SECURITY SIG IN MTS Fraunhofer FOKUS Tallinn 4

SECURITY SIG IN MTS Fraunhofer FOKUS Tallinn, 4 -5 October 2011

Contents Motivation Planned output ETSI work – TVRA framework Next steps & perspectives 2 Security SIG in MTS, 4 -5 October 2011

Security Standardization bodies International, e. g. ISO, ITU European, e. g. ETSI, ENISA National, e. g. NIST, AFNOR, DIN Industrial communities, e. g. IEEE, OMG 3 Security SIG in MTS, 4 -5 October 2011

Terminology (1): Standards The Common Criteria for Information Technology Security Evaluation (CC) is the driving force for the widest available mutual recognition of secure IT products. This web portal is available to support the information on the status of the CCRA, the CC and the certification schemes, licensed laboratories, certified products and related information, news and events. The ISO 27000 series of standards have been specifically reserved by ISO for information security matters. This of course, aligns with a number of other topics, including ISO 9000 (quality management) and ISO 14000 (environmental management). 4 Security SIG in MTS, 4 -5 October 2011

Terminology (2): Recommondations RFC 2828 (191 pages of definitions and 13 pages of references) provides abbreviations, explanations, and recommendations for use of information system security terminology. OUSPG/Codenomicon Glossary of Vulnerability Testing https: //www. ee. oulu. fi/research/ouspg/Glossary Threat modeling framework (Trike): http: //www. netsecurity. org/dl/articles/Trike_v 1_Methodology_Documentdraft. pdf ETSI ISG on Security indicators (ISI) starting with R 2 GS Club terminology … 5 Security SIG in MTS, 4 -5 October 2011

Sample terms Asset: • Anything that has value to the organization (27000). • Entities that the owner of the TOE presumably places value upon (CC). Data, or occasionally a physical object, which is featured in the business Rules of the System. Attack: • Attempt to destroy, expose, alter, disable, steal or gain unauthorized • access to or make unauthorized use of an asset (27000). A task which, if it worked, would help accomplish a threat (Trike). … Control, Continuous Checking, Information Security Risk, Incident, Resilience, Security Event, Security Objective, Security level, … 6 Security SIG in MTS, 4 -5 October 2011

Case studies experiences Industrial approaches validated in industry lead case studies, coming from ETSI members, e. g. : ITEA DIAMONDS project case studies: Smart Cards Industrial Automation Radio Protocols Transport/Automotive Telecommunication 7 Security SIG in MTS, 4 -5 October 2011

TVRA framework - objectives TVRA is a method for use by ETSI standards developers undertaking an analysis of the threats, risks and vulnerabilities of a telecommunications system. Builds from (and complements) the Common Criteria (ISO/IEC 15408). 8 Security SIG in MTS, 4 -5 October 2011

TVRA in ETSI technical commitees TISPAN WG 7 (future WG “Risk management” on Privacy and Security technologies? ) • TR 102 165 • part 1, v 4. 2. 3 (2011 -03): method and proforma for TVRA • part 2, v 4. 2. 1 (2007 -02): Protocol Framework Definition; Security Counter Measures • TR 187 002 v 3. 1. 1 (2011 -04): NGN Security • TR 187 014 v 2. 1. 1 (2009 -02): e. Security, user guide to e. TVRA • STF 415 Security support to NGN: smart meter • ITS: TR 102 893 v 1. 1. 1 (2010 -03): Intelligent Transport Systems; Security: TVRA of 5, 9 GHz radio communication in an ITS (vehicle-to-vehicle and vehicle-to-roadside) 9 Security SIG in MTS, 4 -5 October 2011

Next steps Contributions in MTS • Start Special Interest Group (SIG) for “security [testing]” • First meeting 15 th December 2011 in Berlin: http: //webapp. etsi. org/meetingcalendar/Meeting. Details. asp? mid=13464 • NWI TS focusing on security testing terminology (methodology etc. )? • Similar to ongoing performance testing work • NWI TR focusing on security including industrial case studies? • Similar to ETSI TR 103 168 (Application of Model-Based Testing in the Telecoms Domain) Collaboration with INT new work item on Security/Benchmarking test plan (using MSF inputs) Collaboration with TISPAN • TVRA lacks on test methods • Enrichment with (model-based) testing techniques? 10 Security SIG in MTS, 4 -5 October 2011

More Steps & Perspectives Contribution to new ETSI Industrial Specification Group (ISG) on Information Security Indicators (ISI) Transfer to other international committees (e. g. ISO) Øusing PAS (public available specification) criteria to Øinitiate further international NWI (e. g. via DIN) ETSI members support: FOKUS, Conformiq, Testing. Tech, Codenomicon, FSCOM, … 11 Security SIG in MTS, 4 -5 October 2011

Timeline SIG start 2011 ETSI initiatives 2012 2013 ETSI drafts ETSI final ISO input? 12 Security SIG in MTS, 4 -5 October 2011 2014 ISO input?

Thank you! 13 Security SIG in MTS, 4 -5 October 2011