1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1641 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cloud computing security Cloud computing security best practices and guidelines Guidelines fo
2、r cloud service customer data security Recommendation ITU-T X.1641 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499
3、DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management
4、X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IP
5、TV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERS
6、ECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X
7、.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For
8、 further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1641 (09/2016) i Recommendation ITU-T X.1641 Guidelines for cloud service customer data security Summary Recommendation ITU-T X.1641 provides generic security guidelines for the cloud service customer (CSC) data in clo
9、ud computing. It analyses the CSC data security lifecycle and proposes security requirements at each stage of the data lifecycle. Furthermore, Recommendation ITU-T X.1641 provides guidelines on when each control should be used for best security practice. History Edition Recommendation Approval Study
10、 Group Unique ID* 1.0 ITU-T X.1641 2016-09-07 17 11.1002/1000/12853 Keywords Cloud service customer data, data security controls, data security lifecycle. * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations uniq
11、ue ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1641 (09/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunic
12、ation Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly
13、 (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which f
14、all within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this
15、Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory languag
16、e such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this Reco
17、mmendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of ap
18、proval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TS
19、B patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2017 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1641 (09/2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.
20、1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 3 5 Conventions 3 6 Overview . 3 6.1 Specification of the data in this Recommendation . 3 6.2 Data security threats for cloud service customers 3 6.3 Existing requirements related to about data secu
21、rity 4 6.4 Data security lifecycle 5 7 Guidelines for security controls related to data security 5 7.1 Security controls in create stage . 5 7.2 Security controls in transmit stage . 5 7.3 Security controls in storage stage . 5 7.4 Security controls in use stage . 6 7.5 Security controls in migrate
22、stage 6 7.6 Security controls in destroy stage . 6 7.7 Security controls in backup and restore stage 7 Appendix I Guidelines for using security controls . 8 Bibliography. 9 Rec. ITU-T X.1641 (09/2016) 1 Recommendation ITU-T X.1641 Guidelines for cloud service customer data security 1 Scope This Reco
23、mmendation provides guidelines for cloud service customer (CSC) data security in cloud computing, for those cases where the cloud service provider (CSP) is responsible for ensuring that the data is handled with proper security. This is not always the case, since for some cloud services the security
24、of the data is the responsibility of CSCs themselves. In other cases, the responsibility may be mixed. For example, in some cases the CSP may be responsible for restricting access to the data, while the CSC remains responsible for deciding which cloud service users (CSUs) should have access to it, a
25、nd the behaviour of any scripts or applications with which the CSU processes the data. This Recommendation identifies security controls for CSC data that can be used in different stages of the full data lifecycle. These security controls can differ when the security level of the CSC data changes. Th
26、erefore, this Recommendation provides guidelines on when each control should be used for best security practice. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time o
27、f publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A lis
28、t of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.1601 Recommendation ITU-T X.1601 (2015), Security framework for cloud computing. ITU-T X.
29、1631 Recommendation ITU-T X.1631 (2015) | ISO/IEC 27017:2015, Information technology Security techniques Code of practice for information security controls based on ISO/IEC 27002 for cloud services. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewh
30、ere: 3.1.1 authentication b-NIST-SP-800-53: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system. 3.1.2 cloud computing b-ITU-T Y.3500: Paradigm for enabling network access to a scalable and elastic pool of shareable p
31、hysical or virtual resources with self-service provisioning and administration on-demand. NOTE Examples of resources include servers, operating systems, networks, software, applications, and storage equipment. 3.1.3 cloud service b-ITU-T Y.3500: One or more capabilities offered via cloud computing i
32、nvoked using a defined interface. 2 Rec. ITU-T X.1641 (09/2016) 3.1.4 cloud service customer b-ITU-T Y.3500: Party which is in a business relationship for the purpose of using cloud services. NOTE A business relationship does not necessarily imply financial agreements. 3.1.5 cloud service customer d
33、ata b-ITU-T Y.3500: Class of data objects under the control, by legal or other reasons, of the cloud service customer that were input to the cloud service, or resulted from exercising the capabilities of the cloud service by or on behalf of the cloud service customer via the published interface of t
34、he cloud service. NOTE 1 An example of legal controls is copyright. NOTE 2 It may be that the cloud service contains or operates on data that is not cloud service customer data; this might be data made available by the cloud service providers , or obtained from another source, or it might be publicl
35、y available data. However, any output data produced by the actions of the cloud service customer using the capabilities of the cloud service on this data is likely to be cloud service customer data, following the general principles of copyright, unless there are specific provisions in the cloud serv
36、ice agreement to the contrary. 3.1.6 cloud service derived data b-ITU-T Y.3500: Class of data objects under cloud service provider control that are derived as a result of interaction with the cloud service by the cloud service customer. 3.1.7 cloud service provider b-ITU-T Y.3500: Party which makes
37、cloud services available. 3.1.8 cloud service user b-ITU-T Y.3500: Natural person, or entity acting on their behalf, associated with a cloud service customer that uses cloud services. NOTE Examples of such entities include devices and applications. 3.1.9 infrastructure as a service (IaaS) b-ITU-T Y.
38、3500: Cloud service category in which the cloud capabilities type provided to the cloud service customer is an infrastructure capabilities type. 3.1.10 multi-tenancy b-ITU-T Y.3500: Allocation of physical or virtual resources such that multiple tenants and their computations and data are isolated fr
39、om and inaccessible to one another. 3.1.11 platform as a service (PaaS) b-ITU-T Y.3500: Cloud service category in which the cloud capabilities type provided to the cloud service customer is a platform capabilities type. 3.1.12 party b-ITU-T Y.3500: Natural person or legal person, whether or not inco
40、rporated, or a group of either. 3.1.13 personally identifiable information b-ISO/IEC 29100: Any information that (a) can be used to identify the PII principal to whom such information relates, or (b) is or might be directly or indirectly linked to a PII principal. 3.1.14 PII principal b-ISO/IEC 2910
41、0: Natural person to whom the personally identifiable information (PII) relates. NOTE Depending on the jurisdiction and the particular data protection and privacy legislation, the synonym “data subject“ can also be used instead of the term “PII principal“. 3.1.15 software as a service (SaaS) b-ITU-T
42、 Y.3500: Cloud service category in which the cloud capabilities type provided to the cloud service customer is an application capabilities type. 3.1.16 tenant b-ITU-T Y.3500: One or more cloud service users sharing access to a set of physical and virtual resources. 3.1.17 threat b-ISO/IEC 27000: Pot
43、ential cause of an unwanted incident, which may result in harm to a system or organization. 3.2 Terms defined in this Recommendation None. Rec. ITU-T X.1641 (09/2016) 3 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: CSC Cloud Service Customer CSP Clou
44、d Service Provider CSU Cloud Service User IaaS Infrastructure as a Service PaaS Platform as a Service PII Personally Identifiable Information SaaS Software as a Service 5 Conventions None. 6 Overview 6.1 Specification of the data in this Recommendation CSC data includes private data of customers sto
45、red on a cloud platform and related data through cloud services for CSC, such as account information, login record and operation log. The difference between the terms CSC (see clause 3.1.4) and CSU (see clause 3.1.8) is further distinguished as follows. The CSC is the person or organization that ent
46、ers into the legal relationship with the CSP. So the CSC could be an enterprise, a subsidiary, a government department or an individual consumer. The CSU is the person, device or application that uses the cloud service that has been contracted for. The CSU could be a government employee, an applicat
47、ion running on a smartphone, an individual consumer or a member of a household, such as a child. The CSC usually nominates some CSUs to act as administrators and manage the relationship between the CSC and the CSP. A CSU always acts on behalf of a CSC. Most employee CSUs need to have little or no vi
48、sibility of what or how the CSP operates, or the services that the CSC has contracted for, unless the CSC decides they need to know (e.g. administrators and internal auditors). A CSC can include multiple cloud tenants. A tenant can include multiple CSUs. 6.2 Data security threats for cloud service c
49、ustomers As the cloud service environment is typically multi-tenant, loss or leakage of data is a serious threat to the CSC. The lack of appropriate management of cryptographic information, such as encryption keys, authentication codes and access privilege, could lead to significant damage, such as data loss and unexpected data leakage. For example, insufficient authentication, authorization and audit controls; inconsistent use of encryption or authentication keys; operational f
