International Telecommunication Union ITU-T Seminar – Lisbon, 25 June 2002 ITU-T Activities on Security Greg Jones ITU Telecommunication Standardization Sector (ITU-T)

ITU-T 2 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 ITU-T Study Groups o SG 2 Operational aspects of service provision, networks and performance o SG 3 Tariff and accounting principles including related telecommunications economic and policy issues o SG 4 Telecommunication management, including TMN o SG 5 Protection against electromagnetic environment effects o SG 6 Outside plant o SG 9 Integrated broadband cable networks and television and sound transmission o SG 11 Signalling requirements and protocols o SG 12 End-to-end transmission performance of networks and terminals o SG 13 Multi-protocol and IP-based networks and their internetworking o SG 15 Optical and other transport networks o SG 16 Multimedia services, systems and terminals o SG17 Data networks and software for Telecommunication o SSG Special Study Group "IMT-2000 and beyond" o TSAG Telecommunication Standardization Advisory Group

ITU-T 3 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Lead Study Groups o SG 2Service definition, numbering and routing o SG 4 TMN o SG 9Integrated broadband cable and television networks o SG 11Intelligent networks o SG 12Quality of Service and performance o SG 13IP related matters, B-ISDN, Global Information Infrastructure and satellite matters o SG 15Access network transport and optical technology o SG 16Multimedia services, systems and terminals and on e-business and e-commerce o SG17Communication system security, frame relay, languages and description techniques o SSGIMT 2000 and beyond and for mobility

ITU-T 4 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Communication system security o WTSA & TSAG Request to all study groups to coordinate on telecommunication reliability and security o SG 17 – Coordination of ITU-T security studies X.509, X.842, X.843 o SG 16 – Multimedia services ETS – Emergency Telecommunication Services o SG 13 – Network reliability Network requirements and capabilities to support emergency services o SG 2 – Service aspects Security requirements and incident handling

ITU-T 5 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 ITU-T SG 17 security focus o Authentication (X.509/X.842/X.843) Public Key Infrastructure o Security Management Risk assessment, identification of assets and implementation characteristics o Telebiometrics Telebiometric methods, devices and solutions for security purposes o Mobile Security For low power, small memory size and small display devices

ITU-T 6 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Key studies in ITU-T SG 16 o Question G - Multimedia Security o Secure H.323-based IP Telephony o H.235 and associated security profiles o H.248 Media Gateway Decomposition Security o Secure H.320 Audio/Video and T.120 Data Conferencing o Emergency Telecommunications Services

ITU-T 7 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Key studies in ITU-T SG 9 o IPCablecom project Interactive services over cable TV networks using IP protocol ITU-T Rec. J.170 IPCablecom security specification Types of threat in IPCablecom: Network attacks Theft of service Eavesdropping Denial of Service

ITU-T 8 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Other studies in SG 2 and 13 o Draft new ITU-T Rec. E.sec.1 (SG 2) Telecommunication networks security requirements o Draft new ITU-T Rec. E.sec.2 (SG 2) Incident Organisation and Security Incident Handling (Guidelines) Guidelines on threats and countermeasures o Draft new ITU-T Rec. Y.roec (SG 13) Network reliability

ITU-T 9 25 June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Special Projects o IMT-2000 Network Aspects (SSG) o Call Back (SG 3) o Accounting Rate Reform (SG 3) o TMN (SG 4) o IP Cablecom (SG 9) o Quality of service and performance (SG 12) o IP (SG 13) o Global Information Infrastructure (SG 13) o Access Networks (SG 15) o Optical Networks (SG 15) o Mediacom 2004 (SG 16) o JVT – Joint Video Team (SG 16) o E-commerce and E-business (SG 16) o ASN.1 & Language coordination (SG 17) o Communication system security (SG 17)

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Key products o Catalogue of ITU-T security Recommendations (see t/com17/activity/cat003_ww9.doc) t/com17/activity/cat003_ww9.doc o Compendium of security terms (see t/com17/activity/def003.html) t/com17/activity/def003.html

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 security definitions o Example: Definitions of public-key /X.509 (In a public key cryptosystem) that key of a users key pair which is publicly known /X.810 A key that is used with an asymmetric cryptographic algorithm and that can be made publicly available. (See itu.int/ITU-T/studygroups/com17/cssecurity.html)itu.int/ITU-T/studygroups/com17/cssecurity.html

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Recommendations related to communication systems security o Example: ITU-T Rec. X.509 Information technology - Open Systems Interconnection - The directory: Public-key and attribute certificate frameworks (03/00 – version 4) This Recommendation defines a framework for public-key certificates and attribute certificates… Uses Abstract Syntax Notation 1 (ASN.1) (See itu.int/ITU-T/studygroups/com17/cssecurity.html)itu.int/ITU-T/studygroups/com17/cssecurity.html

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 ITU-T publications o Recommendations o WTSA Resolutions o Appendices o Supplements o Handbooks o Directives o ITU Operational Bulletin

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Worshops and seminars planned o IPv6 Geneva, 6 May 2002 o Security Seoul, Republic of Korea, May 2002 o IMT-2000 and Systems Beyond Ottawa, Canada, 28 May 2002 o IP/Optical Chitose, Japan, 9-11 July 2002 o Workshop on Use of Description Techniques Geneva, 23 November 2002 o Role of Satellites in IP-based and Multimedia Networks and Services Geneva, 9-11 December 2002

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Seoul, May 2002 o ITU-T Workshop on Security May 2002 o Security World Expo May 2002 ( o ITU workshop - Creating trust in critical network Infrastructures May 2002

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Cooperation o A.4 – Communication with forums/consortia o A.5 – Organizations qualified for referencing o A.6 – Communication with SDOs o MoUs MoU ICANN Protocol Supporting Organization, 14 July 1999 MoU between IEC, ISO, ITU and UN/ECE Concerning Standardization in the Field of Electronic Business, 24 March 2000 MoU between ITU and ETSI, 14 June 2000 o Informal Forum summit o ITU-T and Forums web page

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Security collaboration o ISO/IEC JTC1 SC 6 & SC 27 o IETF o OASIS

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Freely accessible web resources o ITU-T patent database o International numbering resources o A.4, A.5 and A.6 recognized organizations o Terms and definitions o List of ITU-T Recommendations o ITU-T Work programme o ASN.1 module database – new

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 ITU-T Databases on ITU-T website o ASN.1 Module Database o ITU-T Patents Database o International Numbering Resources o Recognized SDOs for Recs. A.4, A.5 & A.6 o Terms & Definitions Database o List of ITU-T Recommendations o ITU-T Work Programme Database ITU-T Work Programme Database Search Standardization Areas, Domains and their Codes

ITU-T June 2002 ITU-T Seminar – Lisbon, 25 June 2002 Ensuring global interoperability o Quality of Service (QOS) o Numbering and routing o Communication Systems Security o Tariffs and Accounting rates o Interworking

International Telecommunication Union ITU-T Seminar – Lisbon, 25 June 2002 Thank You! ITU-T Contacts: ITU-T Communication & promotion: Greg Jones - Vladimir Androuchko - ITU-T Study Group 17 Secretariat: Georges Sebek –