TS 33.526
Security Assurance Specification (SCAS) for the
Management Function (MnF)
V18.1.0 (PDF)
2023/09 17 p.
- Rapporteur:
- Dr. Ben Henda, Noamen
Huawei Technologies Sweden AB
full Table of Contents for TS 33.526 Word version: 18.1.0
1 Scope
2 References
3 Definitions of terms, symbols and abbreviations
4 MnF-specific security requirements and related test cases
$ Change history
1 Scope p. 7
The present document contains objectives, requirements and test cases that are specific to the MnF network product class. It refers to the Catalogue of General Security Assurance Requirements and formulates specific adaptions of the requirements and test cases given there, as well as specifying requirements and test cases unique to the MnF network product class. In the present document, the MnF network product class represents independently deployed management product supporting 3GPP defined management services.
2 References p. 7
3 Definitions of terms, symbols and abbreviations p. 7
4 MnF-specific security requirements and related test cases p. 8
4.1 Introduction p. 8
4.2 MnF-specific security functional adaptations of requirements and related test cases p. 8
4.2.1 Introduction p. 8
4.2.2 Security functional requirements on the MnF deriving from 3GPP specifications and related test cases p. 8
4.2.3 Technical Baseline p. 8
4.2.3.1 Introduction p. 8
4.2.3.2 Protecting data and information p. 8
4.2.3.2.1 Protecting data and information - general p. 8
4.2.3.2.2 Protecting data and information - unauthorized viewing p. 8
4.2.3.2.3 Protecting data and information in storage p. 8
4.2.3.2.4 Protecting data and information in transfer p. 8
4.2.3.2.5 Logging access to personal data p. 8
4.2.3.3 Protecting availability and integrity p. 9
4.2.3.3.1 System handling during overload situations p. 9
4.2.3.3.2 Boot from intended memory devices only p. 9
4.2.3.3.3 System handling during excessive overload situations p. 9
4.2.3.3.4 System robustness against unexpected input. p. 9
4.2.3.3.5 Network Product software package integrity p. 9
4.2.3.4 Authentication and authorization p. 9
4.2.3.4.1 Authentication policy p. 9
4.2.3.4.2 Authentication attributes p. 9
4.2.3.4.2.1 Account protection by at least one authentication attribute. p. 9
4.2.3.4.2.2 Predefined accounts shall be deleted or disabled. p. 9
4.2.3.4.2.3 Predefined or default authentication attributes shall be deleted or disabled. p. 9
4.2.3.4.3 Password policy p. 9
4.2.3.4.3.1 Password Structure p. 9
4.2.3.4.3.2 Password changes p. 10
4.2.3.4.3.3 Protection against brute force and dictionary attacks p. 10
4.2.3.4.3.4 Hiding password display p. 10
4.2.3.4.4 Specific Authentication use cases p. 10
4.2.3.4.5 Policy regarding consecutive failed login attempts p. 10
4.2.3.4.6 Authorization and access control p. 10
4.2.3.5 Protecting sessions p. 10
4.2.3.5.1 Protecting sessions - logout function p. 10
4.2.3.5.2 Protecting sessions - Inactivity timeout p. 10
4.2.3.6 Logging p. 10
4.2.4 Operating systems p. 11
4.2.5 Web servers p. 11
4.2.5.1 HTTPS p. 11
4.2.5.2 Logging p. 11
4.2.5.3 HTTP User sessions p. 11
4.2.5.4 HTTP input validation p. 11
4.2.6 Network devices p. 11
4.3 MnF-specific adaptations of hardening requirements and related test cases. p. 12
4.3.1 Introduction p. 12
4.3.2 Technical Baseline p. 12
4.3.3 Operating Systems p. 12
4.3.3.1 General operating system requirements and test cases p. 12
4.3.3.1.1 IP-Source address spoofing mitigation p. 12
4.3.3.1.2 Minimized kernel network functions p. 12
4.3.3.1.3 No automatic launch of removable media p. 12
4.3.3.1.4 SYN Flood Prevention p. 12
4.3.3.1.5 Protection from buffer overflows p. 12
4.3.3.1.6 External file system mount restrictions p. 12
4.3.4 Web Servers p. 12
4.3.4.1 General p. 12
4.3.4.2 No system privileges for web server p. 12
4.3.4.3 No unused HTTP methods p. 12
4.3.4.4 No unused add-ons p. 13
4.3.4.5 No compiler, interpreter, or shell via CGI or other server-side scripting p. 13
4.3.4.6 No CGI or other scripting for uploads p. 13
4.3.4.7 No execution of system commands with SSI p. 13
4.3.4.8 Access rights for web server configuration p. 13
4.3.4.9 No default content p. 13
4.3.4.10 No directory listings p. 13
4.3.4.11 Web server information in HTTP headers p. 13
4.3.4.12 Web server information in error pages p. 13
4.3.4.13 Minimized file type mappings p. 13
4.3.4.14 Restricted file access p. 13
4.3.4.15 Execute rights exclusive for CGI/Scripting directory p. 13
4.3.5 Network Devices p. 13
4.3.6 Network Functions in service-based architecture p. 13
4.4 MnF-specific adaptations of basic vulnerability testing requirements and related test cases p. 14
$ Change history p. 15
