1. CONFIDENTIALITY, INTEGRITY, LEGAL INTERCEPTION
Mr. In-Seop Lee
KT/ITU-T SG 2

2. Importance of Network Security
Background
Explosive growth of computers and network
To protect data and resources
To guarantee the authenticity of data
To protect systems
Security aspects
Security Attacks : An action that compromise the information
Security Mechanism : Design to protect,prevent,recover from attacks
Security Service : Enhance the security of data,systems
ITU-T Workshop on Security - Seoul (Korea), May 2002

3. Relationship between security objectives
Treats
Security
Requirements
Security
services
Security
mechanisms
Security
algorithms
Security
objectives
ITU-T Workshop on Security - Seoul (Korea), May 2002

4. CONCERNS OF I/T EXECUTIVES
Reliability
Complexity of the Transition
Unproven Services
Increased Telecom Costs
Increased Operating Costs
Quality of Management Tools
Security
Lack of Standards
Lack of Applications to Exploit
Other
75%
73%
64%
69%
62%
61%
60%
48% 1%
Source: Information Week.
ITU-T Workshop on Security - Seoul (Korea), May 2002

5. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
SECURITY MODEL
Information
Source
Destination
NORMAL FLOW A B
ITU-T Workshop on Security - Seoul (Korea), May 2002

6. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
SECURITY THREATS
INTERRUPTION A B
INTERCEPTION B A X
AVAILABILITY
CONFIDENTIALITY
MODIFICATION A B X
FABRICATION A B X
INTEGRITY
AUTHENTICITY
ITU-T Workshop on Security - Seoul (Korea), May 2002

7. SECURITY REQUIREMENTS
CONFIDENTIALITY
AUTHENTICATION
INTEGRITY
AVAILABILITY
Communications
& IT
NON-REPUDIATION
ITU-T Workshop on Security - Seoul (Korea), May 2002

8. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
SECURITY SERVICES
Confidentiality
Protection of transmitted data
Authentication
Assuring that communication is authentic
Integrity
Assuring that message has originality
Non-repudiation
Preventing denying message
Access Control
Limit & control the access
Availability
Automated or physical countermeasures
ITU-T Workshop on Security - Seoul (Korea), May 2002

9. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
MODEL FOR NETWORK SECURITY
ITU-T Workshop on Security - Seoul (Korea), May 2002

10. SIX LAYERS OF NETWORK SECURITY
SECURITY AUDITING
SECURITY TOOLS
SOFTWARE
MONITORING
PHYSICAL SECURITY
NETWORK
ADMINISTRATOR
ITU-T Workshop on Security - Seoul (Korea), May 2002

11. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
INTERCEPTION
Interception
Interception of communications occurs where
a private communication between two or more
parties, sent via a communications handling system,
is covertly monitored in order to understand
the content.
Background
In most developed countries,
interception of communications is used by the
law enforcement, security and intelligence agencies
in their work against serious crime and threats to
national security, including terrorism.
ITU-T Workshop on Security - Seoul (Korea), May 2002

12. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
INTERCEPTION
Role
Interception plays a crucial role in helping law
enforcement agencies to combat criminal activity
It is also necessary to protect the human rights,
that is,
disproportionate, or unfettered, use of interception
can have consequences for the rights of
individuals
ITU-T Workshop on Security - Seoul (Korea), May 2002

13. Secure E-Commerce EXAMPLE
Security & Trust
Internet intrinsic
not possess an unique control
world wide
changing traditional “paper-based” transactions
not offering an adequate protection,mechanisms
ITU-T Workshop on Security - Seoul (Korea), May 2002

14. SECURE E-COMMERCE: Security & Trust
For Buyer
& Merchant
Trust
Business & Legal
Relationships
Security
IT Applications
& Systems
Correct Biz
Legal trustworthy
Technical Protections
ITU-T Workshop on Security - Seoul (Korea), May 2002

15. STRUCTURING SOLUTIONS
Trust
Third party
Interactions
Security
Fraud Controls
IT Infrastructure
International Legislation
Insurance
Technology &
Management
Policy
ITU-T Workshop on Security - Seoul (Korea), May 2002

16. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
TECHNICAL SOLUTIONS
Mechanisms
- Verify the Actors’ Identity
- Authorize Access to Resources
- Protect Privacy
- Keep Confident Sensitive Data
Techniques
- Firewall, SSL,VPN, IDS,
- Authentication, Secure Applications
(Web, DBMS, etc.),
IPDR and Click Stream Analysis
Security Policy
ITU-T Workshop on Security - Seoul (Korea), May 2002

17. OPEN PROBLEMS of E-COMMERCE (credibility,efficiency,solvency)
Good’s Quality & Quantity
After-sales assistance
Privacy Safeguard
Buyer’s Solvency
Risk Related to
the Purchase
Business Risk Involved
ITU-T Workshop on Security - Seoul (Korea), May 2002

18. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
TRUST SOLUTIONS
International
Legislation
Customer Profile
check
Payment Methods
assessment
For Merchants
to preserve the merchant public reputation and credibility
to guarantee the payments
to reduce the merchants’ economical losses due to fraudulent orders.
Third Party
Interactions
Insurance
ITU-T Workshop on Security - Seoul (Korea), May 2002

19. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
TRUST SOLUTIONS
International
Legislation
Product
Quality
Product
Delivery
For Buyers
- verification of process control
- process based on information
Third Party
Interactions
Insurance
ITU-T Workshop on Security - Seoul (Korea), May 2002

20. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
RISK MANAGEMENT
Secure E-commerce
Security factors
Trust factor
Risk
Management
strategy
Managing risks
- Scan environments & identify risks
Analyze risks & prioritized
Define the solution
ITU-T Workshop on Security - Seoul (Korea), May 2002

21. ITU-T Workshop on Security - Seoul (Korea), 13-14 May 2002
Conclusions
Security Solutions
Business loss
Threats
Investment costs
Trust Solutions
Thank you very much !!!
ITU-T Workshop on Security - Seoul (Korea), May 2002