1、 International Telecommunication Union ITU-T X.1500TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2011) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Overview of cybersecurity Overview of cybersecurity information exchange Recommendation ITU
2、-T X.1500 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.
3、600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATI
4、ONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurit
5、y X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519Vulnerability/state exchange X.
6、1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.15
7、00 (04/2011) i Recommendation ITU-T X.1500 Overview of cybersecurity information exchange Summary Recommendation ITU-T X.1500 describes techniques for exchanging cybersecurity information. These techniques can be used individually or in combinations, as desired or appropriate, to enhance cybersecuri
8、ty through coherent, comprehensive, global, timely and assured information exchange. No obligations to exchange information are implied, nor are the means of acquisition or ultimate use of the information treated. Cybersecurity information exchange (CYBEX) is one of the elements providing confidence
9、 and security in the use of ICTs. History Edition Recommendation Approval Study Group 1.0 ITU-T X.1500 2011-04-20 17 ii Rec. ITU-T X.1500 (04/2011) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and co
10、mmunication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis.
11、 The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resoluti
12、on 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and
13、 a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are me
14、t. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possib
15、ility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Re
16、commendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest informat
17、ion and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1500 (04/2011) iii Table of Content
18、s Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 2 5 Conventions 3 6 Basic concept Cybersecurity information exchange (CYBEX) 3 7 Structured cybersecurity information exchange techniques . 4 7.1 W
19、eakness, vulnerability and state exchange cluster 5 7.2 Event, incident, and heuristics exchange cluster . 5 7.3 Information exchange policy exchange cluster . 6 7.4 Identification, discovery, and query cluster . 6 7.5 Identity assurance cluster . 7 7.6 Exchange protocol cluster 7 Appendix I Structu
20、red cybersecurity information exchange techniques 8 Appendix II A cybersecurity information exchange ontology 16 II.1 Operation domains 17 II.2 Cybersecurity entities . 17 II.3 Cybersecurity operational information . 18 Appendix III CYBEX examples of security automation schemas 20 III.1 Example: USA
21、 Federal Desktop Core Configuration/United States Government Configuration Baseline 21 III.2 Example: Japan vulnerability information portal site, JVN . 21 Bibliography. 25 iv Rec. ITU-T X.1500 (04/2011) Introduction This Recommendation is intended to be adaptable, extensible, and non-prescriptive t
22、o allow a wide range of techniques some of which are continuously evolving and in varying stages of completion to be applied in different instantiations to enhance the exchange of cybersecurity information about telecommunication/ICT infrastructure, devices, and services. It will be revised periodic
23、ally as those techniques evolve those that are appropriate will be published as ITU-T Recommendations in the ITU-T X.1500 series. The expectation for the techniques embodied in this Recommendation is that telecommunication/ ICT organizations, including computer incident response teams (CIRTs), both
24、within and between jurisdictions, will: a) have information to enable decision making and action to substantially enhance the confidentiality, integrity and availability of global telecommunication/ICT facilities and services; b) have information to facilitate secure collaborative processes and cont
25、rols which improve the level of assurance in the information exchanges between organizations; c) enable a coherent approach to manage and exchange cybersecurity information on a global basis; d) improve security awareness and collaboration to diminish cyberthreats, cyberattacks and malware. The tech
26、niques include: structuring cybersecurity information for exchange purposes; identifying and discovering cybersecurity information and entities; establishment of trust and policy agreement between exchanging entities; requesting and responding with cybersecurity information; assuring the integrity o
27、f the cybersecurity information exchange; and are organized into “clusters“: Weakness, vulnerability and state. Event, incident, and heuristics. Information exchange policy. Identification, discovery, and query. Identity assurance. Exchange protocols. Rec. ITU-T X.1500 (04/2011) 1 Recommendation ITU
28、-T X.1500 Overview of cybersecurity information exchange 1 Scope This Recommendation presents a cybersecurity information exchange (CYBEX) model and discusses techniques that can be used to facilitate the exchange of cybersecurity information. These techniques can be used individually or in combinat
29、ions, as desired or appropriate, to enhance cybersecurity through coherent, comprehensive, global, timely and assured information exchange. No obligations to exchange information are implied, nor are the means of acquisition or ultimate use of the information treated. The techniques include the stru
30、ctured global discovery and interoperability of cybersecurity information in such a way as to allow for continual evolution to accommodate the significant activities and specification evolution occurring in numerous cybersecurity forums. CYBEX is one of the elements providing confidence and security
31、 in the use of ICTs. This Recommendation has the following basic functions that can be used separately or together as appropriate: structuring cybersecurity information for exchange purposes; identifying and discovering cybersecurity information and entities; establishment of trust and policy agreem
32、ent between exchanging entities; requesting and responding with cybersecurity information; assuring the integrity of the cybersecurity information exchange. Subject to agreed policies and applicable laws and regulations, the means of acquiring information as well as the uses made of the information
33、are specifically out of scope and not treated in this Recommendation. Some specific national and regional regulations and legislations may require implementation of mechanisms to protect personally identifiable information. Neither the techniques described in this Recommendation nor the exchange of
34、related cybersecurity information are mandated by this Recommendation. 2 References None. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 cybersecurity b-ITU-T X.1205: The collection of tools, policies, security concepts, security safeg
35、uards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and users assets. Organization and users assets include connected computing devices, personnel, infrastructure, applications
36、, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment. Cybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and users assets against relevant security risks in the cyber envi
37、ronment. The general security objectives comprise availability, integrity (which may include authentication and non-repudiation) and confidentiality. NOTE Some specific national regulations and legislations may require implementation of mechanisms to protect personally identifiable information. 2 Re
38、c. ITU-T X.1500 (04/2011) 3.1.2 security incident b-ITU-T E.409: Any adverse event whereby some aspect of security could be threatened. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 assurance: The degree of confidence that the process or deliverable
39、meets defined characteristics or objectives. 3.2.2 exchange protocol: A set of technical rules and format governing the exchange of information between two or more entities. 3.2.3 information exchange policy: The terms and conditions associated with the use and sharing of cybersecurity information.
40、3.2.4 system state: The current status of a system or entity, including such information as its configuration, memory usage, or other data relevant to cybersecurity. 3.2.5 vulnerability (aligned with b-ITU-T X.800): Any weakness that could be exploited to violate a system or the information it conta
41、ins. 3.2.6 weakness: A shortcoming or imperfection that, while not itself being recognized as a vulnerability, could, at some point become a vulnerability, or could contribute to the introduction of other vulnerabilities. 4 Abbreviations and acronyms This Recommendation uses the following abbreviati
42、ons and acronyms: ARF Assessment Results Format or Asset Reporting Format (depending on the context) BEEP Blocks Extensible Exchange Protocol CA Certification Authority CAPEC Common Attack Pattern Enumeration and Classification CCE Common Configuration Enumeration CEE Common Event Expression CEEE Co
43、mmon Event Expression Exchange CIRT Computer Incident Response Team CPE Common Platform Enumeration CVE Common Vulnerabilities and Exposures CVSS Common Vulnerability Scoring System CWE Common Weakness Enumeration CWSS Common Weakness Scoring System CYBEX Cybersecurity Information Exchange CYIQL Cyb
44、ersecurity Information Query Language DDoS Distributed Denial of Service EVC Extended Validation Certificates EVCERT Extended Validation Certificate HTTP HyperText Transfer Protocol Rec. ITU-T X.1500 (04/2011) 3 IC Integrated Circuit ICT Information and Communication Technology IDS Intrusion Detecti
45、on System IODEF Incident Object Description Exchange Format IPS Intrusion Prevention System IT Information Technology MAEC Malware Attribute Enumeration and Characterization OID Object Identifier OS Operating System OVAL Open Vulnerability and Assessment Language RID Real-time Inter-network Defense
46、SCAP Security Content Automation Protocol SOAP Simple Object Access Protocol TLP Traffic Light Protocol TLS Transport Layer Security TNC Trusted Network Connect TPM Trusted Platform Module XCCDF eXtensible Configuration Checklist Description Format 5 Conventions When the term “standard“ or “standard
47、s“ is used in this Recommendation in the generic sense, it should be interpreted to include: standards; specifications and Recommendations. 6 Basic concept Cybersecurity information exchange (CYBEX) This cybersecurity information exchange (CYBEX) Recommendation is intended to accomplish a simple, li
48、mited objective describe techniques by which cybersecurity entities can exchange cybersecurity information using methods which provide a suitable level of assurance. Such entities typically consist of organizations, persons, devices, or processes possessing or seeking cybersecurity information. Most
49、 frequently, these entities are CIRTs and the operators or vendors of equipment, software or network-based systems. Cybersecurity information exchange is valuable for achieving enhanced cybersecurity and infrastructure protection, as well as contributing to the principal functions performed by CIRTs. The exchange of cybersecurity information can occur within highly compartmentalized trust communities adhering to need-to-know principles based on previously agreed-upon policies
