Secure Hardware and Software Security by Design Updates
This update covers the progress and objectives of Working Group 6, focusing on enhancing the security of hardware and software in public communications networks. The group aims to develop recommendations, best practices, and voluntary mechanisms to ensure the security of core network equipment. Key deliverables include security best practices recommendations and a voluntary attestation framework. Members include industry leaders and organizations committed to improving cybersecurity in the telecommunications sector.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Working Group 6: Secure Hardware and Software Security by Design Status Update December 3, 2015 Joel Molinoff, Co-Chair (CBS) Brian Scarpelli, Co-Chair (Telecommunications Industry Association)
WG 6 Objectives Develop voluntary recommendations and best practices to enhance the security of hardware and software in the core public communications network Develop voluntary mechanisms to demonstrate success of recommendations/best practices 2
WG 6 Deliverables March 2016 Security best practices recommendations September 2016 Recommend voluntary attestation framework 3
WG 6 Members Org CBS* (WG 6 co-chair) TIA* (WG 6 co-chair) IBM Dell Juniper Networks Charter* Verisign* NIST AT&T* CA Technologies CenturyLink* AT&T (ATIS)* Cisco (ATIS)* Gerdenitsch EchoStar* Goeringer Cable Labs Gomi NTT America Hartman CenturyLink* Journoud Oracle Masato Kimura NTT America Darren Kress T-Mobile* Ethan Lucarelli Iridium* (Wiley Rein) FN LN FN LN Org Joel Brian Peter Jon James Kevin Al Jon Chris Jamie Rob Brian Mike Alex Steve Kazu Stacy Franck Molinoff Scarpelli Allor Amis Bean Beaudry Bolivar Boyens Boyer Brown Covolo Daly Geller Jennifer Gabriel Robert Heath Eli Angela Tomofumi Okubo Richard Jeff Glen Kallol Chris Michelle Peter Dorothy Matt Rao Joe Eric Shinichi Manner Martinez Mayer McGinnis Dourado McKay Echostar* DHS US Telecom Association* Verizon* Mercatus Center (GMU) Microsoft Verisign* Shadow Server Symantec Comcast Cable* Comcast Cable* Perlotto Greene Pirrotta Ray Roosenraad TWC* Rosenthal Ruffo Spears-Dean NASNA* Tooley Vasireddy Viens Wenger Yokohama T-Mobile* ZTE USA NCTA* Alcatel-Lucent (TIA)* TWC* Cisco NTT America FN LN Org Steven Emily McKinnon Talaga FCC liaison FCC liaison * Also a CSRIC member 4
Background Recognizing the advantages of building security in to hardware and software (rather than retrofitting), FCC has urged industry to examine security by design practices for core network equipment Examined by FCC Technological Advisory Council (TAC) in 2014 CSRIC IV s WG 4 Final Report, Cybersecurity Risk Management and Best Practices, provides baseline/model for approach 5
WG6 Status Roster continues to reflect a healthy and diverse stakeholder community invested and interested in hardware/software security by design Using a three-phased approach to the development of WG 6 deliverables Holding recurring WG 6 calls on bi-weekly basis 6
WG6 Status Held in-person meeting on Nov 17: Agreed to use NSRA 2012 core network definition Agreed to incorporate both the perspectives of the service providers who have requirements for their vendors, as well as vendors and their secure development life cycle practices used to manage risk 7
WG6 Status Held in-person meeting on Nov 17: Agreed that WG s deliverable should sit at the principle level, and should be technology- and device-neutral Agreed that the deliverable s principles should draw from the existing body of standards and best practices developed for security by design Formed new subgroup to aggregate security-by-design standards and best practices, and to identify common principles for the consideration of the full WG 6, by Dec 14 First conference call for subgroup: Dec 2 8
WG 6 Schedule PHASE 1: Define Objectives, Scope, & Methodology PHASE 2: Analysis & Determine Findings PHASE 3: Conclusions & Recommendations : Deliverable Adopted by Full CSRIC 5 9
Next Steps Augment WG 6 membership with subject matter experts Finalize best practices documentation for review on December 14 Continue bi-weekly conference calls Provide periodic status updates to Steering Committee and Council 10
