Security Management of Next Generation Telecommunications Networks and Services

STUART JACOBS is Principal Consultant for YCS Consulting LLC and a Lecturer at Boston University Metropolitan College. He serves as an Industry Security Subject Matter Expert for the Telecommunications Management and Operations Committee (TMOC) of the Alliance for the Telecommunications Industry Solutions (ATIS). Mr. Jacobs has also served as a technical editor of ATIS Joint Committee Technical Reports and ITU-T Recommendations.

• Preface xiAcknowledgments xv1 INTRODUCTION 11.1 Evolution of Networking Concepts 41.1.1 The Public Switched Telephone Network 41.1.2 Computer/Data Communications Networks 51.1.3 Network Architectures 61.1.4 Data Network Complexity 81.2 A Network Security Historical Perspective 131.2.1 ISO/IEC 7498–1 (ITU-T X.200) Coverage of Management 141.2.2 ISO/IEC 7498–4 (ITU-T X.700) Coverage of Security Management 151.2.3 ISO/IEC 7498–2 (ITU-T X.800) Coverage of Security and Management 151.2.4 The Security Frameworks (ITU-T X.810–ITU-T X.816) 231.2.5 The ITU-T X.805 Approach to Security 251.3 Network and Security Management Systems 261.3.1 Element and Network Management Systems 261.3.2 Operations Support Systems 271.4 Evolution of Network and Security Management Concepts 291.4.1 Telecommunications Management Network 291.4.2 Next Generation Operations Systems and Software 471.4.3 Enhanced Telecom Operations Map 501.5 How the Need for Information Security has Changed 571.6 Summary 61Further Reading and Resources 622 OVERVIEW OF CURRENT AND FUTURE NETWORKS 632.1 A Little Network History 632.1.1 Point-to-Point Data Communications 642.1.2 Early Commercial Packet Switching 642.1.3 The ARPANET: Internet 642.1.4 Ethernet and IEEE 802.3 702.1.5 Network Address Translation 712.2 Common Network Organizations 722.2.1 Wired Local Area Networks 742.2.2 Wireless Networks 832.2.3 Metropolitan Area Networks 872.2.4 Wide Area Networks 942.2.5 Networks Are Now Layered upon Networks 962.2.6 Additional Networking Developments 962.2.7 Security Mechanisms in Modern Networks 1052.3 Next-Generation Networks and Interfaces 1082.3.1 Framework and Topology of the NGN 1082.3.2 IP Multimedia Subsystem 1252.4 Summary 133Further Reading and Resources 1363 SECURITY MANAGEMENT IN CURRENT AND FUTURE NETWORKS 1393.1 Cybercrime as a Driver for Information Security Management 1403.2 Governance as a Driver for Information Security Management 1423.2.1 What Is Governance? 1423.2.2 Information System Security Governance 1433.3 Information Security Management Frameworks 1453.3.1 ISO/IEC 27000 Series 1463.3.2 The Information Technology Infrastructure Library Framework 1643.3.3 COBIT Framework 1673.3.4 FISMA Framework 1733.4 A Holistic Approach for Security Management 1763.4.1 Organizational Aspects of Security Governance and Management 1763.4.2 Policies and Policy Hierarchies 1803.4.3 Functional and Operational Security Requirements 1833.5 Summary 189Further Reading and Resources 1894 RISK MANAGEMENT IN CURRENT AND FUTURE NETWORKS 1914.1 Asset Identification: Definition and Inventorying 1934.2 Impact Analysis 2244.2.1 Existing System Impact Analysis 2244.2.2 New System Impact Analysis 2364.2.3 Risk Mitigation Analysis 2404.2.4 Malicious Security Events and Threat Assessment 2434.3 Risk Mitigation Controls Acquisition or Development 2574.3.1 Procedural Risk Mitigation Controls 2574.3.2 New Technical Risk Mitigation Controls 2584.4 Risk Mitigation Controls Deployment Testing 2734.5 Summary 274Further Reading and Resources 2755 OPERATIONAL MANAGEMENT OF SECURITY 2775.1 Securing Management Applications and Communications 2785.1.1 Security within Element and Network Management Systems 2785.1.2 Telecommunications Management Network Security 2795.1.3 Operations Support System Security Needs 2815.1.4 Reflections on Past ITU Treatment of Managing Security 2855.1.5 Management of Security Services and Mechanisms Revisited 2885.1.6 A Security Management Framework 2915.2 Security Operations and Maintenance 2965.2.1 Operational Security Compliance Programs 2975.2.2 Security Operations Reviews and Audits 3015.2.3 Security Event Response and Incident Management 3025.2.4 Penetration Testing 3045.2.5 Common Criteria Evaluated Systems 3065.2.6 Accreditation and Certification 3095.3 Withdrawal from Service 3125.4 Summary 3145.5 Concluding Remarks 314Further Reading and Resources 314Appendices 318Appendix A: Role of Cryptography in Information SecurityAppendix B: Authentication of SubjectsAppendix C: Network Security MechanismsAppendix D: Example Company Security PolicyAppendix E: Example Generic Detailed Security RequirementsAppendix F: Securing Common Network ProtocolsAppendix G: Security Mapping between M.3400 and M.3050 320Appendix H: State Privacy Laws as of 2010 328Appendix I: Example RFP Security AppendixAppendix J: RFP Security Analysis of ABC ProposalAppendix K: Example Security Statement of Work 339Appendix L: Example Solaris Operating System Audit Procedures 348Appendix M: Example Procedure for Basic Hardening of a Windows XP Professional Operating System 352Appendix N: Example Network Audit Procedure 356Appendix O: Example Unix–Linux Operating SystemAudit Procedures 360Index 365