1. ITU-T SG17 Q.3 Telecommunication information security management
An overview Miho Naganuma
Q.3/17 Rapporteur
17 March 2016

2. Network and information security IdM + Cloud computing security
SG17, Security
Study Group 17
WP 1/17
Fundamental security
WP 2/17
Network and information security
WP 3/17
IdM + Cloud computing security
WP 4/17
Application security
WP 5/17
Formal languages
Q1/17
Telecom./ICT security coordination
Q4/17
Cybersecurity
Q8/17
Cloud Computing Security
Q6/17
Ubiquitous services
Q11/17
Directory, PKI, PMI, ODP, ASN.1, OID, OSI
Q2/17
Security architecture and framework
Q5/17
Countering spam
Q10/17
IdM
Q7/17
Applications
Q12/17
Languages + Testing
Q3/17
IS Management
Q9/17
Telebiometrics

3. Addressing security challenges on a global scale
Question 3
The only question for information
“management “ in SG17
Why information security became so important?
What we have to protect ?
What is the aspect of telecommunication organization?
Business continuity
Managing
business assets
Organizational view
Technical view
2/27/2019Geneva, 6-7 December 2010
Addressing security challenges on a global scale

4. What we need to consider?
Organization
Compliance
Incident handling
Assets
Governance
Operations
Human Assets
policies
Communications
Networks
Physical and environment
Business Continuity
Systems
Supplier / External orgs relationship

5. Questions
specific security management issues for telecommunications organizations?
Management issues for small and medium-sized telecom organizations?
Using the existing standards (ITU-T, ISO/IEC and others)?
In cloud computing environment?
personally identifiable information protection?
IPv6 environment?

6. Recommendations X.1051 X.1052 X.1056 Incident mgt X.1054 X.1057
Framework
X.1051
X.1056
Incident mgt
X.1054
Governance
X.1057
Asset mgt
X.1055
Risk mgt
Information technology – Security techniques – Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

7. X.1051
ITU-T X.1051 | ISO/IEC 27011
Revised version will be published soon
“Information technology – Security techniques - Code of practice for Information security controls based on ISO/IEC for telecommunications organizations“
Joint documents with ISO/IEC JTC1 SC27
Controls in ISO/IEC 27002:2013 and telecommunications extended control set

8. Information security controls: 2016
Introduction 1
Scope 2
Normative Reference 3
Definitions and abbreviations 4
Overview 5
Information security policies 6
Organization of information security 7
Human resources security 8
Asset management

9. Information security controls: 20169
Access Controls 10
Cryptography 11
Physical and environmental security 12
Operations security 13
Communications security 14
Systems acquisition, development and maintenance 15
Supplier relationships 16
Information security incident management 17
Information security aspects of business continuity management 18
Compliances

10. Same objectives, controls with ISO/IEC 27002
Structure of controls
8 Asset management (Domain) 8.1 Responsibility for assets (Sub-clause) Objective: To identify organizational assets and define appropriate protection responsibilities Inventory of assets Control Assets associated with information and information processing facilities should be identified and an inventory of these assets should be drawn up and maintained. Implementation guidance The implementation guidance from ISO/IEC applies.
Same objectives, controls with ISO/IEC 27002

11. Structure of controls (cont.)
Telecommunications-specific implementation guidance
When developing and maintaining the inventory
of assets, clear responsibilities between the tele-
communications facilities of the organization and
those of other connected or related telecommuni-
cations organizations should be specified and clearly
documented.
The list of assets should be comprehensive covering
all telecommunications assets of value including
Information assets for network facilities, network
services and applications.
Additional resources can be found in the Bibliography.
Other information
The other information from ISO/IEC applies.
Sector specific guidance and other information (additional)

12. Recommendations -1
Governance of information security (Rec. ITU-T X.1054)
Rec.X.1054
Implementation of Governance Model

13. Recommendations -2 Information Security Management:
Information Security Management System (Recs. ITU-T X.1051, X.1052) Risk management and risk profile guidelines (Rec. ITU-T X.1055)
Security incident management guidelines (Rec. ITU-T X.1056)
Asset management guidelines (Rec. ITU-T X.1057)
Rec. ITU-T X Risk management process
Rec. ITU-T X Information Security Management
Rec. ITU-T X Asset management process

14. Rec. ITU-T X.1056 - Five high-level incident management processes
Recommendations -3
Incident organization and security incident handling: Guidelines for telecommunication organizations (Rec. ITU-T E.409)
Rec. ITU-T E pyramid of events and incidents
Rec. ITU-T X Five high-level incident management processes

15. Management view of IS, CS and PII
Example
PII
Information Security
Cybersecurity

16. Challenges ( )
X.1051rev
X.gpim: Code of practice for personally identifiable information protection (common text with ISO/IEC 29151)
X.sgsm: Information security management guidelines for small and medium telecommunication organizations
X.sup-gpim, Supplement to ITU-T X.gpim Code of practice for PII protection based on X.gpim for telecommunications
X.sup-gisb, Best practice for implementation of X.1054 on governance of infromation security ; Case of Burkina Faso
X. Sup 23, ITU-T X Supplement on security management guidelines for the implementation of an IPv6 environment in telecommunication organizations (Q2/17)
X.1631, Code of practice for information security controls based on ISO/IEC for cloud services (Q8/17)

17. Collaboration with ISO/IEC JTC1 SC27
International Organization for Standardization
International Electrotechnical Commission
JTC1
SC27: Security Technique
WG1
Information Security Management System
WG2
Cryptography and security mechanisms
WG3
Security evaluation, testing and specification
WG4
Security controls and services
WG5
Identity management and privacy technologies
X.gpim
Common documents/Updating related projects
X.1051 X.1631

18. Emerging issues for “cyber resilient” organization
Next Challenge
Not yet confirmed but,
Emerging issues for “cyber resilient” organization
Traditional approach + Cyber approach
and…

19. Thank you Rapporteur: Miho Naganuma
Associate Rapporteur: Kyeong Hee Oh