Standard No.:	GB/T 20280-2006
English Name:	Information security technology - Testing and evaluation approaches for network vulnerability scanners
Chinese Name:	信息安全技术 网络脆弱性扫描产品测试评价方法
Chinese Classification:	L80    Data encryption
Professional Classification:	GB    National Standard
Source Content Issued by:	AQSIQ; SAC
Issued on:	2006-5-31
Implemented on:	2006-12-1
Status:	superseded
Superseded by:	GB/T 20278-2022 Information security technology—Security technical requirements and testing assessment approaches for network vulnerability scanners
Superseded on:	2022-10-1
Abolished on:	2022-10-01
Target Language:	English
File Format:	PDF
Word Count:	10000 words
Translation Price(USD):	130.0
Delivery:	via email in 1 business day

1 Scope This Standard specifies the testing and evaluation approaches for network vulnerability scanners adopting Transmission Control Protocol and Internet Protocol (TCP/IP). This Standard is applicable to the testing and evaluation, R&D and application of security products for manual or automatic network vulnerability scan on computer information system. This Standard is not applicable to products specialized for vulnerability scan on database system. 2 Normative References The following standard contains provisions which, by reference into this document, constitute the provisions of this document. For dated reference, subsequent amendments to (excluding correction contents), or revisions of, any of these publications do not apply. However, it is encouraged that the Parties that reach an agreement according to this Standard should research whether the latest edition of these documents can be used. For undated references, their latest editions apply. GB/T 5271.8-2001 Information Technology – Vocabulary - Part 8: Security (idt ISO/IEC 2382-8: 1998) GB/T 20278-2006 Information Security Technology Technique Requirement for Network Vulnerability Scanners : 3 Terms and Definitions For the purpose of this Standard, terms and definitions established in GB/T 5271.8-2001 and GB/T 20278-2006 apply. 4 Stipulation of Symbol, Abbreviation and Notation 4.1 Symbols and Abbreviations CGI Common Gateway Interface CVE Common Vulnerabilities and Exposures DNS Domain Name System DOS Denial of Service FTP File Transfer Protocol IDS Intrusion Detection System IP Internet Protocol NETBIOS Network Basic Input Output System NFS Network File System POP Post Office Protocol RPC Remote Procedure Call SMB Server Message Block Protocol SNMP Simple Network Management Protocol TCP Transport Control Protocol UDP User Datagram Protocol 4.2 Stipulation of Notation

Foreword I Introduction II 1 Scope 2 Normative References : 3 Terms and Definitions 4 Stipulation of Symbol, Abbreviation and Notation 4.1 Symbols and Abbreviations 4.2 Stipulation of Notation 5 Overview of Network Vulnerability Scanners 6 Testing Environment 7 Testing and Evaluation Approaches and Procedure 7.1 Basic Type 7.1.1 Basic function 7.1.3 Security assurance requirements 7.2 Enhanced Type 7.2.1 Basic function and performance 7.2.2 Enhancement function 7.2.3 Security assurance requirements Appendix A (Normative) Testing Evidence Provided by Product Manufacturer to Testing Unit A.1 Basic Type A.2 Enhanced Type Bibliography