1、 International Telecommunication Union ITU-T X.1055TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (11/2008) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security Risk management and risk profile guidelines for telecommunication organizations Recommendation ITU-
2、T X.1055 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.60
3、0X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATION
4、S AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity
5、X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1055 (11/2008) i Reco
6、mmendation ITU-T X.1055 Risk management and risk profile guidelines for telecommunication organizations Summary Recommendation ITU-T X.1055 describes and recommends the processes, techniques and functional profiles for information security risk management for telecommunication to support Recommendat
7、ion ITU-T X.1051 | ISO/IEC 27011 and other ITU-T Recommendations. These processes and techniques can be used to assess security requirements and risks identified in telecommunication, and help to select, implement and maintain/update appropriate information security risk controls, i.e., the correct
8、information security level. There are many specific methodologies that have been developed to address the requirements for risk management. This Recommendation provides the criteria for assessing and selecting appropriate methodologies for a telecommunication organization. However, this does not aim
9、 to propose a specific risk management methodology for telecommunication. In addition, this Recommendation provides several risk profiles both in terms of ITU-T X.1051 management areas as well as telecom specific services areas. Source Recommendation ITU-T X.1055 was approved on 13 November 2008 by
10、ITU-T Study Group 17 (2009-2012) under Recommendation ITU-T A.8 procedure. ii Rec. ITU-T X.1055 (11/2008) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU T
11、elecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardizati
12、on Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technol
13、ogy which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance
14、 with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure e.g. interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligator
15、y language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of
16、 this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the
17、date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to cons
18、ult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2009 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1055 (11/2008) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1
19、Terms defined elsewhere 1 3.2 Terms defined in this Recommendation. 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Risk management . 2 6.1 Process 2 6.2 Risk categories 3 6.3 Risk components 4 6.4 Risk assessment and risk treatment 8 7 Risk profiles 9 7.1 Definition 9 7.2 Use of profiles 9 7.3 R
20、isk profile hierarchy. 9 7.4 Profile template 10 7.5 Development and maintenance of risk profiles 11 Annex A Risk profile example . 12 Bibliography. 13 iv Rec. ITU-T X.1055 (11/2008) Introduction Information security risks need to be managed effectively to ensure that organizations and their busines
21、s is suitably protected from a range of threats. In todays world, telecommunication organizations are operating in a highly dynamic, open and global market place where the boundaries between ICT, services and applications are becoming less defined, with greater complexity and options for information
22、 sharing and transfer, on-line business and mobile and wireless services. This computing and networking environment is open to a growing number of risks and threats that can have a dire impact on organizations and their business. Risks to telecommunication networks and services pose growing security
23、 threats to telecommunication providers, network and Internet service providers as well as to the businesses and the national infrastructure. This Recommendation provides an overview of the risks that need to be addressed and suitable protections that may be put in place to manage the risks. Rec. IT
24、U-T X.1055 (11/2008) 1 Recommendation ITU-T X.1055 Risk management and risk profile guidelines for telecommunication organizations 1 Scope This Recommendation provides information and advice relevant to the management of information security risks in telecommunication organizations. 2 References The
25、 following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this
26、 Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation doe
27、s not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.1051 Recommendation ITU-T X.1051 (2008) | ISO/IEC 27011:2008, Information technology Security techniques Information security management guidelines for telecommunications organizations based on ISO/IEC 27002. 3 Definit
28、ions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 impact b-ISO/IEC 27005: Adverse change to the level of business objectives achieved. 3.1.2 information security risk b-ISO/IEC 27005: The potential that a given threat will exploit vulnerabilities
29、of an asset or group of assets and thereby cause harm to the organization. It is measured in terms of a combination of the likelihood of an event and its consequence. 3.1.3 security incident b-ITU-T E.409: A security incident is any adverse event whereby some aspect of security could be threatened.
30、3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 risk profile: A set of information describing one of the risks identified by a telecommunication organization. 3.2.2 risk of exposure (RoE): Likelihood of a threat being able to expose one or more system
31、vulnerabilities. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: ADSL Asymmetric Digital Subscriber Line ASP Application Service Provider CATV Cable Television 2 Rec. ITU-T X.1055 (11/2008) DoS Denial of Service ICT Information and Communication Techno
32、logy IT Information Technology RoE Risk of Exposure 5 Conventions None. 6 Risk management 6.1 Process The risk management process includes the following steps: a-1) Assess the risk, considering the following: i) Assets and their value or utility. ii) Threats and vulnerabilities associated with these
33、 assets. iii) Risk of exposure of these assets to the threats and vulnerabilities. iv) Risk and impacts resulting from this risk of exposure. a-2) Treat the risk, considering the following: i) Identification of available risk management options. ii) Selection of preferred risk management option. iii
34、) Final risk management decision. b) Implement the risk management decision, considering the following: i) Selection of controls. ii) Allocation of resources, roles and responsibilities. iii) Implementation of controls. c) Monitor, review and communicate the risks, considering the following: i) Moni
35、toring the risk situation. ii) Risk-related measurements. iii) Review and re-assessment of the risks. iv) Communicate the risks. d) Update and improve the controls: i) Update controls. ii) Improve controls. Figure 1 illustrates the cyclic nature of the risk management process, which aims at achievin
36、g effective management and control of information security risks through a continuous improvement system of processes. Rec. ITU-T X.1055 (11/2008) 3 Figure 1 Risk management process 6.2 Risk categories Risk categories may include the following. 6.2.1 Information systems risk Information used by tele
37、communication organizations includes that related to customers, staff, operations and communications, network services, and so on, all of which are at risk. This includes sensitive and critical information as well as personal data. 6.2.2 Human resources risk Telecommunication organizations staff nee
38、ds to be trained, competent and qualified in many areas of the business. They need to take charge of roles and responsibilities that are security-related. 6.2.3 Operational risk The operational side of the telecommunication system needs to be efficient, effective and protected against the risk of be
39、ing compromised. 6.2.4 Network services risk The network services provided by a telecommunication organization need to be delivered in such a way that they are protected against the risk of being compromised. 6.2.5 IT services risk The technology deployed by a telecommunication organization for thei
40、r business and their customers needs to be reliable, robust and secure. 6.2.6 Physical risk The physical locations, sites, buildings, computer rooms and switching centres need to be physically secured against the threats. 6.2.7 Compliance risk Telecommunication organizations need to ensure that they
41、 are compliant with the laws and regulations that apply in the jurisdictions in which they are operating and providing services. This should include those laws and regulations that particularly apply to information security and the telecommunication organizations. 4 Rec. ITU-T X.1055 (11/2008) 6.3 R
42、isk components 6.3.1 Assets The following is based on clause 7.1.1 of ITU-T X.1051: Those assets which are critical to the telecommunication organization need to be protected in order to ensure that the operations and services of the telecommunication business are not compromised. Thus, telecommunic
43、ation organizations should make an inventory of assets. There can be many types of assets, including: Information: Communication data, routing information, subscriber information, blacklist information, registered service information, operational information, trouble information, configuration infor
44、mation, customer information, billing information, customer calling patterns, customer geographical locations, traffic statistical information, contracts and agreements, system documentation, research information, user manuals, training material, operational or support procedures, business continuit
45、y plans, emergency plan fallback arrangements, audit trails and archived information. Software assets: Communication control software, operation management software, subscriber information management software, billing software, application software, system software, development tools and utilities.
46、Hardware assets: Switches, cables, terminal equipment, computer equipment (e.g., servers and personal computers/workstations), removable media and other equipment. Services: Fixed telephone service, mobile telephone service, optical subscriber line/ADSL service, leased line/data circuit service, Int
47、ernet connection service, data centre service, CATV service, content delivery service, ASP service and customer services, including billing service, call centre service. Facility and supporting utility system: Building, electrical equipment, air-conditioning equipment, fire extinguishing equipment.
48、People: Customer service staff, telecommunication engineers, IT support staff and staff for third party service providers. Intangibles: Organization control, know-how, reputation and image of the organization. 6.3.2 Threats Threats may include the following. 6.3.2.1 Threats to confidentiality Eavesd
49、ropping. Electromagnetic radiation. Malicious code. Masquerading of user identity. Misrouting/rerouting of messages. Software failure. Theft. Unauthorized access to computers, data, services and applications. Unauthorized access to storage media. 6.3.2.2 Threats to integrity Unauthorized modification of information. Deterioration of storage media. Rec. ITU-T X.1055 (11/2008) 5 Malicious code. Masquerading of user identity. Misrouting/rerouting of messages. Repudiation. Software failures and vulnera
