ITU-T X 1570-2011 Discovery mechanisms in the exchange of cybersecurity information (Study Group 17)《网络安全信息交换的发现机制 17号研究组》.pdf

1、 International Telecommunication Union ITU-T X.1570TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2011) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Identification and discovery Discovery mechanisms in the exchange of cybersecurity informat

2、ion Recommendation ITU-T X.1570 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING

3、 AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X

4、.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE

5、 SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerab

6、ility/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommenda

7、tions. Rec. ITU-T X.1570 (09/2011) i Recommendation ITU-T X.1570 Discovery mechanisms in the exchange of cybersecurity information Summary Recommendation ITU-T X.1570 provides a framework for discovering cybersecurity information and the mechanism that enables this. Discovery can be seen as a stage

8、of the cybersecurity information lifecycle adjacent to information publishing and acquisition, which are integral and necessary stages for discovery. Thus, the framework covers how to publish cybersecurity information, obtain the candidate list, and acquire the needed information. A discovery scheme

9、 may be implemented with arbitrary mechanisms so long as they comply with the framework. Among these mechanisms are object identifier (OID)-based discovery and resource description framework (RDF)-based discovery, which are also elaborated in this Recommendation. History Edition Recommendation Appro

10、val Study Group 1.0 ITU-T X.1570 2011-09-02 17 Keywords Cybersecurity information, information discovery, source discovery. ii Rec. ITU-T X.1570 (09/2011) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information

11、 and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide

12、 basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA R

13、esolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administrat

14、ion and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions

15、 are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the

16、 possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of

17、 the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest i

18、nformation and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1570 (09/2011) iii Table of

19、Contents Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 2 5 Conventions 2 6 Framework to identify and locate the source of cybersecurity information . 3 7 Types and level of details of discovered

20、cybersecurity information 3 8 Cybersecurity information identifier 4 9 Types of discovery mechanisms . 5 9.1 OID-based discovery mechanisms in the exchange of cybersecurity information . 5 9.2 RDF-based discovery mechanisms in cybersecurity information exchange 6 10 Methods available for access to d

21、iscovered information 7 Appendix I Cybersecurity operational information ontology . 8 I.1 Cybersecurity operation domains . 8 I.2 Roles . 8 I.3 Cybersecurity information 9 Appendix II Specifications describing databases and knowledge bases . 12 Appendix III An illustrated implementation of RDF-based

22、 discovery . 13 III.1 RDF-based discovery implementation example . 13 III.2 Class hierarchy of cybersecurity information . 13 Bibliography. 15 iv Rec. ITU-T X.1570 (09/2011) Introduction Greater importance than ever is being placed on the exchange of cybersecurity information. An international stand

23、ard for exchanging cybersecurity information, called CYBEX, is drawing particularly significant attention. CYBEX discovery, which provides a scheme for finding the source of cybersecurity information, is among CYBEXs various technical specifications. This Recommendation explains its framework and te

24、chniques. Rec. ITU-T X.1570 (09/2011) 1 Recommendation ITU-T X.1570 Discovery mechanisms in the exchange of cybersecurity information 1 Scope This Recommendation provides a framework for discovering cybersecurity information and the mechanism that enables this. Discovery can be seen as a stage of th

25、e cybersecurity information lifecycle adjacent to information publishing and acquisition, which are integral and necessary stages for discovery. Thus, the framework covers how to publish cybersecurity information, obtain the candidate list, and acquire the needed information. A discovery scheme may

26、be implemented with arbitrary mechanisms so long as they comply with the framework. Among these mechanisms are object identifier (OID)-based discovery and resource description framework (RDF)-based discovery, which are also elaborated on in this Recommendation. 2 References The following ITU-T Recom

27、mendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are th

28、erefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a st

29、and-alone document, the status of a Recommendation. ITU-T X.660 Recommendation ITU-T X.660 (2011) | ISO/IEC 9834-1:2012, Information technology Procedures for the operation of object identifier registration authorities: General procedures and top arcs of the international object identifier tree. W3C

30、 RDF W3C Recommendation (2004), Resource Description Framework (RDF): Concepts and Abstract Syntax. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 object identifier ITU-T X.660: An ordered list of primary integer values from the root o

31、f the international object identifier tree to a node, which unambiguously identifies that node. 3.1.2 ontology b-Gruber: An explicit specification of a conceptualization. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 cybersecurity information: Struct

32、ured information or knowledge concerning: 1. the “state“ of equipment, software or network-based systems as related to cybersecurity, especially vulnerabilities; 2. forensics related to incidents or events; 3. heuristics and signatures gained from experienced events; 2 Rec. ITU-T X.1570 (09/2011) 4.

33、 parties who implement cybersecurity information exchange capabilities within the scope of this framework; 5. specifications for the exchange of cybersecurity information, including modules, schemas, policies and assigned numbers; 6. the identities and trust attributes of all of the above; 7. implem

34、entation requirements, guidelines and practices. NOTE This definition is based on the description given for cybersecurity information in b-ITU-T X.1500. 3.2.2 exchange (cybersecurity information): The transfer of cybersecurity information between two or more cybersecurity entities. This transfer may

35、 be uni-directional, bi-directional, or multi-directional, i.e., many-to-many. 3.2.3 discovery: The act or process of discovering the target, i.e., obtaining knowledge of the target for the first time. 3.2.4 retriever: An entity retrieving cybersecurity information. 4 Abbreviations and acronyms This

36、 Recommendation uses the following abbreviations and acronyms: CCE Common Configuration Enumeration CERT Computer Emergency Response Team CIRT Computer Incident Response Team CPE Common Platform Enumeration CVE Common Vulnerabilities and Exposures CVSS Common Vulnerability Scoring System CWE Common

37、Weakness Enumeration CWSS Common Weakness Scoring System CYBEX CYBersecurity information EXchange HTTP Hypertext Transfer Protocol IODEF Incident Object Description Exchange Format MAEC Malware Attribute Enumeration and Characterization OID Object IDentifier OVAL Open Vulnerability and Assessment La

38、nguage RDF Resource Description Framework SCAP Security Content Automation Protocol SNMP Simple Network Management Protocol XCCDF eXtensible Configuration Checklist Description Format 5 Conventions None. Rec. ITU-T X.1570 (09/2011) 3 6 Framework to identify and locate the source of cybersecurity inf

39、ormation Different cybersecurity organizations are implementing common cybersecurity protocols for the capture and exchange of information on the system state, vulnerability, incident forensics, and incident heuristics, in operational applications. As this information is becoming available from many

40、 different sources, implementers should harmonize how they identify cybersecurity organizations, trust and information exchange policies, and the information itself that is exchanged or distributed. To address this issue, this clause introduces a framework to identify and locate the source of cybers

41、ecurity information the cybersecurity information discovery framework. Finding cybersecurity information involves three entities: retriever, source, and directory. The retriever retrieves the information by sending a request, the source provides requested information, and the directory registers the

42、 metadata of the sources information and assists the retriever in finding a proper source. X.1570(11)_F6-1RetrieverDirectory SourceInformationpublishingstageCandidate listreceptionstageInformationacquisitionstageFigure 6-1 Three stages of discovery The discovery process is the communication process

43、of the three entities, as depicted in Figure 6-1. It has three stages: information publishing, candidate list reception, and information acquisition. The source publishes its information for the cyber society by registering it with the directory at the information publishing stage. The retriever que

44、ries a registrar directory for the list of candidate sources at the candidate list reception stage. It then selects a source that seems best suited from the list and receives the sources information at the source selection stage. 7 Types and level of details of discovered cybersecurity information T

45、he discovery mechanisms are able to discover cybersecurity information. This mechanism intends to discover the following seven types of information: user resource database; provider resource database; incident database; warning database; product and service knowledge base; cyber risk knowledge base;

46、 and countermeasure knowledge base. Figure 7-1 provides the ontology model used in this Recommendation and shows the relationship between the information types used in this model. 4 Rec. ITU-T X.1570 (09/2011) X.1570(11)_F7-1refersIT assetmanagementdomainIT infrastructureprovidermanipulatesProviderr

47、esource DBis linked tomanipulatesAdministratorUserresource DBis extracted toIncident DBmanipulatesResponseteamcoordinatormanipulatesmanipulatesis extracted toWarning DBIncidenthandlingdomainrefersrefersrefersrefersProduct and service KBVersion KBConfiguration KBrefersCountermeasure KBAssessment KBDe

48、tection/protection KBrefersCyber risk KBVulnerability KBThreat KBOrganizesOrganizesOrganizesProduct and servicedeveloperProvidesinformationtoRegistrarProvidesinformationtoResearcherKnowledgeaccumulationdomainDB: Database KB: Knowledge base Figure 7-1 Cybersecurity operational information ontology Th

49、is ontology is a model for describing the acquisition, accumulation and use of cybersecurity information knowledge that consists of a set of operation domains, roles, and information types. The roles, described with human icons in the figure, are generic and entities such as CIRTs may encompass one or more of these functions. This model is used to define domains for cybersecurity operations, and is then used to identify required cybersecurity entities to support the operations in each domain. The details of the on