1、 International Telecommunication Union ITU-T Series XTELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 6(09/2009) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY ITU-T X.1240 series Supplement on countering spam and associated threats ITU-T X-series Recommendations Suppleme
2、nt 6 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.
3、699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS A
4、ND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1
5、200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 For further details, please refer to the list of ITU-T Recommendations. X series Supplement 6 (09/2009) i Sup
6、plement 6 to ITU-T X-series Recommendations ITU-T X.1240 series Supplement on countering spam and associated threats Summary Supplement 6 to ITU-T X-series Recommendations states that in order to deal effectively with spam, governments need to employ a variety of approaches, including effective laws
7、, technological tools, and consumer and business education. This supplement reviews the international forums where the issue of spam is being addressed. As a case study, for illustrative purposes, it provides some information about the way the U.S. and Japan have approached the spam problem. Source
8、Supplement 6 to ITU-T X-series Recommendations was agreed on 25 September 2009 by ITU-T Study Group 17 (2009-2012). ii X series Supplement 6 (09/2009) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and
9、 communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide bas
10、is. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resol
11、ution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and
12、 a recognized operating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure e.g., interoperability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The wor
13、ds “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that th
14、e practice or implementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication develo
15、pment process. As of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this publication. However, implementers are cautioned that this may not represent the latest information and are therefore str
16、ongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2010 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. X series Supplement 6 (09/2009) iii CONTENTS Page 1 Scope 1 2 References.
17、 1 3 Definitions 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Background . 2 7 National approaches to deal effectively with spam and associated threats 2 8 International (multilateral) countering spam initiatives . 3 8.1 London Action Plan 3 8.2 OECD Spam Toolkit and Council Recommendation on
18、Spam Enforcement Cooperation . 3 8.3 APEC TEL Symposium on spam . 4 9 Case study of some activities to counter spam . 4 9.1 United States . 4 9.2 Japan . 6 Bibliography. 9 X series Supplement 6 (09/2009) 1 Supplement 6 to ITU-T X-series Recommendations ITU-T X.1240 series Supplement on countering sp
19、am and associated threats 1 Scope The topic of this supplement is spam and associated threats. This supplement is intended for national administrators who are newcomers to the concept of spam and would like some basic information about it. This supplement looks at the tools that need to be employed
20、to combat spam effectively and describes the work that some international forums are doing in this area. It provides, as a case study and for illustrative purposes, a description of what the U.S. and Japan are doing to combat spam. 2 References None. 3 Definitions This supplement defines the followi
21、ng terms: 3.1 phishing: An attempt to fool an individual into going to the wrong website with the intent of stealing that individuals private information. 3.2 spam: Although there is no universally agreed definition of spam, the term is commonly used to describe unsolicited electronic bulk communica
22、tions over e-mail or mobile messaging (SMS, MMS). 4 Abbreviations and acronyms This supplement uses the following abbreviations: ADSP Author Domain Sending Practices APEC TEL Asia-Pacific Economic Community Telecommunication and Information Working Group CAN-SPAM Controlling the Assault of Non-Solic
23、ited Pornography and Marketing Act of 2003 (U.S.) CNSA Contact Network of Spam Authorities (European Union) DKIM Domain Keys Identified Mail FCC Federal Communications Commission (U.S.) FTC Federal Trade Commission (U.S.) ISP Internet Service Provider JEAG Japan Email Anti-abuse Group (Japan) LAP Lo
24、ndon Action Plan MAAWG Messaging Anti-Abuse Working Group MMS Multimedia Messaging Service MSCM Mobile Service Commercial Messages 2 X series Supplement 6 (09/2009) OECD Organisation for Economic Co-operation and Development OP25B Outbound Port 25 Blocking SMS Short Messaging Service SPF Sender Poli
25、cy Framework 5 Conventions None. 6 Background 6.1 Spam has gone from being nuisance communications containing commercial advertisements to a facilitator of a more serious cybersecurity problem. For example, spam can be a vehicle for deception, spreading malware such as viruses and spyware, and induc
26、ing consumers to provide confidential information that can later be used to commit identity theft (i.e., phishing). Spammers take advantage of the fact that they can send their messages from anywhere in the world to anyone in the world at an extremely low cost to themselves. This makes spam an inter
27、national problem that must be addressed through international cooperation. 6.2 Phishing takes advantage of the fact that, due to a basic characteristic in the Internets e-mail system1, anyone can send e-mail to anyone with almost no form of authentication. Phishing is an attempt to fool someone into
28、 going to the wrong website with the intent of stealing that individuals private information. Phishing exists in large part because sometimes people expect to receive e-mail from a popular site and they simply do not realize that the mail is not from the legitimate site. Because there is little auth
29、entication in e-mails, it is difficult to determine whether a message is legitimate without careful inspection of the message. Such careful inspection requires substantial knowledge of the underlying mechanisms used on the web. Phishing also exists because most people find it difficult to verify tha
30、t the websites they are going to are legitimate. Sometimes we do not look closely at the URL of a web page before entering sensitive information, and sometimes we just do not know what the correct URL should be. The web servers used to “phish“ sensitive information are often themselves the victims o
31、f malware, making it again extremely difficult to track phishers. 6.3 Malware, or malicious software that is made to run on a device without the knowledge or permission of the owner, is also a substantial problem. 7 National approaches to deal effectively with spam and associated threats 7.1 Nationa
32、l strategy and spam: With respect to a national strategy, countries should develop and maintain a combination of effective laws, law enforcement authorities and tools, technological tools and best practices, and consumer and business education to effectively deal with spam. 7.2 Legal and regulatory
33、foundation and spam: With respect to a legal foundation and regulatory framework, authorities that have jurisdiction over spam must have the necessary authority to investigate and take action against violations of laws related to spam that are committed from their country or cause effects in their c
34、ountry. Authorities that have jurisdiction over spam should also have mechanisms to cooperate with foreign authorities. Requests for assistance from _ 1The Internet e-mail system was designed in the 1970s when access to the Internet was limited to very few researchers and government members. There w
35、as no need to authenticate the identity of individuals sending e-mail, and therefore no effort was made to design the system to do so. While the e-mail system has evolved since then, this basic omission has been present ever since. X series Supplement 6 (09/2009) 3 foreign authorities should be prio
36、ritized based on areas of common interest and in cases where significant harm occurs. 7.3 Government-industry collaborations and promotion of national awareness of spam and associated threats: All interested persons, including enforcement authorities, businesses, industry groups, and consumer groups
37、 should cooperate in pursuing violations of laws related to spam. Government enforcement agencies should partner with industry and consumer groups to educate users and promote information sharing. Government enforcement agencies should cooperate with the private sector to promote the development of
38、technological tools to fight spam, including tools to facilitate the location and identification of spammers. Phishing is often a preventable crime. Governments should work together with the private sector to improve means of protecting citizens from phishing, and educating consumers and businesses
39、on safe authentication methods. Governments can also play a role in educating the public on the need to keep malware in check by making use of tools such as anti-virus software and by applying the latest operating system patches and trusted computing techniques. 8 International (multilateral) counte
40、ring spam initiatives Several multilateral fora are working on initiatives to combat spam. These include: 8.1 London Action Plan The U.S. Federal Trade Commission (FTC) and the U.K. Office of Fair Trading hosted an International Spam Enforcement Conference in London in 2004, which led to the creatio
41、n of a London Action Plan on international spam enforcement cooperation (LAP). As of July 2008, government agencies and private sector representatives from more than 25 countries have endorsed the plan. The LAP encourages interested parties, including spam enforcement agencies and private sector sta
42、keholders, to consider applying for membership in the organization. The purpose of the LAP is to promote international spam enforcement cooperation and address spam related problems, such as online fraud and deception, phishing, and dissemination of viruses. The LAP builds relationships among these
43、entities based on a short document that sets forth a basic work plan for improving international enforcement and education cooperation against illegal spam. This document is non-binding, asking participants only to use best efforts to move the work plan forward. http:/londonactionplan.org/ Since its
44、 inception, the LAP has held annual workshops, typically in conjunction with the European Unions Contact Network of Spam Authorities (CNSA). In October, 2007, the LAP and CNSA co-located their annual joint workshop with the Messaging Anti-Abuse Working Group (MAAWG) conference in Arlington, Virginia
45、, which facilitated increased law enforcement cooperation with the private sector. In October 2008, the LAP and CNSA co-located their annual joint workshop with Ecos 6th German Anti-Spam Summit in Wiesbaden, Germany. 8.2 OECD Spam Toolkit and Council Recommendation on Spam Enforcement Cooperation In
46、 April 2006, the OECD Spam Task Force released an Anti-Spam “Toolkit“, which contains recommendations to help policy makers, regulators and industry players orient their policies relating to spam solutions and restore trust in the Internet and e-mail. The Toolkit contains eight elements, including a
47、nti-spam regulation, industry driven solutions and anti-spam technologies, education and awareness, and global cooperation/outreach. Recognizing that international cooperation is key to combating spam, the OECD governments also approved a “Recommendation on Cross-Border Co-operation in the Enforceme
48、nt of Laws against Spam“, which urges countries to 4 X series Supplement 6 (09/2009) ensure that their laws enable enforcement authorities to share information with other countries and do so more quickly and effectively. http:/www.oecd-antispam.org/sommaire.php3. 8.3 APEC TEL Symposium on spam In Ap
49、ril 2006, APEC TEL held a symposium on “Spam and Related Threats“ that brought together thirty speakers and panelists to discuss the evolution of the spam problem and establish a common agenda of action for the TEL. The main topics addressed included: 1) the development and application of national anti-spam regulatory regimes, including enforcement and codes of practice; 2) the role of industry in combating spam, including government-industry collaboration; 3) technical responses to spam; 4) cr
