1. 2
OVERVIEW
Cybersecurity initiative launched in July 2015 to create a trusted environment to address Cybersecurity -- Focus on the security needs of operators
Phase 1 completed early 2016
Phase 2 underway

2. 3
PHASE 1: Overview
Develop Application Tools and Share Standards for Use in Complex Organizations
NIST Framework Application
Focus on Tools and Processes to enable effective Cybersecurity Risk Management
Cybersecurity Risk Mgmt. Toolkit
Emerging Threat Analysis
Characterize Emerging Threats and Identify Tools to Address Them

3. PHASE 1: NIST Framework Application Tools4
PHASE 1: NIST Framework Application Tools
Telecom Industry Best Practices and Standards for Framework Core Elements
Application in large organizations with complex supply chains
Target Profile impacts as movement to SDN, NFV, Cloud Architectures occurs, etc.

4. PHASE 1: Emerging Threats Analysis5
PHASE 1: Emerging Threats Analysis
SDN/NFV Based Networks/End-User Controlled Networks
Back-office and IT infrastructure attacks
Specific IoT and M2M Threats

5. NIST FRAMEWORK RFI: ATIS Response6
NIST FRAMEWORK RFI: ATIS Response
RFI Purpose – NIST seeking comments on:
Effectiveness of Version 1 Framework
Suggestions for improvement of the Framework
Options for longer-term ownership
Key points of response include:
Current Version 1 Framework is effective for ICT sector; should remain voluntary
Standardization of measurements is discouraged -- would discourage ICT companies from enhancing use of the Framework and associated company process specific metrics
Encouraged NIST to retain long-term ownership of the Framework
Recommended removing profile related elements as their application is highly company specific

6. CYBERSECURITY PHASE 2 “Architect and Design for Security” toolkit:7
CYBERSECURITY PHASE 2
“Architect and Design for Security” toolkit:
Standards, practices and other recommendations to assist in development of secure solutions include SDN/NFV and Cloud
Create an Information Sharing and Analysis Center (ISAC) Forum roadmap for ICT; survey existing ISAC fora relative to coverage of emerging threats

7. ARCHITECT AND DESIGN FOR SECURITY: Threat Modelling8
ARCHITECT AND DESIGN FOR SECURITY: Threat Modelling
Development processes can wait until the end of the development cycle to address security. Try to test security flaws out.
At the end, we see if security requirements are satisfied.
With Architectural Risk Analysis applied early in the development cycle, we begin to design security into the product.
At the beginning, we intentionally aim for strong security.
Did we hit anything?
Aiming for the right target

8. 9
COMMUNICATION
Balance value of information dissemination with sensitivities
Information management processes established
Enable broader external publication and use of group’s output with selective protection of sensitive elements.
Planning to target portion of Phase 2 work for external publication
Maintain trusted and active environment to address cybersecurity