The reporter learned from the Ministry of National Security that network operation and maintenance is an important part of network information construction, and its role in ensuring the normal operation of the network and ensuring data security is becoming increasingly prominent. In recent years, the national security organs have found in their work that some confidential units have irregular network operations and maintenance, or use operation and maintenance agencies with mismatched qualifications and abilities, or operation and maintenance personnel have violated regulations, resulting in the operation and maintenance links becoming a breakthrough for overseas spy intelligence agencies to carry out network penetration and stealing secrets in me, threatening our network security and data security.

Ignoring the norms and opening the "remote end"

Imposing the standard, I will open and not close for a long time and become a "scarce"

The server used by a certain enterprise to monitor production process data is attacked and controlled by foreign spy intelligence agencies. The national security agency found that in order to facilitate convenience, the employees of the enterprise responsible for operating and maintaining the system privately opened the remote login port of the server, changed the on-site operation and maintenance to remote operation and maintenance, and did not take any technical protection measures. After overseas spy intelligence agencies used network exploration and attack to control the server, they used it as a springboard to carry out intranet penetration activities, resulting in a large amount of intranet data being stolen by the company, posing a real threat.

Operation and maintenance personnel are "dark under the light"

The operation and operation cause trouble with "toxic" operations

A large number of drawings and electronic data of a certain public institution were stolen by overseas spy intelligence agencies. The national security agency found that the operation and maintenance laptops hired by the on-site operation and maintenance engineers used by the unit were infected with multiple treacherous Trojan programs with automatic transmission functions in foreign spy intelligence agencies, which were not discovered and removed in time. The "toxic" operation caused multiple network equipment to be infected with treacherous Trojans one after another, becoming an intranet penetration channel for overseas spy intelligence agencies, resulting in the theft of important sensitive data.

Prisoning for "security" in the cloud

Being lucky, "stop the slap"

Short after a new smart cloud platform deployed by a certain enterprise was launched, a large number of overseas IPs illegally exceeded their authority access, and they were suspected of being attacked by overseas networks. The national security agency found that the cloud platform was developed by a third-party company. After the platform was delivered, in order to facilitate remote maintenance, the third-party company privately mapped the cloud platform's database port to the outside and directly exposed it to the Internet. Before the cloud platform was launched, the company did not conduct security testing or check for technical vulnerabilities. Overseas spy intelligence agencies illegally control and steal data from cloud platforms through vulnerability attacks, including enterprise production information, engineering project information and customer service information, which not only causes harm to the safe and stable operation of the enterprise's own network system, but also poses a security threat to many customer units.

National Security Agency reminds

Network operation and maintenance security is an important part of ensuring network security and data security. All units, especially core confidential units, should effectively improve their attention to network operation and maintenance security and security prevention capabilities.

· Establish and improve specialized network operation and maintenance security mechanisms. Network operation and maintenance security should be regarded as an important part of network information construction, and it should be planned, deployed and implemented with information construction, and a security management system that is compatible with the level of information construction of the unit and the situation facing the enemy. All units should designate special leaders to be responsible, equip necessary professional and technical personnel to manage, supervise operation and maintenance service outsourcing, regularly assess service quality, promptly investigate, effectively prevent risks and hidden dangers, avoid "full outsourcing", be "hands-off managers", and "ignoring and feelingless" of abnormal situations.

·Strengthen the qualification review of network operation and maintenance agencies and personnel. When hiring external network operation and maintenance agencies and personnel, an operation and maintenance service access system should be established. For institutions and personnel responsible for confidential information system operation and maintenance services and contacting important sensitive data of the unit, they should further strictly review procedures and regularly assess operation and maintenance personnel to ensure that they have the necessary knowledge and ability to engage in network operation and maintenance security work, standardize their operations, eliminate illegal operations, and promptly discover and eliminate loopholes and hidden dangers that affect the safe and stable operation of the network system.

Everyone is responsible for national security. Citizens and organizations should work with the national security organs to prevent and investigate and deal with cyber espionage. For suspected cyber espionage activities found, please promptly report to the local national security organs through the 12339 National Security Agency reporting and acceptance telephone number, the Internet reporting platform (www.12339.gov.cn), and the WeChat official account of the Ministry of Security, or directly report to the local national security organs.

(CCTV reporter Song Feng)