ICS 35.240 L67 YD 中 华 人 民 共 和 国 通 信 行 业 标 准 YD/T [×××××]—[××××] [代替 YD/T] 交互式应用程序安全测试工具能力要求 Capability Requirements of Interactive Application Security Testing Tools [点击此处添加与国际标准一致性程度的标识] （征求意见稿） 2021.03.11 [××××]-[××]-[××]发布 [××××]-[××]-[××]实施 中华人民共和国工业和信息化部 发 布 YD/T ×××××—×××× 目 次 前 言 ..............................................................................................................................................................III 引 言 ............................................................................................................................................................. IV 1 范围 ............................................................................................................................................................1 2 规范性引用文件 ........................................................................................................................................1 3 术语和定义 ................................................................................................................................................1 4 缩略语 ........................................................................................................................................................1 5 检测分析能力要求 ....................................................................................................................................2 5.1 支持的编程语言................................................................................................................................2 5.2 支持的中间件、库及开发框架类型................................................................................................2 5.3 支持的检测方式................................................................................................................................2 5.4 支持的安全风险漏洞类型................................................................................................................2 5.5 检测分析类型要求............................................................................................................................3 5.6 检测分析性能要求............................................................................................................................3 5.7 漏报率要求 .......................................................................................................................................3 5.8 误报率要求 .......................................................................................................................................3 6 工具灵活性能力要求 ................................................................................................................................4 6.1 检测分析配置能力要求....................................................................................................................4 6.2 使用模式 ...........................................................................................................................................4 6.3 告警能力要求 ...................................................................................................................................4 6.4 网络环境调试 ...................................................................................................................................4 6.5 性能熔断配置 ...................................................................................................................................4 7 分析辅助能力要求 ....................................................................................................................................4 7.1 支持缺陷快速定位............................................................................................................................4 7.2 支持任务的集中管理与展示............................................................................................................5 7.3 支持缺陷数据的多维度统计及展示................................................................................................5 7.4 支持结果的对比分析........................................................................................................................5 7.5 提供缺陷的修复指导........................................................................................................................5 7.6 报表展示要求 ...................................................................................................................................6 7.7 权限控制及审计能力要求................................................................................................................6 8 开发流程嵌入能力要求 ..................................................................