1. Working Group 6: Secure Hardware and Software – Security by Design Status Update September 21, 2015 Joel Molinoff, Co-Chair (CBS) Brian Scarpelli, Co-Chair (Telecommunications Industry Association)

2. 2 WG 6 Objectives Develop voluntary recommendations and best practices to enhance the security of hardware and software in the core public communications network Develop voluntary mechanisms to demonstrate success of recommendations/best practices

3. 3 WG 6 Deliverables March 2016 – Security best practices recommendations September 2016 – Recommend voluntary attestation framework

4. 4 WG 6 Members * Also a CSRIC member FNLNOrg JoelMolinoffCBS* (WG 6 co-chair) BrianScarpelliTIA* (WG 6 co-chair) PeterAllorIBM JonAmisDell JamesBeanJuniper Networks KevinBeaudryCharter* AlBolivarVerisign* JonBoyens NIST ChrisBoyerAT&T* JamieBrownCA Technologies RobCovoloCenturyLink* BrianDalyAT&T (ATIS)* MikeGellerCisco (ATIS)* AlexGerdenitschEchoStar* SteveGoeringerCable Labs KazuGomiNTT America StacyHartmanCenturyLink* FranckJournoudOracle MasatoKimuraNTT America DarrenKressT-Mobile* EthanLucarelliIridium* (Wiley Rein) FNLNOrg JenniferManner Echostar* GabrielMartinez DHS RobertMayer US Telecom Association* HeathMcGinnis Verizon* EliDourado Mercatus Center (GMU) AngelaMcKayMicrosoft TomofumiOkuboVerisign* RichardPerlottoShadow Server JeffGreeneSymantec GlenPirrottaComcast Cable* KallolRayComcast Cable* ChrisRoosenraadTWC* MichelleRosenthalT-Mobile* PeterRuffoZTE USA DorothySpears-DeanNASNA* MattTooleyNCTA* RaoVasireddyAlcatel-Lucent (TIA)* JoeViensTWC* EricWengerCisco ShinichiYokohamaNTT America FNLNOrg StevenMcKinnon FCC liaison EmilyTalaga FCC liaison

5. 5 Background Recognizing the advantages of building security in to hardware and software (rather than retrofitting), FCC has urged industry to examine security by design practices for core network equipment – Examined by FCC Technological Advisory Council (TAC) in 2014 CSRIC IV’s WG 4 Final Report, Cybersecurity Risk Management and Best Practices, provides baseline/model for approach

6. 6 WG 6 held a kickoff conference call on 9/16/15 Roster reflects a healthy and diverse stakeholder community invested and interested in hardware/software security by design WG 6 has agreed to a three-phased approach to the development of WG 6 deliverables – WG 6 has formed a subgroup to address objectives, scope and methodology for 1 st deliverable WG6 Status

7. 7 WG 6 Schedule PHASE 1: Define Objectives, Scope, & Methodology PHASE 2: Analysis & Determine Findings PHASE 3: Conclusions & Recommendations : Deliverable Adopted by Full CSRIC 5

8. 8 Next Steps Build/finalize WG 6 membership Continue to develop a work plan to accomplish the CSRIC V charge, taking advantage of WG 6 members’ subject matter expertise Seek WG 6 volunteers to lead aspects of the work plan Continue bi-weekly conference calls Provide periodic status updates to Steering Committee and Council