ITU-T X 1051-2016 Information technology - Security techniques - Code of practice for Information security controls based on ISO IEC 27002 for telecommunications organizations《信息技术.pdf

1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1051 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Information and network security Security management Information technology Security techniqu

2、es - Code of practice for information security controls based on ISO/IEC 27002 for telecommunications organizations Recommendation ITU-T X.1051 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299

3、INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General sec

4、urity aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.

5、1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor

6、network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information requ

7、est X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing securit

8、y implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For further details, please refer to the list of ITU-T Recommendations. ITU-T Rec. X.1051 (04/2016) i INTERNATIONAL STANDARD ISO/IEC 27011 RECOMMENDATION ITU-T X.1051 Information technology Security techniques Code of practice

9、 for information security controls based on ISO/IEC 27002 for telecommunications organizations Summary This Recommendation | International Standard: a) establishes guidelines and general principles for initiating, implementing, maintaining and improving information security controls in telecommunica

10、tions organizations based on ISO/IEC 27002; b) provides an implementation baseline of information security controls within telecommunications organizations to ensure the confidentiality, integrity and availability of telecommunications facilities, services and information handled, processed or store

11、d by the facilities and services. As a result of implementing this Recommendation | International Standard, telecommunications organizations, both within and between jurisdictions, will: a) be able to ensure the confidentiality, integrity and availability of global telecommunications facilities, ser

12、vices and the information handled, processed or stored within global facilities and services; b) have adopted secure collaborative processes and controls ensuring the lowering of risks in the delivery of telecommunications services; c) be able to deliver information security in an effective and effi

13、cient manner; d) have adopted a consistent holistic approach to information security; e) be able to improve the security culture of organizations, raise staff awareness and increase public trust. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X.1051 2004-07-29 17 11.1002/10

14、00/7286 2.0 ITU-T X.1051 2008-02-13 17 11.1002/1000/9332 3.0 ITU-T X.1051 2016-04-29 17 11.1002/1000/12845 Keywords Code of practice, information security controls and telecommunications extended controls, information security management, ISO/IEC 27002, security risk assessment. * To access the Reco

15、mmendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii ITU-T Rec. X.1051 (04/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations s

16、pecialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on th

17、em with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-

18、T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used

19、 for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the

20、Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of a

21、ny party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Prope

22、rty Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, imp

23、lementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2016 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior writ

24、ten permission of ITU. ITU-T Rec. X.1051 (04/2016) iii CONTENTS Page 1 Scope 1 2 Normative references 1 3 Definitions and abbreviations . 1 3.1 Definitions . 1 3.2 Abbreviations 2 4 Overview 2 4.1 Structure of this Recommendation | International Standard 2 4.2 Information security management systems

25、 in telecommunications organizations 3 5 Information security policies 5 6 Organization of information security 5 6.1 Internal organization . 5 6.2 Mobile devices and teleworking 6 7 Human resource security 6 7.1 Prior to employment 6 7.2 During employment 7 7.3 Termination or change of employment .

26、 7 8 Asset management 7 8.1 Responsibility for assets 7 8.2 Information classification 8 8.3 Media handling 8 9 Access control 8 9.1 Business requirement for access control . 8 9.2 User access management . 9 9.3 User responsibilities 9 9.4 System and application access control 9 10 Cryptography 9 11

27、 Physical and environmental security 9 11.1 Secure areas . 9 11.2 Equipment . 10 12 Operations security . 12 12.1 Operational procedures and responsibilities 12 12.2 Protection from malware . 13 12.3 Backup 13 12.4 Logging and monitoring 13 12.5 Control of operational software . 13 12.6 Technical vu

28、lnerability management 14 12.7 Information systems audit considerations . 14 13 Communications security . 14 13.1 Network security management 14 13.2 Information transfer. 15 14 System acquisition, development and maintenance . 16 14.1 Security requirements of information systems 16 14.2 Security in

29、 development and support processes 16 14.3 Test data 16 15 Supplier relationships . 16 15.1 Information security in supplier relationships . 16 15.2 Supplier service delivery management 17 16 Information security incident management 17 16.1 Management of information security incidents and improvemen

30、ts. 17 17 Information security aspects of business continuity management 19 iv ITU-T Rec. X.1051 (04/2016) Page 17.1 Information security continuity . 19 17.2 Redundancies 20 18 Compliance . 20 Annex A Telecommunications extended control set 21 Annex B Additional guidance for network security . 29 B

31、.1 Security measures against network attacks . 29 B.2 Network security measures for network congestion 30 Bibliography 31 ITU-T Rec. X.1051 (04/2016) v Introduction This Recommendation | International Standard provides interpretation guidelines for the implementation and management of information se

32、curity controls in telecommunications organizations based on ISO/IEC 27002. Telecommunications organizations provide telecommunications services by facilitating the communications of customers through their infrastructure. In order to provide telecommunications services, telecommunications organizat

33、ions need to interconnect and/or share their services and facilities and/or use the services and facilities of other telecommunications organizations. Furthermore, the site location, such as radio sites, antenna locations, ground cables and utility provision (power, water), may be accessed not only

34、by the organizations staff, but also by contractors and providers external to the organization. Therefore, the management of information security in telecommunications organizations is complex, potentially: depending on external parties; having to cover all areas of network infrastructure, services

35、applications and other facilities; including a range of telecommunications technologies (e.g., wired, wireless or broadband); supporting a wide range of operational scales, service areas and service types. In addition to the application of security objectives and controls described in ISO/IEC 27002,

36、 telecommunications organizations may need to implement extra controls to ensure confidentiality, integrity, availability and any other security property of telecommunications in order to manage security risk in an adequate fashion. 1) Confidentiality Protecting confidentiality of information relate

37、d to telecommunications from unauthorized disclosure. This implies non-disclosure of communications in terms of the existence, the content, the source, the destination and the date and time of communicated information. It is critical that telecommunications organizations ensure that the non-disclosu

38、re of communications being handled by them is not breached. This includes ensuring that persons engaged by the telecommunications organization maintain the confidentiality of any information regarding others that may have come to be known during their work duties. NOTE The term “secrecy of communica

39、tions“ is used in some countries in the context of “non-disclosure of communications“. 2) Integrity Protecting the integrity of telecommunications information includes controlling the installation and use of telecommunications facilities to ensure the authenticity, accuracy and completeness of infor

40、mation transmitted, relayed or received by wire, radio or any other method. 3) Availability Availability of telecommunications information includes ensuring that access to facilities and the medium used for the provision of communication services is authorized, regardless of whether communications i

41、s provided by wire, radio or any other method. Typically, telecommunications organizations give priority to essential communications in case of emergencies, managing unavailability of less important communications in compliance with regulatory requirements. Audience The audience of this Recommendati

42、on | International Standard consists of telecommunications organizations and those responsible for information security; together with security vendors, auditors, telecommunications terminal vendors and application content providers. This Recommendation | International Standard provides a common set

43、 of general security control objectives based on ISO/IEC 27002, telecommunications sector-specific controls and information security management guidelines allowing for the selection and implementation of such controls. ISO/IEC 27011:2016 (E) ITU-T Rec. X.1051 (04/2016) 1 INTERNATIONAL STANDARD ITU-T

44、 RECOMMENDATION Information technology Security techniques Code of practice for information security controls based on ISO/IEC 27002 for telecommunications organizations 1 Scope The scope of this Recommendation | International Standard is to define guidelines supporting the implementation of informa

45、tion security controls in telecommunications organizations. The adoption of this Recommendation | International Standard will allow telecommunications organizations to meet baseline information security management requirements of confidentiality, integrity, availability and any other relevant securi

46、ty property. 2 Normative references The following Recommendations and International Standards contain provisions which, through reference in this text, constitute provisions of this Recommendation | International Standard. At the time of publication, the editions indicated were valid. All Recommenda

47、tions and Standards are subject to revision, and parties to agreements based on this Recommendation | International Standard are encouraged to investigate the possibility of applying the most recent edition of the Recommendations and Standards listed below. Members of IEC and ISO maintain registers

48、of currently valid International Standards. The Telecommunication Standardization Bureau of the ITU maintains a list of currently valid ITU-T Recommendations. ISO/IEC 27000, Information technology Security techniques Information security management systems Overview and vocabulary. ISO/IEC 27002:2013

49、, Information technology Security techniques Code of practice for information security controls. 3 Definitions and abbreviations 3.1 Definitions For the purposes of this Recommendation | International Standard, the definitions given in ISO/IEC 27000 and the following apply: 3.1.1 co-location: Installation of telecommunications facilities on the premises of other telecommunications carriers. 3.1.2 communication centre: Building where facilities for providing telecommunicat