ITU-T SG17 Q.3 Telecommunication information security management An overview Miho Naganuma Q.3/17 Rapporteur 17 March 2016

Network and information security IdM + Cloud computing security SG17, Security Study Group 17 WP 1/17 Fundamental security WP 2/17 Network and information security WP 3/17 IdM + Cloud computing security WP 4/17 Application security WP 5/17 Formal languages Q1/17 Telecom./ICT security coordination Q4/17 Cybersecurity Q8/17 Cloud Computing Security Q6/17 Ubiquitous services Q11/17 Directory, PKI, PMI, ODP, ASN.1, OID, OSI Q2/17 Security architecture and framework Q5/17 Countering spam Q10/17 IdM Q7/17 Applications Q12/17 Languages + Testing Q3/17 IS Management Q9/17 Telebiometrics

Addressing security challenges on a global scale Question 3 The only question for information “management “ in SG17 Why information security became so important? What we have to protect ? What is the aspect of telecommunication organization? Business continuity Managing business assets Organizational view Technical view 2/27/2019Geneva, 6-7 December 2010 Addressing security challenges on a global scale

What we need to consider? Organization Compliance Incident handling Assets Governance Operations Human Assets policies Communications Networks Physical and environment Business Continuity Systems Supplier / External orgs relationship

Questions specific security management issues for telecommunications organizations? Management issues for small and medium-sized telecom organizations? Using the existing standards (ITU-T, ISO/IEC and others)? In cloud computing environment? personally identifiable information protection? IPv6 environment?

Recommendations X.1051 X.1052 X.1056 Incident mgt X.1054 X.1057 Framework X.1051 X.1056 Incident mgt X.1054 Governance X.1057 Asset mgt X.1055 Risk mgt Information technology – Security techniques – Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

X.1051 ITU-T X.1051 | ISO/IEC 27011 Revised version will be published soon “Information technology – Security techniques - Code of practice for Information security controls based on ISO/IEC 27002 for telecommunications organizations“ Joint documents with ISO/IEC JTC1 SC27 Controls in ISO/IEC 27002:2013 and telecommunications extended control set

Information security controls: 2016 Introduction 1 Scope 2 Normative Reference 3 Definitions and abbreviations 4 Overview 5 Information security policies 6 Organization of information security 7 Human resources security 8 Asset management

Information security controls: 2016 9 Access Controls 10 Cryptography 11 Physical and environmental security 12 Operations security 13 Communications security 14 Systems acquisition, development and maintenance 15 Supplier relationships 16 Information security incident management 17 Information security aspects of business continuity management 18 Compliances

Same objectives, controls with ISO/IEC 27002 Structure of controls 8 Asset management (Domain) 8.1 Responsibility for assets (Sub-clause) Objective: To identify organizational assets and define appropriate protection responsibilities. 8.1.1 Inventory of assets Control Assets associated with information and information processing facilities should be identified and an inventory of these assets should be drawn up and maintained. Implementation guidance The implementation guidance from ISO/IEC 27002 8.1.1 applies. Same objectives, controls with ISO/IEC 27002

Structure of controls (cont.) Telecommunications-specific implementation guidance When developing and maintaining the inventory of assets, clear responsibilities between the tele- communications facilities of the organization and those of other connected or related telecommuni- cations organizations should be specified and clearly documented. The list of assets should be comprehensive covering all telecommunications assets of value including Information assets for network facilities, network services and applications. Additional resources can be found in the Bibliography. Other information The other information from ISO/IEC 27002 8.1.1 applies. Sector specific guidance and other information (additional)

Recommendations -1 Governance of information security (Rec. ITU-T X.1054) Rec.X.1054 Implementation of Governance Model

Recommendations -2 Information Security Management: Information Security Management System (Recs. ITU-T X.1051, X.1052) Risk management and risk profile guidelines (Rec. ITU-T X.1055) Security incident management guidelines (Rec. ITU-T X.1056) Asset management guidelines (Rec. ITU-T X.1057) Rec. ITU-T X.1055 - Risk management process Rec. ITU-T X.1052 - Information Security Management Rec. ITU-T X.1057 - Asset management process

Rec. ITU-T X.1056 - Five high-level incident management processes Recommendations -3 Incident organization and security incident handling: Guidelines for telecommunication organizations (Rec. ITU-T E.409) Rec. ITU-T E.409 - pyramid of events and incidents Rec. ITU-T X.1056 - Five high-level incident management processes

Management view of IS, CS and PII Example PII Information Security Cybersecurity

Challenges (2014-2016) X.1051rev X.gpim: Code of practice for personally identifiable information protection (common text with ISO/IEC 29151) X.sgsm: Information security management guidelines for small and medium telecommunication organizations X.sup-gpim, Supplement to ITU-T X.gpim Code of practice for PII protection based on X.gpim for telecommunications X.sup-gisb, Best practice for implementation of X.1054 on governance of infromation security ; Case of Burkina Faso X. Sup 23, ITU-T X.1037 - Supplement on security management guidelines for the implementation of an IPv6 environment in telecommunication organizations (Q2/17) X.1631, Code of practice for information security controls based on ISO/IEC 27002 for cloud services (Q8/17)

Collaboration with ISO/IEC JTC1 SC27 International Organization for Standardization International Electrotechnical Commission JTC1 SC27: Security Technique WG1 Information Security Management System WG2 Cryptography and security mechanisms WG3 Security evaluation, testing and specification WG4 Security controls and services WG5 Identity management and privacy technologies X.gpim Common documents/Updating related projects X.1051 X.1631

Emerging issues for “cyber resilient” organization Next Challenge Not yet confirmed but, Emerging issues for “cyber resilient” organization Traditional approach + Cyber approach and…

Thank you Rapporteur: Miho Naganuma Associate Rapporteur: Kyeong Hee Oh