ITU-T SG17 Q.3 Telecommunication information security management An overview Miho Naganuma Q.3/17 Rapporteur 17 March 2016

SG17, Security 2/93 Study Group 17 WP 1/17 Fundamental security WP 2/17 Network and information security WP 3/17 IdM + Cloud computing security WP 4/17 Application security WP 5/17 Formal languages Q6/17 Ubiquitous services Q7/17 Applications Q9/17 Telebiometrics Q12/17 Languages + Testing Q1/17 Telecom./ICT security coordination Q2/17 Security architecture and framework Q3/17 IS Management Q4/17 Cybersecurity Q5/17 Countering spam Q8/17 Cloud Computing Security Q10/17 IdM Q11/17 Directory, PKI, PMI, ODP, ASN.1, OID, OSI

Question 3 The only question for information “management “ in SG17 Why information security became so important? What we have to protect ? What is the aspect of telecommunication organization? 3 Addressing security challenges on a global scale 7/10/2016Geneva, 6-7 December 2010 Managing business assets Business continuity Organizational view Technical view

What we need to consider? policies Organization Physical and environment Human Assets Assets Operations Communications Networks Communications Networks Systems Supplier / External orgs relationship Compliance Incident handling Business Continuity Governance

Questions specific security management issues for telecommunications organizations? Management issues for small and medium- sized telecom organizations? Using the existing standards (ITU-T, ISO/IEC and others)? In cloud computing environment? personally identifiable information protection? IPv6 environment?

Recommendations Information technology – Security techniques – Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

X.1051 ITU-T X.1051 | ISO/IEC Revised version will be published soon “Information technology – Security techniques - Code of practice for Information security controls based on ISO/IEC for telecommunications organizations“ Joint documents with ISO/IEC JTC1 SC27 Controls in ISO/IEC 27002:2013 and telecommunications extended control set

Information security controls: 2016

Structure of controls 8Asset management (Domain) 8.1Responsibility for assets (Sub-clause) Objective: To identify organizational assets and define appropriate protection responsibilities Inventory of assets Control Assets associated with information and information processing facilities should be identified and an inventory of these assets should be drawn up and maintained. Implementation guidance The implementation guidance from ISO/IEC applies. Same objectives, controls with ISO/IEC 27002

Structure of controls (cont.) Telecommunications-specific implementation guidance When developing and maintaining the inventory of assets, clear responsibilities between the tele- communications facilities of the organization and those of other connected or related telecommuni- cations organizations should be specified and clearly documented. The list of assets should be comprehensive covering all telecommunications assets of value including Information assets for network facilities, network services and applications. Additional resources can be found in the Bibliography. Other information The other information from ISO/IEC applies. Sector specific guidance and other information (additional)

Recommendations -1  Governance of information security (Rec. ITU-T X.1054)Rec. ITU-T X.1054 Rec.X.1054 Implementation of Governance Model

Recommendations -2  Information Security Management:  Information Security Management System (Recs. ITU-T X.1051, X.1052) Risk management and risk profile guidelines (Rec. ITU-T X.1055)X.1051X.1052Rec. ITU-T X.1055  Security incident management guidelines (Rec. ITU-T X.1056)Rec. ITU-T X.1056  Asset management guidelines (Rec. ITU-T X.1057)Rec. ITU-T X.1057 Rec. ITU-T X Asset management process Rec. ITU-T X Information Security Management Rec. ITU-T X Risk management process

Recommendations -3  Incident organization and security incident handling: Guidelines for telecommunication organizations (Rec. ITU-T E.409)Rec. ITU-T E.409 Rec. ITU-T E pyramid of events and incidents Rec. ITU-T X Five high-level incident management processes

Management view of IS, CS and PII Information Security PII Cybersecurity Example

Challenges ( ) X.1051rev X.gpim: Code of practice for personally identifiable information protection (common text with ISO/IEC 29151) X.sgsm: Information security management guidelines for small and medium telecommunication organizations X.sup-gpim, Supplement to ITU-T X.gpim Code of practice for PII protection based on X.gpim for telecommunications X.sup-gisb, Best practice for implementation of X.1054 on governance of infromation security ; Case of Burkina Faso X. Sup 23, ITU-T X Supplement on security management guidelines for the implementation of an IPv6 environment in telecommunication organizations (Q2/17) X.1631, Code of practice for information security controls based on ISO/IEC for cloud services (Q8/17)

Collaboration with ISO/IEC JTC1 SC27 International Organization for Standardization International Electrotechnical Commission JTC1 SC27: Security Technique WG1 Information Security Management System WG1 Information Security Management System WG2 Cryptography and security mechanisms WG2 Cryptography and security mechanisms WG3 Security evaluation, testing and specification WG3 Security evaluation, testing and specification WG4 Security controls and services WG4 Security controls and services WG5 Identity management and privacy technologies WG5 Identity management and privacy technologies X.1051 X.1631 X.gpim Common documents/Updating related projects

Next Challenge Not yet confirmed but, – Emerging issues for “cyber resilient” organization – Traditional approach + Cyber approach and…

Thank you Rapporteur: Miho Naganuma Associate Rapporteur: Kyeong Hee Oh