1. Security in MTS 14th May2013 SIG Report
Fraunhofer FOKUS

2. Agenda (14.5.)
4 Participants: I. Bryant, A. Takanen, P. Schmitting, A. Rennoch, (supported by E. Chaulot-Talmon)
ISO SC27 & ETSI Security workshop presentation 26th April
Idea: MTS & SC27/WG3 Liaison
TODO: send request (with current working documents)
Discussion of draft document

3. SC27 WG3 liaison (to be decided)
ISO/IEC Test requirements for cryptographic modules
ISO/IEC 30127: Detailing software penetration testing under ISO/IEC and ISO/IEC vulnerability analysis
ISO/IEC TR Refining software vulnerability analysis under ISO/IEC and ISO/IEC 18045
for ETSI (Terminology)
for ETSI (Security guidelines)
WG3 is interested in ETSI (case studies)

4. SC27 WG4 liaison (to be decided)
ISO/IEC Application security validation
for ETSI (Security guidelines)

5. WI status and schedules
Terminology and Concepts (Ari):
3rd draft (word document) considered comments and updates
-> need to be reviewed (CTI or E2NA)
Case studies (Ari/Jürgen): 
Plan: early draft with two case studies (Diamonds)
2-3 more case studies expected September (from Diamonds and Spacios)

6. WI status and schedules
Design guide V&V (Scott/Ian):
-> new draft available with new input from Ian and Scott (still early draft)
Plan: stable draft and review in September.
Security Testing Methodology (Scott):
Plan: results to be integrated in V&V

7. „Terminology“ (3rd draft)
3 Definitions, symbols and abbreviations
4 Introduction to security testing
4.1 Types of security testing
4.2 Penetration testing tools
4.3 Test verdicts in security testing
5 Security test requirements
6 Functional security testing
7 Performance testing for security
8 Fuzz testing
9 Security Testing activities mapped to SDLC

8. „Case studies“ (1st draft)
Project case studies from:
DIAMONDS project
G&D Banking (available)
Accurate (available)
Radio
Automotive
More?
SPACIOS project
tbd

9. „Case studies“ (1st draft)
For each of the case studies a similar structure of the description is planned. It will consist of the following parts:
Characteriazation
Background (challenges)
System under Test
Risk Analysis
Security Testing Approaches
Applied approaches
Comparison with SoA tools/techniques
Results so far
Expectations
Test Results
Exploitation (value of techniques)

10. Next steps Jürgen/Peter: complete Diamonds case study input
Ari/Peter: Invite E2NA and CTI to review Terminology & Concepts (after stable draft) ???
Ian/Scott: provide stable draft for September
MTS: request formal liaison with ISO SC27/WG3&4
Next SIG meetings
Discussion of current drafts in MTS#59
No SIG meeting planned (only if new drafts available)