TS 33.527
Security Assurance Specification (SCAS) for
3GPP Virtualized Network products
V18.3.0 (PDF)
2024/06 20 p.
- Rapporteur:
- Mr. Qi, Minpeng
China Mobile Com. Corporation
full Table of Contents for TS 33.527 Word version: 18.3.0
1 Scope
2 References
3 Definitions of terms, symbols and abbreviations
4 Catalogue of security requirements and related test cases for virtualized network product
$ Change history
1 Scope p. 7
The present document contains objectives, requirements and test cases to virtualized network product classes.
Several virtualized network product classes share very similar if not identical security requirements for some aspects. Therefore, these are collected in the present document applicable to many virtualized network product classes. In addition to this catalogue, requirements specific to different network product classes will be captured in separate documents.
2 References p. 7
3 Definitions of terms, symbols and abbreviations p. 7
4 Catalogue of security requirements and related test cases for virtualized network product p. 8
4.1 Introduction p. 8
4.1.1 Pre-requisites for testing p. 8
4.1.2 Use of tools in testing p. 8
4.1.3 Documentation Requirements p. 9
4.2 Security functional requirements and related test cases p. 9
4.2.1 Introduction p. 9
4.2.2 Security functional requirements deriving from 3GPP specifications and related test cases p. 9
4.2.3 technical baseline p. 9
4.2.3.1 Introduction p. 9
4.2.3.2 Protecting data and information p. 9
4.2.3.3 Protecting availability and integrity p. 10
4.2.3.3.1 System handling during overload situations p. 10
4.2.3.3.2 Boot from intended memory devices only p. 10
4.2.3.3.3 System handling during excessive overload situations p. 10
4.2.3.3.4 System robustness against unexpected input p. 10
4.2.3.3.5 Virtualized Network product software package integrity p. 10
4.2.3.4 Authentication and authorization p. 11
4.2.3.5 Protecting sessions p. 11
4.2.3.6 Logging p. 11
4.2.4 Operating systems p. 11
4.2.5 Web servers p. 11
4.2.6 Network devices p. 11
4.2.7 Security functional requirements deriving from virtualisation and related test cases p. 12
4.3 Security requirements and related test cases related to hardening p. 15
4.3.1 Introduction p. 15
4.3.2 Technical baseline p. 15
4.3.2.1 No unnecessary or insecure services / protocols p. 15
4.3.2.2 Restricted reachability of services p. 15
4.3.2.3 No unused software p. 15
4.3.2.4 No unused functions p. 15
4.3.2.5 No unsupported components p. 15
4.3.2.6 Remote login restrictions for privileged users p. 15
4.3.2.7 File system Authorization privileges p. 16
4.3.3 Operating systems p. 16
4.3.4 Web servers p. 16
4.3.5 Network devices p. 16
4.3.6 Virtualized Network Products p. 16
4.4 Basic vulnerability testing requirements p. 17
4.4.1 Introduction p. 17
4.4.2 Port Scanning p. 17
4.4.3 Vulnerability Scanning p. 17
4.4.4 Robustness and Fuzz testing p. 17
$ Change history p. 18
