ANSI INCITS ISO IEC 18028-1-2006 Information technology Security techniques IT network security Part 1 Network security management.pdf

1、INCITS/ISO/IEC 18028-1:20062008(ISO/IEC 18028-1:2006, IDT) Information technology Security techniques IT network security Part 1: Network security managementINCITS/ISO/IEC 18028-1:20062008(ISO/IEC 18028-1:2006, IDT)INCITS/ISO/IEC 18028-1:20062008 ii ITIC 2008 All rights reserved PDF disclaimer This

2、PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept there

3、in the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the

4、 PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. Adopted by INCITS (InterNa

5、tional Committee for Information Technology Standards) as an American National Standard. Date of ANSI Approval: 7/1/2008 Published by American National Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2008 by Information Technology Industry Council (ITI). All rights reser

6、ved. These materials are subject to copyright claims of International Standardization Organization (ISO), International Electrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale. No part of this publication may

7、be reproduced in any form, including an electronic retrieval system, without the prior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1250 Eye Street NW, Washington, DC 20005. Printed in the United States of America INCITS/ISO/IEC 18028-1:20062008 ITI

8、C 2008 All rights reserved iii Contents Page Foreword .v Introduction vi 1 Scope 1 2 Normative references .1 3 Terms and definitions 2 3.1 Terms defined in other International Standards .2 3.2 Terms defined in this part of ISO/IEC 18028 .2 4 Abbreviated terms 7 5 Structure .9 6 Aim 10 7 Overview . 1

9、0 7.1 Background 10 7.2 Identification Process 12 8 Consider Corporate Information Security Policy Requirements 15 9 Review Network Architectures and Applications 15 9.1 Background 15 9.2 Types of Network 16 9.3 Network Protocols 16 9.4 Networked Applications . 17 9.5 Technologies Used to Implement

10、Networks . 17 9.5.1 Local Area Networks 17 9.5.2 Wide Area Networks . 18 9.6 Other Considerations . 18 10 Identify Types of Network Connection 18 11 Review Networking Characteristics and Related Trust Relationships. 20 11.1 Network Characteristics . 20 11.2 Trust Relationships 20 12 Identify the Inf

11、ormation Security Risks . 22 13 Identify Appropriate Potential Control Areas 27 13.1 Background 27 13.2 Network Security Architecture . 27 13.2.1 Preface 27 13.2.2 Local Area Networking . 29 13.2.3 Wide Area Networking 31 13.2.4 Wireless Networks 32 13.2.5 Radio Networks 33 13.2.6 Broadband Networki

12、ng 35 13.2.7 Security Gateways 36 13.2.8 Remote Access Services . 37 13.2.9 Virtual Private Networks. 38 13.2.10 IP Convergence (data, voice, video) 39 13.2.11 Enabling Access to Services Provided by Networks that are External (to the Organization) . 41 13.2.12 Web Hosting Architecture 42 13.3 Secur

13、e Service Management Framework 44 13.3.1 Management Activities . 44 INCITS/ISO/IEC 18028-1:20062008 iv ITIC 2008 All rights reserved 13.3.2 Networking Security Policy . 44 13.3.3 Security Operating Procedures . 45 13.3.4 Security Compliance Checking . 45 13.3.5 Security Conditions for Connection 45

14、13.3.6 Documented Security Conditions for Users of Network Services . 46 13.3.7 Incident Management . 46 13.4 Network Security Management 46 13.4.1 Preface 46 13.4.2 Networking Aspects . 46 13.4.3 Roles and Responsibilities 48 13.4.4 Network Monitoring 49 13.4.5 Evaluating Network Security . 49 13.5

15、 Technical Vulnerability Management 49 13.6 Identification and Authentication 49 13.6.1 Background 49 13.6.2 Remote Log-in 49 13.6.3 Authentication Enhancements 50 13.6.4 Remote System Identification 50 13.6.5 Secure Single Sign-on . 51 13.7 Network Audit Logging and Monitoring 51 13.8 Intrusion Det

16、ection. 52 13.9 Protection against Malicious Code . 53 13.10 Common Infrastructure Cryptographic Based Services 54 13.10.1 Preface 54 13.10.2 Data Confidentiality over Networks . 54 13.10.3 Data Integrity over Networks . 54 13.10.4 Non-Repudiation 54 13.10.5 Key Management 55 13.11 Business Continui

17、ty Management 57 14 Implement and Operate Security Controls 58 15 Monitor and Review Implementation . 58 Bibliography . 59 INCITS/ISO/IEC 18028-1:20062008 ITIC 2008 All rights reserved v Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Com

18、mission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. I

19、SO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, I

20、SO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to natio

21、nal bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC should not be held responsible f

22、or identifying any or all such patent rights. ISO/IEC 18028-1 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. ISO/IEC 18028 consists of the following parts, under the general title Information technology Security techniques

23、 IT network security: Part 1: Network security management Part 2: Network security architecture Part 3: Securing communications between networks using security gateways Part 4: Securing remote access Part 5: Securing communications across networks using virtual private networks INCITS/ISO/IEC 18028-

24、1:20062008 vi ITIC 2008 All rights reserved Introduction The telecommunications and information technology industries are seeking cost-effective comprehensive security solutions. A secure network should be protected against malicious and inadvertent attacks, and should meet the business requirements

25、 for confidentiality, integrity, availability, non-repudiation, accountability, authenticity and reliability of information and services. Securing a network is also essential for maintaining the accuracy of billing or usage information as appropriate. Security capabilities in products are crucial to

26、 overall network security (including applications and services). However, as more products are combined to provide total solutions, the interoperability, or the lack thereof, will define the success of the solution. Security must not only be a thread of concern for each product or service, but must

27、be developed in a manner that promotes the interweaving of security capabilities in the overall end-to-end security solution. Thus, the purpose of ISO/IEC 18028 is to provide detailed guidance on the security aspects of the management, operation and use of information system networks, and their inte

28、r-connections. Those individuals within an organization that are responsible for information security in general, and network security in particular, should be able to adapt the material in this standard to meet their specific requirements. Its main objectives are as follows: in ISO/IEC 18028-1, to

29、define and describe the concepts associated with, and provide management guidance on, network security including on how to identify and analyze the communications related factors to be taken into account to establish network security requirements, with an introduction to the possible control areas a

30、nd the specific technical areas (dealt with in subsequent parts of ISO/IEC 18028); in ISO/IEC 18028-2, to define a standard security architecture, which describes a consistent framework to support the planning, design and implementation of network security; in ISO/IEC 18028-3, to define techniques f

31、or securing information flows between networks using security gateways; in ISO/IEC 18028-4, to define techniques for securing remote access; in ISO/IEC 18028-5, to define techniques for securing inter-network connections that are established using virtual private networks (VPNs). ISO/IEC 18028-1 is

32、relevant to anyone involved in owning, operating or using a network. This includes senior managers and other non-technical managers or users, in addition to managers and administrators who have specific responsibilities for information security and/or network security, network operation, or who are

33、responsible for an organizations overall security program and security policy development. ISO/IEC 18028-2 is relevant to all personnel who are involved in the planning, design and implementation of the architectural aspects of network security (for example network managers, administrators, engineer

34、s, and network security officers). ISO/IEC 18028-3 is relevant to all personnel who are involved in the detailed planning, design and implementation of security gateways (for example network managers, administrators, engineers and network security officers). ISO/IEC 18028-4 is relevant to all person

35、nel who are involved in the detailed planning, design and implementation of remote access security (for example network managers, administrators, engineers, and network security officers). ISO/IEC 18028-5 is relevant to all personnel who are involved in the detailed planning, design and implementati

36、on of VPN security (for example network managers, administrators, engineers, and network security officers). AMERICAN NATIONAL STANDARD INCITS/ISO/IEC 18028-1:20062008 ITIC 2008 All rights reserved 1 Information technology Security techniques IT network security Part 1: Network security management 1

37、 Scope ISO/IEC 18028-1 provides direction with respect to networks and communications, including on the security aspects of connecting information system networks themselves, and of connecting remote users to networks. It is aimed at those responsible for the management of information security in ge

38、neral, and network security in particular. This direction supports the identification and analysis of the communications related factors that should be taken into account to establish network security requirements, provides an introduction on how to identify appropriate control areas with respect to

39、 security associated with connections to communications networks, and provides an overview of the possible control areas including those technical design and implementation topics dealt with in detail in ISO/IEC 18028-2 to ISO/IEC 18028-5. 2 Normative references The following referenced documents ar

40、e indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 18028-2:2005, Information technology Security techniques IT network security P

41、art 2: Network security architecture ISO/IEC 18028-3:2005, Information technology Security techniques IT network security Part 3: Securing communications between networks using security gateways ISO/IEC 18028-4:2005, Information technology Security techniques IT network security Part 4: Securing rem

42、ote access ISO/IEC 18028-5:2006, Information technology Security techniques IT network security Part 5: Securing communications across networks using virtual private networks ISO/IEC 13335-1:2004, Information technology Security techniques Management of information and communications technology secu

43、rity Part 1: Concepts and models for information and communications technology security management ISO/IEC 17799:2005, Information technology Security techniques Code of practice for information security management ISO/IEC 18044:2004, Information technology Security techniques Information security i

44、ncident management ISO/IEC 18043:2006, Information technology Security techniques Selection, deployment and operations of intrusion detection systems INCITS/ISO/IEC 18028-1:20062008 2 ITIC 2008 All rights reserved 3 Terms and definitions 3.1 Terms defined in other International Standards For the pur

45、poses of this document, the terms and definitions given in ISO/IEC 7498 (all parts) and the following terms defined in ISO/IEC 17799 and ISO/IEC 13335-1 apply: accountability, asset, authenticity, availability, baseline controls, confidentiality, data integrity, impact, integrity, security policy, n

46、on-repudiation, reliability, risk, risk analysis, risk assessment, risk management, control, threat and vulnerability. 3.2 Terms defined in this part of ISO/IEC 18028 For the purposes of this document, the following terms and definitions apply. 3.2.1 alert instant indication that an information syst

47、em and network may be under attack, or in danger because of accident, failure or people error 3.2.2 attacker any person deliberately exploiting vulnerabilities in technical and non-technical security controls in order to steal or compromise information systems and networks, or to compromise availabi

48、lity to legitimate users of information system and network resources 3.2.3 audit formal inquiry, formal examination, or verification of facts against expectations, for compliance and conformity 3.2.4 audit logging gathering of data on information security events for the purpose of review and analysi

49、s, and ongoing monitoring 3.2.5 audit tools automated tools to aid the analysis of the contents of audit logs 3.2.6 business continuity management process to ensure that recovery of operations will be assured should any unexpected or unwanted incident occur that is capable of negatively impacting the continuity of essential business functions and supporting elements NOTE The process should also ensure that recovery is achieved in the required priorities and timescale