1、 International Telecommunication Union ITU-T X.1500TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Amendment 3(04/2013) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Overview of cybersecurity Overview of cybersecurity information exchange Amendme
2、nt 3: Revised structured cybersecurity information exchange techniques Recommendation ITU-T X.1500 (2011) Amendment 3 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWO
3、RKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029
4、 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security
5、 X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1
6、339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured e
7、xchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) i Recommendation ITU-T X.1500 Overview of cybersecurity information exchange Amendment 3 Revised structured cybersecurity information exchange techniques Summary Amen
8、dment 3 to Recommendation ITU-T X.1500 (2011) provides a list of revised structured cybersecurity information techniques that has been created to be constantly updated as these techniques evolve, expand, are newly identified or are replaced. The list follows the outline provided in the body of the R
9、ecommendation. This amendment reflects the situation of recommended techniques as of April 2013, including bibliographical references. History Edition Recommendation Approval Study Group 1.0 ITU-T X.1500 2011-04-20 17 1.1 ITU-T X.1500 (2011) Amd. 1 2012-03-02 17 1.2 ITU-T X.1500 (2011) Amd. 2 2012-0
10、9-07 17 1.3 ITU-T X.1500 (2011) Amd. 3 2013-04-26 17 ii Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommun
11、ication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assemb
12、ly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which
13、 fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with thi
14、s Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory langu
15、age such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this R
16、ecommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of
17、 approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the
18、 TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2013 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) 1 Recommendation ITU-T X.1500 Overview of cybersecurity in
19、formation exchange Amendment 3 Revised structured cybersecurity information exchange techniques 1) Replace Appendix I with the appendix below. Appendix I Structured cybersecurity information exchange techniques (This appendix does not form an integral part of this Recommendation.) Table I.1 Techniqu
20、es in the weakness, vulnerability and state exchange cluster Technique Description References Common vulnerabilities and exposures (CVE) Common vulnerabilities and exposures is a method for identifying and exchanging information security vulnerabilities and exposures, and provides common identifiers
21、 for publicly known problems. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, repositories, and services) with this “common enumeration“. CVE is designed to allow vulnerability databases and other resources to be linked together, and to facilitat
22、e the comparison of security tools and services. As such, CVE does not contain information such as risk, impact, fix information, or detailed technical information. CVE only contains the standard identifier number with a status indicator, a brief description, and references to related vulnerability
23、reports and advisories. The intention of CVE is to be comprehensive with respect to all publicly known vulnerabilities and exposures. While CVE is designed to contain mature information, the primary focus is on identifying vulnerabilities and exposures that are detected by security tools, as well as
24、 identifying any new problems that become public, and then addressing any older security problems that require validation. b-ITU-T X.1520 2 Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) Table I.1 Techniques in the weakness, vulnerability and state exchange cluster Technique Description References Common
25、vulnerability scoring system (CVSS) The common vulnerability scoring system process provides for an open framework for communicating the characteristics and impacts of ICT vulnerabilities. The CVSS consists of three groups: base, temporal and environmental. Each group produces a numeric score rangin
26、g from 0 to 10, and a vector, a compressed textual representation that reflects the values used to derive the score. The base group represents the intrinsic qualities of a vulnerability. The temporal group reflects the characteristics of a vulnerability that change over time. The environmental group
27、 represents the characteristics of a vulnerability that are unique to the environment of the user. The CVSS enables ICT managers, vulnerability bulletin providers, security vendors, application vendors and researchers to all benefit by adopting a common language of scoring ICT vulnerabilities. b-ITU
28、-T X.1521 Common weakness enumeration (CWE) Common weakness enumeration is a process for identifying and exchanging unified, measurable sets of software weaknesses. CWE enables more effective discussion, description, selection, and use of software security tools and services that can find these weak
29、nesses in source code and operational systems. It also provides for better understanding and management of software weaknesses related to architecture and design. CWE implementations are compiled and updated by a diverse, international group of experts from business, academia and government agencies
30、, ensuring breadth and depth of content. CWE provides standardized terminology, allows service providers to inform users of specific potential weaknesses and proposed resolutions, and allows software buyers to compare similar products offered by multiple vendors. b-ITU-T X.1524 Common weakness scori
31、ng system (CWSS) The common weakness scoring system provides for an open framework for communicating the characteristics and impacts of software weakness. b-CWSS See Note. Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) 3 Table I.1 Techniques in the weakness, vulnerability and state exchange cluster Techni
32、que Description References Open vulnerability and assessment language (OVAL) Open vulnerability and assessment language is an international specification effort to promote open and publicly available security content, and to standardize the transfer of this information across the entire spectrum of
33、security tools and services. OVAL includes a language used to encode system details, and an assortment of content repositories held throughout the community. The language standardizes the three main steps of the assessment process: representing configuration information of systems for testing, analy
34、sing the system for the presence of the specified machine state (vulnerability, configuration, patch state, etc.), and reporting the results of this assessment. The repositories are collections of publicly available and open content that utilize the language. OVAL schemas written in XML have been de
35、veloped to serve as the framework and vocabulary of the OVAL language. These schemas correspond to the three steps of the assessment process: an OVAL system characteristics schema for representing system information, an OVAL definition schema for expressing a specific machine state, and an OVAL resu
36、lts schema for reporting the results of an assessment. b-ITU-T X.1526 eXtensible configuration checklist description format (XCCDF) The eXtensible configuration checklist description format is a specification language for writing security checklists, benchmarks, and related kinds of documents. An XC
37、CDF document represents a structured collection of security configuration rules for a set of target systems. The specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing, and compliance scoring. The spec
38、ification also defines a data model and format for storing results of benchmark compliance testing. The intent of XCCDF is to provide a uniform foundation for expression of security checklists, benchmarks, and other configuration guidance, and thereby foster more widespread application of good secur
39、ity practices. XCCDF documents are expressed in XML. b-XCCDF Common platform enumeration (CPE) Common platform enumeration (CPE) is a standardized method to identify and describe the software systems and hardware devices present in an enterprises computing asset inventory. CPE provides: a naming spe
40、cification, including the logical structure of well-formed CPE names and the procedures for binding and unbinding these names with machine-readable encodings; a matching specification, which defines procedures for comparing CPE names to determine whether they refer to some or all of the same product
41、s or platforms; and a dictionary specification, which defines the concept of a dictionary of identifiers and prescribes high-level rules for dictionary curators. b-ITU-T X.1528 b-ITU-T X.1528.1 b-ITU-T X.1528.2 b-ITU-T X.1528.3 b-ITU-T X.1528.4 Common configuration enumeration (CCE) Common configura
42、tion enumeration provides unique identifiers to system configuration issues in order to facilitate fast and accurate correlation of configuration data across multiple information sources and tools. For example, CCE identifiers can be used to associate checks in configuration assessment tools with st
43、atements in configuration best-practice documents. b-CCE See Note. 4 Rec. ITU-T X.1500 (2011)/Amd.3 (04/2013) Table I.1 Techniques in the weakness, vulnerability and state exchange cluster Technique Description References NOTE ITU is currently considering the creation of an ITU-T Recommendation spec
44、ifying this technique. Table I.2 Techniques relevant to the event, incident, and heuristics exchange cluster Technique Description References Common event expression (CEE) Common event expression standardizes the way computer events are described, logged, and exchanged. By using CEEs common language
45、 and syntax, enterprise-wide log management, correlation, aggregation, auditing, and incident handling can be performed more efficiently and produce better results. The primary goal of the effort is to standardize the representation and exchange of logs from electronic systems. CEE breaks the record
46、ing and exchanging of logs into three (3) components: profile, log syntax and log transport. b-CEE See Note. Incident object description exchange format (IODEF) The incident object description exchange format defines a data representation that provides a standard format for the exchange of commonly
47、exchanged information about computer security incidents. IODEF describes an information model and provides an associated data model specified with XML schema. b-ITU-T X.1541 Extensions to IODEF for reporting Phishing This extends the incident object description exchange format to support the reporti
48、ng of phishing events. Recommendation ITU-T X.1500 is intended to only describe techniques for commonly understood, assured means for cybersecurity entities to exchange cybersecurity information, and does not include the uses of that information. b-IETF RFC 5901 Common attack pattern enumeration and
49、 classification (CAPEC) CAPEC is a specification method for the identification, description, and enumeration of attack patterns. Attack patterns are a powerful mechanism to capture and communicate the attackers perspective. They are descriptions of common methods for exploiting software. They derive from the concept of design patterns applied in a destructive rather than constructive context and are generated from in-depth analysis of specific real-world exploit examples. The objective of CAPEC is to provide
