Presentation on theme: "Cloud computing security related works in ITU-T SG17"— Presentation transcript:
1 Cloud computing security related works in ITU-T SG17 ITU Workshop on “Cloud Computing Standards - Today and the Future”(Geneva, Switzerland, 14 November 2014)Cloud computing security related works in ITU-T SG17Haihua, LiVice Chief Engineer of Institute of Communication Standards Research of CATR, MIITPPT prepared by Liang Wei(Rapporteur of Q8/17)
2 Contents Cloud computing security related Questions Ongoing work items Cloud computing security Recommendation structureThe contents have two parts, First one is work of ITU-T focus group on cloud computing. The second part is standardization activities in SG17 and SG13.
3 SG17 mandate established by World Telecommunication Standardization Assembly (WTSA-12) WTSA-12 decided the following for Study Group 17:Title: SecurityResponsible for building confidence and security in the use of information and communication technologies (ICTs). This includes studies relating to cybersecurity, security management, countering spam and identity management. It also includes security architecture and framework, protection of personally identifiable information, and security of applications and services for the Internet of things, smart grid, smartphone, IPTV, web services, social network, cloud computing, mobile financial system and telebiometrics. Also responsible for the application of open system communications including directory and object identifiers, and for technical languages, the method for their usage and other issues related to the software aspects of telecommunication systems, and for conformance testing to improve quality of Recommendations.Lead Study Group for:SecurityIdentity managementLanguages and description techniquesResponsible for specific E, F, X and Z series RecommendationsResponsible for 12 Questions
4 SG17 structure WP1：Fundamental security Q1：Telecommunication/ICT security coordinationQ2：Security architecture and frameworkQ3：Telecommunication information security managementWP2：Network and information securityQ4：CybersecurityQ5：Countering spam by technical meansWP3：Identity management and cloud computing securityQ8：Cloud computing securityQ10：Identity management architecture and mechanismsWP4：Application securityQ6：Security aspects of ubiquitous telecommunication servicesQ7：Secure application servicesQ9：TelebiometricsWP5：Formal languagesQ11：Generic technologies to support secure applicationsQ12：Formal languages for telecommunication software and testing
5 SG17 cloud computing security related Questions 1. Security architecture/model and framework2.Security management and audit technology3. BCP/disaster recovery and storage security4.Data and privacy protection5.Account/identity management6.Network monitoring and incidence response7.Network security8.Interoperability security9.Service portabilityQ3/17Q10/17Q4/17Q8/17In SG17, cloud security standardization work is in several questions, including q3, q4, q8, and q10.Q8 is the main question responsible for security…Q3 is mainly responsible forQ10 is主要在Q8ManagementCyberSecurity(Main)cloudIdM/Bio
6 SG17 cloud computing security work items Published inX.1601: Security framework for cloud computingX.cc-control: Information technology – Security techniques – Code of practice for information security controls for cloud computing services based on ISO/IEC 27002X.sfcse: Security functional requirements for SaaS application environmentX.goscc: Guideline of operational security for cloud computinX.Idmcc: Requirement of IdM in cloud computingX.CSCdataSec: Guidelines for cloud service customer data securityCommon text with ISO/IECX.1601:Security Framework for Cloud ComputingX.sfcse:Security functional requirements for SaaS application environmentX.goscc: Guideline of operational security for cloud computingX.idmcc:Requirement of IdM in cloud computingX.cc-control：Code of practice forinformation security controls for cloud computing services based on ISO/IEC 27002For now, there are five work items, they are X.1601, X.cc-control, X.sfcse, X.goscc and X.idmcc.X.1601 was published in January this year.X.cc-control shares common text with ISO/IEC named 27017The left three work items are still on-going.Established work item in SG17 meeting
7 Rec. ITU-T X.1601 Security framework for cloud computing These are the cover and table of contents of X.1601.
8 Rec. ITU-T X.1601 Security framework for cloud computing 7. Security threats for cloud computing8. Security challenges for cloud computing9. Cloud computing security capabilities10. Framework methodologyThe main body of this Recommendation has four parts.Clause 7 security threats for cloud computingClause 8 Security challenges for cloud computingClause 9 cloud computing security capabilitiesClause 0 Framework methodologySecurity threats and security challenges are separated base on US delegates suggestions.Threats refers to Potential cause of an unwanted incident, which may result in harm to a system or organisation.And security challenges refers to a security “difficulty” other than a direct security threat arising from the nature and operating environment of cloud services, including “indirect” threats.
9 Rec. ITU-T X.1601 7. Security threats for cloud computing 7.1 Security threats for cloud service customers (CSCs)Data loss and leakageInsecure service accessInsider threats7.2 Security threats for cloud service providers (CSPs)Unauthorized administration accessInsider threatsSecurity threats are stated from the views of cloud service customers and cloud service providers.
10 Rec. ITU-T X.1601 8. Security challenges for cloud computing 8.1 Security challenges for cloud service customers (CSCs)8.1.1 Ambiguity in responsibility8.1.2 Loss of trust8.1.3 Loss of governance8.1.4 Loss of privacy8.1.5 Service unavailability8.1.6 Cloud service provider lock-in8.1.7 Misappropriation of intellectual property8.1.8 Loss of software integrity8.2 Security challenges for cloud service providers (CSPs)8.2.1 Ambiguity in responsibility8.2.2 Shared environment8.2.3 Inconsistency and conflict of protection mechanisms8.2.4 Jurisdictional conflict8.2.5 Evolutionary risks8.2.6 Bad migration and integration8.2.7 Business discontinuity8.2.8 Cloud service partner lock-in8.2.9 Supply chain vulnerabilitySoftware dependencies8.3 Security challenges for cloud service partners (CSNs)8.3.1 Ambiguity in responsibility8.3.2 Misappropriation of intellectual property8.3.3 Loss of software integritySecurity challenges for cloud computing are stated from the views of CSC, CSP and CSN
11 Rec. ITU-T X.1601 9.Cloud computing security capabilities 9.1 Trust model9.2 Identity and access management (IAM), authentication, authorization, and transaction audit9.3 Physical security9.4 Interface security9.5 Computing virtualization security9.6 Network security9.7 Data isolation, protection and privacy protection9.8 Security coordination9.9 Operational security9.10 Incident management9.11 Disaster recovery9.12 Service security assessment and audit9.13 Interoperability, portability, and reversibility9.14 Supply chain securityBased on the analyse of security threats and security challenges. A series of security capabilities are proposed to mitigate the security risks caused by these identified threats and challenges.For these 14 capabilities, the first one is
12 Rec. ITU-T X.1601 10. Framework methodology Step 1: Use clauses 7 and 8 to identify security threats and security implications of the challenges in the cloud computing service under study.Step 2: Use clause 9 to identify the needed high level security capabilities based on identified threats and challenges which could mitigate security threats and address security challenges.Step 3: Derive security controls, policies and procedures which could provide needed security abilities based on identified security capabilities.For clause 10 Framework methodology, it’s about the thres steps from security threats and challenges to security capabilities, and then to security controls, policies and procedures.
13 Draft Rec. ITU-T X.cc-control Title: Information technology – Security techniques – Code of practice for information security controls for cloud computing services based on ISO/IEC 27002ScopeThis International Standard provides guidelines supporting the implementation of Information security controls for cloud service providers and cloud service customers of cloud computing services. Selection of appropriate controls and the application of the implementation guidance provided will depend on a risk assessment as well as any legal, contractual, or regulatory requirements. ISO/IEC provides information security risk management guidance, including advice on risk assessment, risk treatment, risk acceptance, risk communication, risk monitoring and risk review.Planned determination:For X.cc-control, it also name 27017, the title is “Code of practice for information security controls for cloud computing services based on ISO/IEC 27002”It has the same skeleton as Based on 27002, it adds cloud specific security controls. It’s mainly to provide guidelines supporting the implementation of information security controls for cloud service providers and cloud service customers of cloud computing services.和ISO联合标准：security controlGeneva, Switzerland, 14 November 2014
14 Planned determination:2015-09 Draft Rec. ITU-T X.sfcseTitle：Security functional requirements for SaaS application environmentScopeThis Recommendation mainly focuses on the security aspects of Software as a Service (SaaS) applications at different maturity levels in the telecom cloud computing environment, and specifies security requirements for service oriented SaaS application environment. The target audiences of this Recommendation are cloud service partners such as application developers.Planned determination:
15 Title：Guidelines of operational security for cloud computing Scope Draft Rec. ITU-T X.gosccTitle：Guidelines of operational security for cloud computingScopeThis Recommendation provides guideline of operational security for cloud computing, which includes guidance of SLA and daily security maintenance for cloud computing. The target audiences of this recommendation are cloud service providers, such as traditional telecom operators, ISPs and ICPs.Planned determination:
16 Title:Requirement of IdM in cloud computing Scope Draft Rec. ITU-T X.idmccTitle:Requirement of IdM in cloud computingScopeThis Recommendation provides use-case and requirements analysis giving consideration to the existing industry efforts. This Recommendation concentrates on the requirements for providing IdM as a Service (IdMaaS) in cloud computing. The use of non-cloud IdM in cloud computing, while common in industry, is out of scope for this Recommendation.Planned determination:
17 Draft Rec. ITU-T X.CSCdataSec Title: Guidelines for cloud service customer data securityScopeThis Recommendation will provide guidelines for cloud service customer data security in cloud computing, for those cases where the CSP is responsible for ensuring that the data is handled with proper security. This is not always the case, since for some cloud services the security of the data will be the responsibility of the cloud service customer themselves. In other cases, the responsibility may be mixed.This Recommendation identifies security controls for cloud service customer data that can be used in different stages of the full data lifecycle. These security controls may differ when the security level of the cloud service customer data changes. Therefore, the Recommendation provides guidelines on when each control should be used for best security practice.Planned determination: 2017
18 SG17 cloud computing security Recommendation structure For the future standardization working plan, we have a draft structure which is still under development.It has four layers, overview, security designs, security implementations, best practices and guidelines.For the security design layer, it may includes security requirements, security capabilities, trust model, security architecture, security functions, security controls and so on.For the security implementation layer, it may includes security solutions, security mechanisms, incident management, disaster recovery, security assessment and audit.SG17和SG13：有个标准工作划分，有个基本原则，大部分Q19：报告人ISO：联合