ITU-T SG17 Q.3
Telecommunication information
security management
An overview
Miho Naganuma
Q.3/17 Rapporteur
17 March 2016
SG17, Security
Study Group 17
WP 1/17
WP 2/17
WP 3/17
WP 4/17
WP 5/17
Fundamental
security
Network and
information
security
IdM + Cloud
computing
security
Application
security
Formal
languages
Q1/17
Q4/17
Q8/17
Q6/17
Q11/17
Telecom./ICT
security
coordination
Cybersecurity
Cloud
Computing
Security
Ubiquitous
services
Directory,
PKI, PMI,
ODP, ASN.1,
OID, OSI
Q2/17
Q5/17
Q10/17
Q7/17
Q12/17
Security
architecture and
framework
Countering spam
IdM
Applications
Languages +
Testing
Q3/17
Q9/17
IS Management
Telebiometrics
2/93
Question 3
The only question for information
“management “ in SG17
•Why information security became so important?
•What we have to protect ?
•What is the aspect of telecommunication
organization?
Managing
business assets
5/30/2016Geneva, 6-7 December
Addressing security challenges on a global scale
2010
Business continuity
Organizational view
Technical view
3
What we need to consider?
Organization
Compliance
Incident
handling
Assets
Governance
Operations
Human Assets
policies
Communications
Networks
Physical and
environment
Business
Continuity
Systems
Supplier / External
orgs relationship
Questions
• specific security management issues for
telecommunications organizations?
• Management issues for small and mediumsized telecom organizations?
• Using the existing standards (ITU-T, ISO/IEC
and others)?
• In cloud computing environment?
• personally identifiable information
protection?
• IPv6 environment?
Recommendations
Information technology – Security techniques
– Information security management
guidelines for telecommunications
organizations based on ISO/IEC 27002
X.1051
• ITU-T X.1051 | ISO/IEC 27011
• Revised version will be published soon
“Information technology – Security techniques
- Code of practice for Information security
controls based on ISO/IEC 27002 for
telecommunications organizations“
• Joint documents with ISO/IEC JTC1 SC27
• Controls in ISO/IEC 27002:2013 and
telecommunications extended control set
Information security controls: 2016
0
Introduction
1
Scope
2
Normative Reference
3
Definitions and abbreviations
4
Overview
5
Information security policies
6
Organization of information security
7
Human resources security
8
Asset management
Information security controls: 2016
9
10
11
12
13
14
15
16
17
18
Access Controls
Cryptography
Physical and environmental security
Operations security
Communications security
Systems acquisition, development and maintenance
Supplier relationships
Information security incident management
Information security aspects of business continuity
management
Compliances
Structure of controls
8
Asset management (Domain)
8.1 Responsibility for assets (Sub-clause)
Objective: To identify organizational assets and define
appropriate protection responsibilities.
Same objectives,
8.1.1 Inventory of assets
controls with
Control
ISO/IEC 27002
Assets associated with information and information
processing facilities should be identified and an inventory of
these assets should be drawn up and maintained.
Implementation guidance
The implementation guidance from ISO/IEC 27002 8.1.1
applies.
Structure of controls (cont.)
Telecommunications-specific implementation guidance
When developing and maintaining the inventory
of assets, clear responsibilities between the telecommunications facilities of the organization and
those of other connected or related telecommunications organizations should be specified and clearly
documented.
The list of assets should be comprehensive covering
all telecommunications assets of value including
Information assets for network facilities, network
services and applications.
Additional resources can be found in the Bibliography.
Other information
The other information from ISO/IEC 27002 8.1.1 applies.
Sector specific
guidance and
other
information
(additional)
Recommendations -1
 Governance of information security
(Rec. ITU-T X.1054)
Rec.X.1054
Implementation
of Governance
Model
Recommendations -2
 Information Security Management:

Information Security Management System
(Recs. ITU-T X.1051, X.1052) Risk management and
risk profile guidelines
(Rec. ITU-T X.1055)

Security incident management guidelines
(Rec. ITU-T X.1056)

Asset management guidelines (Rec. ITU-T X.1057)
Rec. ITU-T X.1052 - Information
Security Management
Rec. ITU-T X.1055 - Risk
management process
Rec. ITU-T X.1057 - Asset
management process
Recommendations -3
 Incident organization and security incident handling:
Guidelines for telecommunication organizations (Rec. ITU-T
E.409)
Rec. ITU-T E.409 - pyramid of events and incidents
Rec. ITU-T X.1056 - Five high-level
incident management processes
Management view of IS, CS and PII
Example
PII
Information
Security
Cybersecurity
Challenges (2014-2016)
• X.1051rev
• X.gpim: Code of practice for personally identifiable
information protection (common text with ISO/IEC 29151)
• X.sgsm: Information security management guidelines for small
and medium telecommunication organizations
• X.sup-gpim, Supplement to ITU-T X.gpim Code of practice for
PII protection based on X.gpim for telecommunications
• X.sup-gisb, Best practice for implementation of X.1054 on
governance of infromation security ; Case of Burkina Faso
• X. Sup 23, ITU-T X.1037 - Supplement on security
management guidelines for the implementation of an IPv6
environment in telecommunication organizations (Q2/17)
• X.1631, Code of practice for information security controls
based on ISO/IEC 27002 for cloud services (Q8/17)
Collaboration with ISO/IEC JTC1 SC27
International
Organization for
Standardization
International
Electrotechnical
Commission
JTC1
SC27: Security Technique
WG1
Information
Security
Management
System
X.1051
X.1631
WG2
Cryptography
and security
mechanisms
WG3
Security
evaluation,
testing and
specification
WG4
Security
controls and
services
Common documents/Updating related projects
WG5
Identity
management
and privacy
technologies
X.gpim
Next Challenge
• Not yet confirmed but,
–Emerging issues for “cyber resilient”
organization
–Traditional approach + Cyber approach
and…
Thank you
Rapporteur: Miho Naganuma
Associate Rapporteur: Kyeong Hee Oh