Activities of ATIS Cybersecurity Standards Committee

GSC16-GTSC9-10 Document No: ATIS Source: Wayne Zeuch, wzeuch@atis.org Contact: GTSC-9 GSC Session: 4.2 Agenda Item: ATIS Cybersecurity Standards Wayne Zeuch, ATIS Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Highlight of Current Activities (1) GSC16-GRSC9-10 ATIS Packet Technologies and Systems Committee (PTSC) - Completed ATIS-1000034.2010, NGN Security Mechanisms and Procedures Describes the security mechanisms and specifies the suite of options that can be used to fulfill the requirements described in ATIS- 1000029.2008 (NGN Security Requirements). Describes identification, authentication and authorization mechanisms; discusses transport security for signalling, OAM&P and media security; and describes audit-trail-related mechanisms and provisioning. ATIS-1000044.2011, ATIS Identity Management (IdM): Requirements and Use Cases Standard Provides IdM example use cases and requirements for the NGN and its interfaces. IdM functions and capabilities are used to increase confidence in identity information and support and enhance business and security applications including identity-based services. 2 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Highlight of Current Activities (1) GSC16-GRSC9-10 ATIS Packet Technologies and Systems Committee (PTSC) Is Currently Developing a Standard that provides a framework for the design, implementation, and operations of a security architecture by NGN providers, and guidelines for a structured approach and methodology for NGN security planning and operations. Defining security guidelines to support IP Network Interface (INI) to an IP emergency network. Defining the security guidelines for external Data Border Function (DBF) interfaces (UNI, ANI, NNI, SNI). Addressing the necessary requirements and mechanisms in support of Emergency Telecommunications Services (ETS) authentication. 3 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Highlight of Current Activities (2) GSC16-GRSC9-10 PTSC continues to focus on security-related topics that will ensure robust signalling and communications standards and network implementations that will provide adequate protection and support for multimedia and emergency services in the current cybersecurity environment: ETS Authentication Data Border Function Requirements Security Mechanisms Location Identity Management Certificate Management Security architecture is layered, both horizontally and vertically, with border element functions protecting trusted from untrusted domains. 4 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Highlight of Current Activities (3) GSC16-GRSC9-10 PTSC s focus is on specifying security considerations for Layers 1 through 5 for UNIs, NNIs, ANIs, and SNIs Generation of interface requirements will: Attempt to reduce number of available interconnection options, without compromising the desired flexibility in implementing the services, thereby facilitating interoperability Facilitate interconnection negotiations Ensure adequate security will be provided 5 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Highlight of Current Activities (4) GSC16-GRSC9-10 ATIS Telecom Management and Operations Committee (TMOC) TMOC will continue to address Management aspects of security, especially concerning NGN Carrier Interconnection arrangements and VoIP Registry Database Management aspects of security, as driven by the ATIS Board (e.g., TOPS Council or CIO Council) 6 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Strategic Direction GSC16-GRSC9-10 ATIS continues to develop a suite of security authentication and IdM standards that will facilitate secure interconnection of: transport facilities signalling facilities services and applications Cloud computing may pose significant security issues that will need to be addressed, and ATIS committees will continue to collaborate (e.g., PTSC, CSF, etc.) on such matters. 7 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Challenges GSC16-GRSC9-10 SIP security solutions are tailored to be end to end SIP/SIPPING/SIMPLE/etc. RFCs have well written security sections that are not fully implemented in vendor products Security solutions have an impact on delay and performance 8 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Next Steps/Actions GSC16-GRSC9-10 ATIS will continue on its current path of generating a complete suite of standards that can be used to facilitate interconnection negotiations and result in interconnection scenarios that are secure ATIS will continue to collaborate with and provide input into the ITU-T on global solutions for security- and IdM-related matters. 9 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Proposed Resolution GSC16-GRSC9-10 ATIS supports the reaffirmation of the existing Cybersecurity Resolution contained in: Resolution GSC-15/11 Cybersecurity Request that the Resolutions Editor make editorial formatting updates; e.g.: Align bullet formatting Removal of blank items Recognizing #17 Resolves #7 GSC15-CL-16 2 September 2010 RESOLUTION GSC-15/11: (GTSC)Cybersecurity (Revised) The 15th Global Standards Collaboration meeting (Beijing, 30 August 2 September 2010) Recognizing: 1.the crucial importance of the information and communications infrastructure to practically all forms of social and economic activity, and the need for everyone to assume their role in contributing to its security on an ongoing basis; 2.that the legacy Public Switched Telephone Network (PSTN) has a level of inherent security properties because of its hierarchical structure and built-in management systems; 3.that the converged legacy networks and IP networks are therefore potentially more vulnerable to intrusion if adequate care is not taken to integrate security requirements into the planning and design as early as possible; 4.that the type and number of cyber attacks in terms of worms, viruses, malicious intrusions and thrill-seeker intrusions is on the increase; 5.that new cyber attacks such as phishing, pharming, malware distributed via the web, and botnets are emerging and spreading rapidly; 6.that the source of attack or spoofed IP address used by attackers need to be identifiable; 7.that ITU-T Recommendation X.1205 Overview of Cybersecurity provides a definition, description of technologies, and network protection principles; 8.that ITU-T Recommendation X.805 provides a systematic framework for identifying security vulnerabilities that together with many new security-related deliverables from the ITU and the Participating Standards Organizations (PSOs) can assist risk assessment and the development of mechanisms to mitigate the risks; 9.that the ITU-T and ISO/IEC JTC 1 already has a significant body of published materials and ongoing work that is directly relevant to this topic, that needs to be taken into account and integrated; 10.that the UN World Summit on the Information Society identified the ITU as the facilitator and moderator for its Action Line C5 (Building confidence and security in the use of ICTs); 11.that the Global Cybersecurity Agenda (GCA) of the ITU promotes international cooperation aimed at proposing strategies for solutions to enhance confidence and security in the use of ICTs; 12.that the World Telecommunication Standardization Assembly (Johannesburg, 2008) revised WTSA Resolution 50 on Cybersecurity, which underlined the vigorous activity 10 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

GSC16-GRSC9-10 Supplemental Slides 11 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Supplemental Slides GSC16-GRSC9-10 PTSC Issues may be found at: http://www.atis.org/0191/issues.asp PTSC Active Issues which have a security component are: Issue # Title S0060 ATIS NGN Identity Management Mechanisms S0061 Certificate Management S0063 ATIS ETS Authentication S0073 Security Guidelines for DBF Interface S0074 Security Guidelines for Carrier Interconnection (NNI) S0093 NGN Security Planning & Operations Guidelines S0094 Security Guidelines for IP Network Interface (INI) to an Emergency Services Network 12 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All

Supplemental Slides GSC16-GRSC9-10 PRQC Issues may be found at: http://www.atis.org/0010/issues.asp PRQC Active Issues which have a security component are: Issue # Title A0010 User Plane Security Requirements in NGNs A0014 Network-Network Interface (NNI) User Plane Security A0035 Impact of Security on QOS Performance in NGNs A0045 Service-specific Security Mechanism Implementation Options 13 Halifax, 31 Oct 3 Nov 2011 ICT Accessibility For All