Feeds

China lays out glorious eight-point infosec masterplan

Aims to protect the people and the nation

Choosing a cloud hosting partner with confidence

The Chinese government has released sweeping new information security guidelines designed to enable public and private bodies to protect themselves more effectively against new cyber threats.

The State Council’s long list of recommendations spans just about every conceivable aspect of information security, painting a picture of a nation under siege from attackers and increasingly vulnerable thanks to its reliance on the internet.

It points to the need to better secure “energy, transport, finance and other fields of the national economy” as well as government departments.

On the government side, the guidelines include more auditing, security reporting and monitoring and a pledge to “reduce the number of internet connection points” – presumably to isolate highly classified data on specific machines.

The government also acknowledged the risk to industrial control systems, pledging to “strengthen the protection" of nuclear facilities, aerospace, advanced manufacturing, oil and gas pipelines, power systems, and more.

China also wants to “improve the information security certification and accreditation system”, step-up password protection in e-commerce and e-government, promote the use of “e-signatures” in banking and e-commerce and use strong encryption to protect classified information systems.

In addition, the plans include working towards better information sharing and exchange on cyber security matters, improving emergency response teams, and strengthening and promoting the ranks of information security professionals in the country.

Although short on any detail of exactly how all of this is going to be achieved, as a statement of intent it’s pretty comprehensive and with significant financial and human resources to hand, you can be pretty sure China will meet its goals.

However, throwing more technology at the problem may not be the best way for China to go, according to Kenny Lee, a principal consultant with Verizon Business Asia Pacific.

"Companies simply adopting more layers of technology may lead to false sense of security," he told The Reg.

"Many of today’s malware are undetectable due to increased customisation which renders anti-virus tools less effective. For example, on a case Verizon worked on, we identified a backdoor which was only recognised by one out of 40 AV vendors."

The government's proposals are nothing new, but if anything can be seen as a recognition of the importance of evolving information security strategies in key industries to protect national security and economic advantage.

If nothing else, a more secure China should at least reduce the number of unprotected machines which can be co-opted by cyber criminals.

There's no doubt China is an increasing target of attack for other states and cyber criminals.

Stats revealed in March claimed that attacks from outside the country had infected 8.9 million machines in 2011, up from five million a year earlier.®

Internet Security Threat Report 2014

More from The Register

next story
Bladerunner sequel might actually be good. Harrison Ford is in it
Go ahead, you're all clear, kid... Sorry, wrong film
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Forget Hillary, HP's ex CARLY FIORINA 'wants to be next US Prez'
Former CEO has political ambitions again, according to Washington DC sources
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.