ImageVerifierCode 换一换
格式:PDF , 页数:22 ,大小:491.48KB ,
资源ID:737303      下载积分:10000 积分
快捷下载
登录下载
邮箱/手机:
温馨提示:
如需开发票,请勿充值!快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。
如填写123,账号就是123,密码也是123。
特别说明:
请自助下载,系统不会自动发送文件的哦; 如果您已付费,想二次下载,请登录后访问:我的下载记录
支付方式: 支付宝扫码支付 微信扫码支付   
注意:如需开发票,请勿充值!
验证码:   换一换

加入VIP,免费下载
 

温馨提示:由于个人手机设置不同,如果发现不能下载,请复制以下地址【http://www.mydoc123.com/d-737303.html】到电脑端继续下载(重复下载不扣费)。

已注册用户请登录:
账号:
密码:
验证码:   换一换
  忘记密码?
三方登录: 微信登录  

下载须知

1: 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。
2: 试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。
3: 文件的所有权益归上传用户所有。
4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
5. 本站仅提供交流平台,并不能对任何下载内容负责。
6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

版权提示 | 免责声明

本文(ETSI TR 187 014-2009 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN) eSecurity User Guide to eTVRA web-database《电信和互联网融合业务及高级网络协议(.pdf)为本站会员(amazingpat195)主动上传,麦多课文库仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文库(发送邮件至master@mydoc123.com或直接QQ联系客服),我们立即给予删除!

ETSI TR 187 014-2009 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN) eSecurity User Guide to eTVRA web-database《电信和互联网融合业务及高级网络协议(.pdf

1、 ETSI TR 187 014 V2.1.1 (2009-02)Technical Report Telecommunications and Internet converged Services andProtocols for Advanced Networking (TISPAN);eSecurity;User Guide to eTVRA web-databaseETSI ETSI TR 187 014 V2.1.1 (2009-02) 2Reference DTR/TISPAN-07020-NGN-R2 Keywords data, security ETSI 650 Route

2、 des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can be downloaded f

3、rom: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall

4、be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is availabl

5、e at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copy

6、right and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2009. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM is a

7、Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM As

8、sociation. ETSI ETSI TR 187 014 V2.1.1 (2009-02) 3Contents Intellectual Property Rights 4g3Foreword . 4g31 Scope 5g32 References 5g32.1 Normative references . 5g32.2 Informative references 5g33 Definitions and abbreviations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 Overview of eTVRA web appli

9、cation structure . 6g35 User guide 8g35.1 Access to the eTVRA home page . 8g35.1.1 Access restrictions 8g35.2 eTVRA step 1 . 9g35.2.1 Creation and editing systems 9g35.2.2 Creation and editing of objectives 10g35.2.3 Creation and editing of unwanted incidents 12g35.3 eTVRA step 2 . 14g35.4 eTVRA ste

10、p 3 . 15g35.5 eTVRA steps 4, 5, 6 and 7 16g35.6 Risk reporting . 21g3History 22g3ETSI ETSI TR 187 014 V2.1.1 (2009-02) 4Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if

11、any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available

12、 on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server)

13、 which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TR 187 014 V2.1.1 (2009-02) 51 Scope

14、 The present document is a guide to the use of the ETSI eTVRA web-application. NOTE: The eTVRA web-application acts as a tool for entering analysis results following completion of an analysis using the ETSI TVRA method defined in TS 102 165-1 i.1. 2 References References are either specific (identif

15、ied by date of publication and/or edition number or version number) or non-specific. For a specific reference, subsequent revisions do not apply. Non-specific reference may be made only to a complete document or a part thereof and only in the following cases: - if it is accepted that it will be poss

16、ible to use all future changes of the referenced document for the purposes of the referring document; - for informative references. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks

17、 included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references The following referenced documents are indispensable for the application of the present document. For dated references, only the edition cited applies. For non-spec

18、ific references, the latest edition of the referenced document (including any amendments) applies. Not applicable. 2.2 Informative references The following referenced documents are not essential to the use of the present document but they assist the user with regard to a particular subject area. For

19、 non-specific references, the latest version of the referenced document (including any amendments) applies. i.1 ETSI TS 102 165-1: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and proforma for Threat, Risk,

20、Vulnerability Analysis“. i.2 ETSI TR 187 011: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Security; Application of ISO-15408-2 requirements to ETSI standards - guide, method and application with examples“. i.3 ISO/IEC 15408-2: “ Information

21、 technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional components“. i.4 ISO/IEC 15408-1: “Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model“. i.5 ISO/IEC 15408-3: “Information tec

22、hnology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance components“. ETSI ETSI TR 187 014 V2.1.1 (2009-02) 63 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TS 102 165-1 i.1 and TR 18

23、7 011 i.2 apply. 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: EAL Evaluation Assurance Level EOL ETSI On Line account TVRA Threat Vulnerability and Risk Analysis UML Unified Modelling Language URL Uniform Resource Locator 4 Overview of eTVRA web appl

24、ication structure The eTVRA web application is structured as shown in figure 1. Figure 1: eTVRA web application structure The web page design is aligned to the “look and feel“ of the ETSI Web-application suite and any change to the overall ETSI look will be reflected in the eTVRA site. The eTVRA too

25、l and website populates a database, as defined in annex E of TS 102 165-1 i.1 but modified for practical implementation on the ETSI server platform. The eTVRA site and database allow cataloguing of the results of the analysis but does not present any shortcut in the analysis (although it may be poss

26、ible to modify entries and their associated risk to view the impact of adding countermeasures to the system). ETSI ETSI TR 187 014 V2.1.1 (2009-02) 7Unwanted IncidentsPK,I1 IDI2 UnwantedIncidentabstractCountermeasuresPK,I1 iddescriptionVulnerablityPK IDPK,FK1 AssetIDPK,FK2,I2 WeaknessIDPK,FK3,I1 Thr

27、eatAgentAssetPK,I2 IDAsset typeAsset subtypeAsset groupI1 NameDescriptionImpact when breachedWeaknessPK IDNameDescriptionAttackSystemKnowledgeFK1 UnwantedIncidentSecurity ObjectivePK,FK1 SecurityObjectiveSystemPK,I1 IDNameFK1 rootAssetIDAsset AggregatorPK Container AssetPK,FK1 AssetImpact when breac

28、hedsystem countermeasuresPK,FK3,I1 System IDPK,FK2,I2 countermeasurePK,FK1 in assetprotecting assetThreatPK,I1 IDFK2 Threat FamilyThreatAgentAttackExpertiseAttackEquipmentAttackTimeFK1 AutomationClassAttackAccessIntensityAutomatedThreatsPK IDNameExpertiseAccessknowledgeEquipmentTimeIntensityThreat F

29、amilyPK,I1 IDI2 Threat familySecurity ObjectiveconcreteCountermeasuresPK,I2 idI1 NameFK2 weaknessFK1 abstractCountermeasuremethodeffectTimeeffectExpertiseeffectKnowledgeeffectAccesseffectEquipmenteffectImpactFigure 2: Database structure extracted from MS-Access TVRA test database ETSI ETSI TR 187 01

30、4 V2.1.1 (2009-02) 85 User guide 5.1 Access to the eTVRA home page The ETSI TVRA homepage is accessed via the following URL: http:/portal.etsi.org/eTVRA/ NOTE: The eTVRA site is noted as under construction and the present document is a guide to the current version of the site. Feedback garnered thro

31、ugh its operation will be used to improve and modify the site in a future release. Figure 3: eTVRA website welcome page 5.1.1 Access restrictions Access to the eTVRA application is restricted in the following way: Table 1 Role Access EOL account holders Read only access to database content eTVRA adm

32、inistrator Full access to the database ETSI support Access to update webpages On entering the eTVRA site the user will be directed to enter the EOL account user-name and password. If a TVRA user does not have such credentials they have to be requested from ETSI. EOL accounts may be applied for onlin

33、e from the following URL: http:/webapp.etsi.org/createaccount/ ETSI ETSI TR 187 014 V2.1.1 (2009-02) 95.2 eTVRA step 1 5.2.1 Creation and editing systems The first step defined for the eTVRA is identifying the objectives. As a pre-requisite it is essential to first define the system itself. Figure 4

34、: Screen shot for entering a system Figure 5: Screen shot for editing a system ETSI ETSI TR 187 014 V2.1.1 (2009-02) 105.2.2 Creation and editing of objectives As stated in TS 102 165-1 i.1 the objectives for security are the essential starting point of the design. Should these objectives be unclear

35、 or unconsciously changing during the design process the system becomes more difficult (and hence expensive) to secure. Alternatively, if the objectives are not clear from the outset of the design important security aspects may be left unaddressed that may lead to costly incidents and/or repair oper

36、ations. Objectives package TVRA 1/1SystemObjectivesSecurityObjectivesAssuranceObjectivesFigure 6: Hierarchy of objectives in a system design As shown in figure 6 assurance objectives and security objectives are specializations of system objectives. Those characteristics of an objective that mark it

37、out as a security objective are those that refer to one or more of the following system attributes: Authenticity. Confidentiality. Availability. Integrity. Within the context of standardization there are a number of objectives for security that are intended to ensure availability of the network and

38、customer confidence. These objectives break down to the following technical security issues for most telecommunications services: charging fraud; protection of privacy; and ensuring availability of the offered services. The goals for telecommunications services should therefore aim to reduce these r

39、isks by reducing the ability to mount attacks that prevent the achievement of these objectives. ETSI ETSI TR 187 014 V2.1.1 (2009-02) 11The following technical objectives for telecommunications services security hold: Prevention of masquerade: - being able to determine that a user claiming to be Ali

40、ce is always Alice, Bob is always Bob, and Bob cannot pretend to be Alice; - applies to both masquerade of the user and of the system or service. Ensure availability of the telecommunications services: - the service must be accessible and usable on demand by an authorized entity. NOTE: In general, a

41、 user expects to be able to place a call, and complete the call without being cut off in the middle. Maintain privacy of communication: - where the parties to a call communicate across public networks mechanisms should exist to prevent eavesdropping; - the only delivery points for communication have

42、 to be the legitimate parties to the call. Figure 7: Screen shot for entering an objective ETSI ETSI TR 187 014 V2.1.1 (2009-02) 12Figure 8: Screen shot for editing an objective 5.2.3 Creation and editing of unwanted incidents Unwanted incidents are the corollary of objectives, whereas an objective

43、is stated as an intent, an unwanted incident is stated as something the designer explicitly does not want the system to do. Figure 9: Screen shot for inserting an unwanted incident ETSI ETSI TR 187 014 V2.1.1 (2009-02) 13Figure 10: Screen shot for editing an unwanted incident ETSI ETSI TR 187 014 V2

44、.1.1 (2009-02) 145.3 eTVRA step 2 The system requirements are dependent on the system objectives identified in step 1 and have two specialisms shown in figure 11 identifying security and assurance requirement specialisms. Requirements package TVRA 2/2SystemRequirementsSecurityRequirementsAssuranceRe

45、quirementsSystemObjectivesFigure 11: Dependency relationship between requirements and objectives Following the guidance given in TR 187 011 i.2 security functional requirements should be defined using the model specified in ISO/IEC 15408-2 i.3 and should be specified for both the asset and, where ap

46、plicable, its environment. The asset security functional requirements should be classified into the following groups: asset security functional requirements: - an identification the security functional requirements as specified by reference to the functional components defined in ISO/IEC 15408-2 i.3

47、 where the assignments and/or selections required have been made for the system under evaluation; asset security assurance requirements: - an indication of the Evaluation Assurance Level (EAL) as described in ISO/IEC 15408-1 i.4 that an implementation of the base security standard could be expected

48、to meet. As there are likely to be many implementations in a number of different application areas, the EAL requirement could be expressed as a range (e.g. EAL3 - EAL5); - where possible, an identification of any specific assurance components from ISO/IEC 15408-3 i.5 which will apply to an implement

49、ation; and - where necessary, a specification of any essential assurance requirements which are not included in ISO/IEC 15408-3 i.5. ETSI ETSI TR 187 014 V2.1.1 (2009-02) 15When building systems the use of ISO/IEC 15408-2 i.3 functional capabilities offer a means to unambiguously state requirements. Requirements are modelled further in the system as specific assets although this may be revisited. NOTE: The eTVRA tool and method in its current form does not allow a simple guided means of linking system assets

copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
备案/许可证编号:苏ICP备17064731号-1