foundation for sustained success in the realm of industrial safety.**安全标准化二级英文证书的重要性**在工业安全领域，获得安全标准化二级认证是一个重要的里程碑。
企业安全管理制度的国际化标准与认证
企业安全管理制度的国际化标准与认证随着全球经济的发展和企业越来越依赖信息技术，企业安全管理制度的国际化标准与认证变得越来越重要。
在全球范围内，各国政府、企业和组织都意识到了安全管理的重要性，并纷纷引入了相关的国际标准和认证机制来保护企业的安全。
国际标准化组织（ISO）是全球最重要的国际标准制定组织之一，为企业安全管理制度的国际化提供了重要的指导和支持。
ISO 27001是ISO制定的信息安全管理体系标准，它提供了一套全面的安全管理要求，帮助企业构建统一的、系统化的信息安全管理制度。
企业通过遵循ISO 27001标准可以提高对信息资产的保护，减小信息安全风险，并降低企业在全球经济中的不确定性。
ISO 27001标准的认证是企业安全管理制度国际化的重要证明。
获得ISO 27001认证意味着企业的信息安全管理制度已经达到了国际水平，并通过了第三方的验证。
这不仅有助于提升企业在国际市场上的竞争力，还可以增加企业与业务合作伙伴的信任和合作。
除了ISO标准，还有其他国际化的安全管理制度标准和认证方法。
例如，美国国家安全局（NSA）制定的存储器粉尘安全管理制度（CMMC）是面向美国国防工业基地的一项安全管理制度认证。
CMMC标准通过对供应链的认证来确保企业在存储器粉尘安全方面的合规性，这对于国防工业企业的国际化竞争至关重要。
此外，国际电信联盟（ITU）也制定了一系列的安全管理标准和认证机制，旨在帮助各国和地区加强信息通信技术的安全。
ITU的安全管理标准包括了网络安全、信息安全和通信数据保护等方面，可以为企业提供全方位的安全管理解决方案，有助于企业在国际市场上实现可持续发展。
企业安全管理制度的国际化标准与认证不仅有助于保护企业的信息资产和业务运营，还可以增强企业的可持续发展能力。
通过引入国际标准和认证，企业可以与国际市场接轨，提高自身的安全竞争力，增加国际合作的机会，并获得更多的商业机会。
然而，企业在实施国际化的安全管理制度之前，还需注意一些问题。
安全风险评估技术标
安全风险评估技术标
安全风险评估技术标准是指用于评估安全风险的一套标准和方法。
这些技术标准旨在帮助组织识别和评估可能存在的安全威胁，并提供基于风险的决策和措施。
以下是一些常见的安全风险评估技术标准：
1. NIST SP 800-30：美国国家标准与技术研究院（NIST）发布的一项风险评估标准，提供了一个系统的方法来评估信息系统的安全风险。
2. ISO 27005：国际标准化组织（ISO）发布的信息安全管理系统（ISMS）风险管理标准，为组织提供了一个系统的方法来
评估和管理信息安全风险。
3. OCTAVE：一种由Carnegie Mellon大学软件工程研究所开
发的企业安全风险评估方法，通过组织内部的合作和合作来识别和管理风险。
4. FAIR：一种基于定量方法的安全风险评估框架，帮助组织
量化和投资风险管理措施。
5. CSA CCM：由云安全联盟（CSA）发布的云计算控制矩阵，提供了一套用于评估云计算环境中安全风险的控制要求。
这些技术标准提供了一种结构化的方法来评估安全风险，并帮助组织制定有效的安全策略和措施。
根据组织的需求和特定风险情境，可以选择适合的技术标准进行安全风险评估。
安全评估权威机构
安全评估权威机构
以下是几个权威的安全评估机构：
1. 美国国家标准与技术研究院（NIST）：NIST是美国政府部门，负责开发和推动各种安全标准和技术。
他们的计算机安全部门负责研究和推动计算机系统和网络的安全。
2. 英国政府通信总部（GCHQ）：GCHQ是英国政府的情报机构，负责评估和保护国家信息系统的安全。
他们提供安全咨询和审核服务，以确保英国政府和企业的信息系统安全。
3. 国际电信联盟（ITU）：ITU是联合国下属的国际组织，负责电信和信息技术的国际标准制定和协调。
他们的安全评估分部负责确保全球电信网络的安全。
4. 欧洲网络和信息安全局（ENISA）：ENISA是欧洲联盟的一个机构，负责推动和协调欧洲的网络和信息安全。
他们提供安全评估、咨询和培训服务，以保护欧洲的信息基础设施。
除了以上机构，还有许多国家和地区都有其自己的安全评估机构，如美国国家安全局（NSA）、德国联邦安全局（BSI）、加拿大通信安全局（CSE）等。
这些机构都拥有丰富的经验和专业知识，可以为企业和政府提供权威的安全评估服务。
国外安全评价概况
国外安全评价概况安全评价是为了评估产品、设备或系统的安全性能，尤其是在生产、运输或使用时，是否会对人、财产或环境造成危险或损害。
这项评估是为了确保产品或系统与相关的法规、标准和规范保持一致，确保用户和公众能够安全地使用这些产品。
国外安全评价在不同的国家和领域中有些许不同，下面简要地介绍几个具有代表性的实践。
1.欧洲安全评价欧盟对于安全评价有自己的标准和程序，主要是通过EC指令对于新产品的评估和验证，确认其对于人员、财产及环境是否存在危险性。
欧盟有许多指令要求生产商在发布产品前进行评估，例如机械产品指令、低电压指令等。
这些指令规定了安全评价中需要考虑的因素、评估方法以及标准，并要求厂商提交技术文件以证明产品符合要求。
2.美国安全评价美国不同的部门和组织有着不同的安全评价要求和程序，例如环境保护局、食品药品监督管理局等。
美国的安全评价主要关注产品的设计以及在使用过程中的危险性。
他们主要通过对于相关技术文件的审核及产品测试来确定产品是否合格。
3.澳大利亚安全评价澳大利亚的安全评价有其自己的法规和标准，产品厂商需要按照澳大利亚的法律标准对产品进行测试和认证，以确保产品可以在澳大利亚销售。
4.中国安全评价中国的安全评价体系从2001年开始逐步建立，主要包括产品安全、环境安全、食品安全等方面。
同时也建立了一套完整的符合国际标准和本国国情的安全评价法律法规，例如《消费品安全法》、《环境影响评价法》等。
中国的安全评价要求厂商必须在产品设计和制造过程中进行风险评估和安全控制，也可以通过第三方机构进行产品认证。
总之，安全评价可以对于产品的使用安全进行有效的控制，不同国家和地区的安全评价体系有不同的特点，但最终目的都是为了保护用户和公众的安全。
cpsia是什么认证
cpsia是什么认证
cpsia是美国关于儿童消费品类产品的认证。
CPSIA即2008年8月14日由美国总统布什签署生效的安全改进法案。
该法令是自1972年消费品安全委员会(CPSC)成立以来最严厉的消费者保护法案。
新法案除了对儿童产品中铅含量的要求更为严格外，还对玩具和儿童护理用品中的有害物质邻苯二甲酸盐的含量做出新的规定。
此外，该法案还要求建立消费品安全公共数据库。
美国总统布什于2008年8月14日正式签署生效消费品安全改进法案(CPSIA/HR4040)，成为法律。
CPSIA影响着美国所有生产、进口、分销玩具、服装和其他儿童产品及护理品的相关行业。
所有制造商应该保证其产品符合该法案的所有规定、禁令、标准或者规则，在邻苯二甲酸盐含量中，除了DINP、DIDP及DNOP暂时被禁止使用，直到CHAP研究报告出台后再决定是否解禁或列为永久禁止使用外，DEHP、DBP及BBP已被永久禁止使用。
必须通过美国消费品安全委员会CPSC认可检测机构检测，否则将面对巨额罚款并导致出口中断。
tsca检测标准
tsca检测标准TSCA检测标准是指美国《毒性物质控制法案》（Toxic Substances Control Act）所规定的化学物质检测标准。
该法案于1976年通过，是美国联邦政府对化学物质的生产、进口、使用和处理进行监管的重要法律。
TSCA检测标准的制定旨在保护公众和环境免受有害化学物质的危害。
根据该标准，所有在美国生产或进口的化学物质都需要进行评估和检测，以确定其对人类健康和环境的潜在风险。
这些化学物质包括工业原料、化妆品、家居用品、食品添加剂等。
TSCA检测标准要求化学物质的生产者或进口者提供详细的安全数据，包括物质的化学成分、毒性特性、用途和暴露途径等。
这些数据将用于评估化学物质的潜在风险，并制定相应的管理措施。
如果某种化学物质被认定为有害或具有潜在风险，相关部门可以采取限制或禁止其使用的措施，以保护公众和环境的安全。
TSCA检测标准的制定和执行涉及多个机构和部门的合作。
美国环境保护署（EPA）是主要负责执行该法案的机构，负责评估化学物质的风险，并制定相应的管理措施。
此外，美国食品药品监督管理局（FDA）和职业安全卫生管理局（OSHA）等部门也参与了TSCA检测标准的制定和执行工作。
TSCA检测标准的实施对于保护公众和环境的健康至关重要。
通过对化学物质的评估和监管，可以减少有害物质对人体健康的影响，降低环境污染的风险。
此外，TSCA检测标准还促进了化学物质的研发和创新，推动了绿色化学和可持续发展的进程。
然而，TSCA检测标准也面临一些挑战和争议。
一方面，化学物质的评估和检测需要大量的时间和资源，导致进程缓慢和成本高昂。
另一方面，一些人认为TSCA检测标准的要求不够严格，无法有效保护公众和环境的健康。
因此，一些环保组织和科学家呼吁对TSCA进行修订和改进，以提高其效果和可行性。
总之，TSCA检测标准是美国对化学物质进行监管的重要法律工具。
通过对化学物质的评估和检测，可以保护公众和环境的健康，促进绿色化学和可持续发展。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
XenApp 6 Security Standards and Deployment Scenarios© 2011 Citrix Systems, Inc. All rights reserved. Terms of Use | Trademarks | Privacy StatementContentsXenApp 6 Security Standards and Deployment Scenarios4 XenApp 6 Security Standards and Deployment Scenarios5 Security Considerations in a XenApp Deployment6 Country-Specific Government Information7FIPS 140 and XenApp8TLS/SSL Protocols10Government Ciphersuites11IP Security12Citrix Single Sign-on13Smart Cards14Kerberos Authentication15Citrix Plug-ins16 Standards Summary17 Virtual Channels19Additional XenApp Security Features20 Deployment Samples21 Sample A – Using the SSL Relay22 How the Components in Sample Deployment A Interact23Security Considerations in Sample Deployment A24 Sample B – Using Secure Gateway (Single-Hop)26 How the Components in Sample Deployment B Interact28Security Considerations for Sample Deployment B30 Sample C – Using Secure Gateway (Double-Hop)32 How the Components in Sample Deployment C Interact34Security Considerations in Sample Deployment C35 Sample D – Using the SSL Relay and the Web Interface37 How the Components in Sample Deployment D Interact39Security Considerations for Sample Deployment D40 Sample E – Using Citrix Single Sign-on and Secure Gateway (Single-Hop)42How the Components in Sample Deployment E Interact44 Security Considerations for Deployment Sample E45XenApp 6 Security Standards and Deployment ScenariosCitrix products offer the security specialist a wide range of features for securing a XenAppsystem according to officially recognized standards.Security standards as they apply to Citrix XenApp 6.0 for Microsoft Windows Server 2008 R2are discussed here. These topics provide an overview of the standards that apply to XenAppdeployments and describe the issues involved in securing communications across a set ofsample XenApp deployments. For more information about the details of the individualsecurity features, refer to the relevant product or component documentation.When deploying XenApp within large organizations, particularly in governmentenvironments, security standards are an important consideration. For example, manygovernment bodies in the United States and elsewhere specify a preference or requirementfor applications to be compliant with FIPS 140. These topics address common issues relatedto such environments.These topics are designed for security specialists, systems integrators, and consultants,particularly those working with government organizations worldwide.DeploymentXenApp provides server-based computing to local and remote users through theIndependent Computing Architecture (ICA) protocol developed by Citrix.ICA is the communication protocol by which servers and client devices exchange data in aXenApp environment. ICA is optimized to enhance the delivery and performance of thisexchange, even on low bandwidth connections.As an application runs on the server, XenApp intercepts the application’s display data anduses the ICA protocol to send this data (on standard network protocols) to the pluginsoftware running on the user’s client device. When the user types on the keyboard or movesand clicks the mouse, the plugin software sends the data generated for processing by theapplication running on the server.ICA requires minimal client workstation capabilities and includes error detection andrecovery, encryption, and data compression.A server farm is a collection of XenApp servers that you can manage (from the DeliveryServices Console) as a single entity. A server can belong to only one farm, but a farm caninclude servers from more than one domain. The design of server farms has to balance thegoal of providing users with the fastest possible application access with that of achievingthe required degree of centralized administration and network security.Note that in XenApp deployments that include the Web Interface, communication betweenthe server running the Web Interface and client devices running Web browsers (and pluginsoftware) takes place using HTTP.In a XenApp deployment, administrators can configure encryption using either of thefollowing:q SSL Relay, a component that is integrated into XenAppq Secure Gateway, a separate component provided on the XenApp installation mediaDeploymentXenApp provides server-based computing to local and remote users through theIndependent Computing Architecture (ICA) protocol developed by Citrix.ICA is the communication protocol by which servers and client devices exchange data in aXenApp environment. ICA is optimized to enhance the delivery and performance of thisexchange, even on low bandwidth connections.As an application runs on the server, XenApp intercepts the application’s display data anduses the ICA protocol to send this data (on standard network protocols) to the pluginsoftware running on the user’s client device. When the user types on the keyboard or movesand clicks the mouse, the plugin software sends the data generated for processing by theapplication running on the server.ICA requires minimal client workstation capabilities and includes error detection andrecovery, encryption, and data compression.A server farm is a collection of XenApp servers that you can manage (from the DeliveryServices Console) as a single entity. A server can belong to only one farm, but a farm caninclude servers from more than one domain. The design of server farms has to balance thegoal of providing users with the fastest possible application access with that of achievingthe required degree of centralized administration and network security.Note that in XenApp deployments that include the Web Interface, communication betweenthe server running the Web Interface and client devices running Web browsers (and pluginsoftware) takes place using HTTP.In a XenApp deployment, administrators can configure encryption using either of thefollowing:q SSL Relay, a component that is integrated into XenAppq Secure Gateway, a separate component provided on the XenApp installation mediaCountry-Specific Government Information The following topics are of particular relevance to XenApp installations in Australia, theUnited Kingdom, and the United States:q FIPS 140 and XenAppq TLS/SSL Protocolsq Smart Cardsq Kerberos AuthenticationIn addition, for information on Common Access Cards (of particular relevance toinstallations in the United States), see Smart Cards.For more information about issues specific to your country, contact your local Citrixrepresentative.FIPS 140 and XenAppFederal Information Processing Standard 140 (FIPS 140) is a U.S. Federal Governmentstandard that specifies a benchmark for implementing cryptographic software. It providesbest practices for using cryptographic algorithms, managing key elements and data buffers,and interacting with the operating system. An evaluation process that is administered bythe National Institute of Standards and Technology (NIST) National Voluntary LaboratoryAccreditation Program (NVLAP) allows encryption product vendors to demonstrate theextent to which they comply with the standard and, thus, the trustworthiness of theirimplementation.FIPS 140-1, published in 1994, established requirements for cryptographic modules toprovide four security levels that allowed cost-effective solutions appropriate for differentdegrees of data sensitivity and different application environments. FIPS 140-2, whichsuperceded FIPS 140-1 in 2002, incorporated changes in standards and technology since1994. FIPS 140-3, which is still in draft, adds an additional security level and incorporatesnew security features that reflect recent advances in technology.Some U.S. Government organizations restrict purchases of products that containcryptography to those that use FIPS 140-validated modules.In the U.K., guidance published by the Communications-Electronics Security Group (CESG)recommends the use of FIPS 140-approved products where the required use for informationis below the RESTRICTED classification, but is still sensitive (that is, data classifiedPRIVATE).The security community at large values products that follow the guidelines detailed in FIPS140 and the use of FIPS 140-validated cryptographic modules.To implement secure access to application servers and to meet the FIPS 140 requirements,Citrix products can use cryptographic modules that are FIPS 140 validated in Windowsimplementations of secure TLS or SSL connections.The following XenApp components can use cryptographic modules that are FIPS 140validated:q XenAppq Citrix online plug-in (inlcuding the Citrix online plug-in and citrix online plug-in Web)q Web Interfaceq SSL Relayq Secure Gateway for Windowsq Single sign-onq Offline applications (streaming)q SmartAuditorFIPS 140 and XenAppq Power and Capacity ManagementWhere the client and server components (listed above) communicate with the TLS or SSLconnection enabled, the cryptographic modules that are used are provided by the MicrosoftWindows operating system. These modules use the Microsoft Cryptography ApplicationProgramming Interface (CryptoAPI) and are FIPS 140 validated.The ciphersuite RSA_WITH_3DES_EDE_CBC_SHA, first defined in Internet RFC 2246(/rfc/rfc2246.txt), uses RSA key exchange and TripleDES encryption.This is achieved as follows:q According to the Microsoft documentation(/en-us/library/cc750357.aspx), FIPS-compliant systemsthat use FIPS 140-certified cryptomodules can be deployed by following a prescribed setof steps. These steps include setting a particular FIPS local policy flag.q As noted in the Microsoft documentation referenced above, not all Microsoftcomponents and products check the FIPS local policy flag. Refer to the Microsoftdocumentation for instructions on how to configure these components and products tobehave in a FIPS-compliant manner.q Similarly, Citrix components do not check the FIPS local policy flag. Instead, these components must be configured to behave in a FIPS-compliant manner.q Specifically, Citrix components that use TLS must be configured to use government ciphersuites. This will cause the component to select one of the following ciphersuites:q RSA_WITH_3DES_EDE_CBC_SHA [RFC 2246]q RSA_WITH_AES_128_CBC_SHA [FIPS 197, RFC 3268]q RSA_WITH_AES_256_CBC_SHA [FIPS 197, RFC 3268]Given the accuracy of the above statements, and assuming that all these steps arefollowed, the resulting XenApp configuration will use FIPS 140 cryptomodules in aFIPS-compliant manner.For a list of currently validated FIPS 140 modules, see/cryptval/140-1/1401val.htm.For more information about FIPS 140 and NIST, visit the NIST Web site at/cryptval/.TLS/SSL ProtocolsYou can secure communications between client devices and servers using either theTransport Layer Security (TLS) 1.0 or Secure Sockets Layer (SSL) 3.0 protocols. Theseprotocols are collectively referred to TLS/SSL.Both TLS and SSL are open protocols that provide data encryption, server authentication,message integrity, and optional client authentication for a TCP/IP connection. Note thatboth the SSL Relay and Secure Gateway support TLS and SSL.SSL is an open, nonproprietary security protocol for TCP/IP connections. If you want to usethe SSL Relay to secure communications between client devices and servers within theserver farm, you must install the SSL Relay on each server in the farm. Alternatively, youcan use Secure Gateway. Both the SSL Relay and Secure Gateway implementations arediscussed in this documentation.TLS, which is also an open standard, is the latest, standardized version of the SSL protocol.The SSL Relay also supports TLS; you can configure the SSL Relay, Secure Gateway, and theWeb Interface to use TLS. Support for TLS Version 1.0 is included in XenApp 6.0 and Singlesign-on 4.8.Because there are only minor differences between TLS and SSL, the server certificates inyour installation can be used for both TLS and SSL implementations.Government CiphersuitesYou can configure XenApp, the Web Interface, and Secure Gateway to usegovernment-approved cryptography to protect “sensitive but unclassified” data.For RSA key exchange and TripleDES encryption, the government ciphersuite isRSA_WITH_3DES_EDE_CBC_SHA.Alternatively, for TLS connections, you can use Advanced Encryption Standard (AES) asdefined in FIPS 197. The government ciphersuites are RSA_WITH_AES_128_CBC_SHA for128-bit keys and RSA_WITH_AES_256_CBC_SHA for 256-bit keys.IP SecurityIP Security (IPSec) is a set of standard extensions to the Internet Protocol (IP) that providesauthenticated and encrypted communications with data integrity and replay protection.IPSec is a network-layer protocol set, so higher level protocols such as Citrix ICA can use itwithout modification.Although such sample deployments are outside the scope of this document, you can useIPSec to secure a XenApp deployment within a virtual private network (VPN) environment.IPSec is described in Internet RFC 2401.Microsoft Windows 7, Windows Vista, Windows XP, Windows Server 2008 R2, Windows Server2008, and Windows Server 2003 have built-in support for IPSec.Citrix Single Sign-onCitrix Single sign-on increases application security for all XenApp applications, allowingorganizations to centralize password management while providing users with fast sign-onaccess to Web, Windows, and host-based applications.Smart CardsYou can use smart cards with XenApp, supported XenApp plug-ins, the Web Interface, andSingle sign-on to provide secure access to applications and data. Using smart cardssimplifies the authentication process while enhancing logon security. XenApp supportssmart card authentication to published applications, including “smart card-enabled”applications such as Microsoft Outlook.In a business network, smart cards are an effective implementation of public keytechnology and can be used for the following purposes:q Authenticating users to networks and computersq Securing channel communications over a networkq Securing content using digital signaturesIf you are using smart cards for secure network authentication, your users can authenticateto applications and content published on your server farms. In addition, smart cardfunctionality within these published applications is also supported.For example, a published Microsoft Outlook application can be configured to require thatusers insert a smart card into a smart card reader attached to the client device in order tolog on to a XenApp server. After users are authenticated to the application, they candigitally sign email using certificates stored on their smart cards.Citrix supports the use of Personal Computer Smart Card (PC/SC)-based cryptographic smartcards. These cards include support for cryptographic operations such as digital signaturesand encryption. Cryptographic cards are designed to allow secure storage of private keyssuch as those used in Public Key Infrastructure (PKI) security systems. These cards performthe actual cryptographic functions on the smart card itself, meaning that the private keyand digital certificates never leave the card. In addition, you can use two-factorauthentication for increased security. Instead of merely presenting the smart card (onefactor) to conduct a transaction, a user-defined PIN (a second factor) known only to theuser, is used to prove that the cardholder is the rightful owner of the smart card.Smart Card SupportCitrix continues testing various smart cards to address smart card usage and compatibilityissues with XenApp.XenApp supports the Common Access Card in a deployment that includes the Citrix onlineplug-in for Windows. Contact your Common Access Card vendor or Citrix representative formore information about supported versions of Common Access Card hardware and software.Citrix tests smart cards using certificates from common certificate authorities such as thosesupported by Microsoft. If you have any concerns regarding your certificate authority andcompatibility with XenApp, contact your local Citrix representative.Kerberos AuthenticationKerberos is an authentication protocol. Version 5 of this protocol is standardized as InternetRFC 1510. Many operating systems, including Microsoft Windows 2000 and later, supportKerberos as a standard feature.XenApp extends the use of Kerberos. When users log on to a client device, they can connectto XenApp without needing to authenticate again. The user’s password is not transmitted toXenApp; instead, authentication tokens are exchanged using the Generic Security ServicesAPI (GSSAPI) standardized in Internet RFC 1509.This authentication exchange is performed within an ICA virtual channel and does notrequire any additional protocols or ports. The authentication exchange is independent ofthe logon method, so it can be used with passwords, smart cards, or biometrics.To use Kerberos authentication with XenApp, both the client and server must beappropriately configured. You can also use Microsoft Active Directory Group Policyselectively to disable Kerberos authentication for specific users and servers.Citrix Plug-insWith the Citrix online plug-in installed on their client devices, users can work withapplications running on XenApp servers. Users can access these applications from virtuallyany type of client device over many types of network connection, including LAN, WAN,dial-up, and direct asynchronous connections. Because the applications are not downloadedto the client devices (as with the more traditional network architecture), applicationperformance is not limited by bandwidth or device performance.Citrix plug-ins are available for Windows, Macintosh, Linux, UNIX, and Windows CEoperating systems, and the Java Runtime Environment. Additionally, you can use the Citrixonline plug-in Web with Web browsers that support ActiveX controls or Netscape plug-ins.Citrix plug-ins for Windows use cryptographic modules provided by the operating system.Other plug-ins, including the Client for Java, contain their own cryptographic modules. TheClient for Java can, therefore, be used on older Windows operating systems that do notsupport strong encryption.The Standards Summary table lists the latest versions of the available plug-ins. The tablespecifies whether each plug-in is FIPS 140 compliant, supports TLS, includes smart cardsupport, uses government ciphersuites, supports certificate revocation checking, andsupports Kerberos authentication. Note that certificate revocation checking is applicable toplug-ins running on Windows XP, Windows Vista, and Windows 7 only. Where the latestversion of a plug-in does not completely supersede a previous version (for example, aparticular operating system may be supported only by an earlier plug-in version), the earlierversion of the plug-in is also listed.Standards SummaryThe following table summarizes the standards relevant to the various Citrix plug-ins:Plug-in type FIPS140TLS TripleDES AES CRLcheckSmartcardKerberosCitrix online plug-in 12.x*¹******Citrix online plug-in Web12.x*¹******Client for Windows CEfor Windows-BasedTerminals 10.x*²** *Client for Windows CEfor Handheld and PocketPCs 10.x*²** *Client for Macintosh 10.x *** **Client for Linux 10.x ** *Client for Java 9.x **** *³Client for Sun Solaris 8.x ** *Notes:¹ These plug-ins inherit FIPS 140 compliance from the base operating system, Windows.² These plug-ins inherit FIPS 140 compliance from the base operating system, Windows CE.³ Kerberos authentication is not supported when the Client for Java is running on Mac OS X client devices.The table below shows the certificate source for plug-ins that support at least one of the security features listed in the table above. Plug-ins marked “OS” use certificates stored in the operating system certificate store, those marked “Plug-in” use certificates bundled with the plug-in, and plug-ins marked “JRE” use certificates stored in the Java keystore.Plug-in type Root certificate sourceCitrix online plug-in 12.x OSCitrix online plug-in Web 12.x OSClient for Windows CE for Windows-BasedTerminals 10.xOSClient for Windows CE for Handheld andPocket PCs 10.xOSClient for Macintosh 10.x OSStandards SummaryClient for Linux 10.x Plug-inClient for Java 9.x JRE (Java 1.4.x)JRE or OS (Java 1.5.x or later) Client for Sun Solaris 8.x Plug-inVirtual ChannelsThe following table shows which ICA virtual channels (or combination of virtual channels)can be used with XenApp for authentication and application signing or for encryptionmethods.Smart cardvirtual channel Kerberos virtualchannelCore ICA protocol (novirtual channel)Smart cardauthentication**Biometric¹authentication*Passwordauthentication**Applicationsigning/encryption* ¹ Third-party equipment is required for biometric authentication.Additional XenApp Security Features The following products can be used with XenApp to provide additional security. Theseadditional security measures are not included in the sample deployments.ICA Encryption Using SecureICAICA encryption with SecureICA is integrated into XenApp. With SecureICA, you can use up to128-bit encryption to protect the information sent between a XenApp server and users’client devices. However, it is important to note that SecureICA does not use FIPS140-compliant algorithms. If this is an issue, you can configure XenApp servers and plug-insto avoid using SecureICA.Authentication for the Web Interface Using RSA SecurIDYou can use the third-party product RSA SecurID as an authentication method for the WebInterface running on Internet Information Services. If RSA SecurID is enabled, users must logon using their credentials (user name, password, and domain) plus their SecurID PASSCODE.The PASSCODE is made up of a PIN followed by a tokencode (the number displayed on theuser’s RSA SecurID token).RSA SecurID supports authentication on both XenApp and Single sign-on. Authentication for the Web Interface Using SafeWordYou can use the third-party product Aladdin SafeWord as an authentication method for theWeb Interface running on Internet Information Services. If SafeWord is enabled, users mustlog on using their credentials (user name, password, and domain) plus their SafeWordpasscode. The passcode is made up of the code displayed on the user’s SafeWord token,optionally followed by a PIN.SafeWord supports authentication on XenApp, but not on Single sign-on.Deployment SamplesTo make a XenApp deployment FIPS 140 compliant, you need to consider eachcommunication channel within the installation. The following deployment samples showhow users can connect to XenApp servers with different configurations of components andfirewalls. In particular, the samples provide general guidance on how to make eachcommunication channel secure using TLS/SSL so that the system as a whole is FIPS 140compliant.Sample A – Using the SSL RelayThis deployment uses the SSL Relay to provide end-to-end TLS/SSL encryption between theXenApp server and the plugin.This diagram shows sample deployment A, which uses the SSL Relay.The deployment uses a server farm comprising XenApp 6 servers. Users run the Citrix onlineplug-in 12.x on their client devices.How the Components in Sample Deployment A InteractUse TLS/SSL to secure the connections between client devices and the XenApp servers. Todo this, deploy TLS/SSL-enabled plug-ins to users and configure the SSL Relay on theXenApp servers.This deployment provides end-to-end encryption of the communication between the clientdevice and the XenApp servers. Both the SSL Relay and the appropriate server certificatemust be installed and configured on each server in the farm.The SSL Relay operates as an intermediary in communication between client devices andthe XML Service on each server. Each client device authenticates the SSL Relay by checkingthe SSL Relay’s server certificate against a list of trusted certificate authorities. After thisauthentication, the client device and the SSL Relay negotiate requests in encrypted form.The SSL Relay decrypts the requests and passes them to the XenApp servers. All informationsent to the client device from the servers passes through the SSL Relay, which encrypts thedata and forwards it to the client device to be decrypted. Message integrity checks verifythat each communication has not been tampered with.This diagram shows a detailed view of sample deployment A.Security Considerations in Sample Deployment AFIPS 140 Validation in Sample Deployment AIn this deployment, the SSL Relay uses the Microsoft cryptographic service providers (CSPs)and associated cryptographic algorithms available in the Microsoft Windows CryptoAPI toencrypt and decrypt communication between client devices and servers. For moreinformation about the FIPS 140 validation of the CSPs, see the Microsoft documentation.For Windows 7, Windows Vista, Windows XP, Windows Server 2008 R2 (in a XenApp 6 farm),Windows Server 2008 (in a XenApp 5 farm), and Windows Server 2003 (in a XenApp 5 farm),TLS/SSL support and the supported ciphersuites can also be controlled using the followingMicrosoft security option:System cryptography: Use FIPS compliant algorithms for encryption, hashing, andsigningFor more information, see the documentation for your operating system.TLS/SSL Support in Sample Deployment AYou can configure XenApp to use either the Transport Layer Security 1.0 protocol or theSecure Sockets Layer 3.0 protocol. In sample deployment A, the components are configuredfor TLS.When using the SSL Relay Configuration Tool, ensure that TLS is selected on theConnection tab.Supported Ciphersuites for Sample Deployment A In this deployment, XenApp can be configured to use government-approved cryptography,such as the ciphersuite RSA_WITH_3DES_EDE_CBC_SHA, to protect “sensitive butunclassified” data.When using the SSL Relay Configuration Tool, ensure that only GOV is selected on theCiphersuite tab.Alternatively, for TLS connections, you can use AES as defined in FIPS 197. The governmentciphersuites are RSA_WITH_AES_128_CBC_SHA for 128-bit keys andRSA_WITH_AES_256_CBC_SHA for 256-bit keys. As defined in Internet RFC 3268/rfc/rfc3268.txt, these ciphersuites use RSA key exchange and AESencryption. For more information about AES, see /cryptval/des.htm.Security Considerations in Sample Deployment ACertificates and Certificate Authorities in Sample Deployment ACitrix products use standard Public Key Infrastructure (PKI) as a framework and trustinfrastructure. In sample deployment A, a separate server certificate is configured for eachXenApp server on which the SSL Relay is used. A root certificate is required for each clientdevice.Smart Card Support in Sample Deployment AIn this deployment, you can configure XenApp to provide smart card authentication. To dothis, you must configure authentication with Microsoft Active Directory and use theMicrosoft Certificate Authority.Plug-ins Used in Sample Deployment AIn this deployment, users access their applications using the Citrix plug-in. For moreinformation about the security features and capabilities of Citrix plug-ins, see CitrixPlug-ins.。