For the purposes of the present document, the terms and definitions given in
TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in
TR 21.905.
Automatic assessment tool:
A software that operates with a minimal human intervention and aids the user in evaluation of the security of computer programs, systems and/or networks.
Developer:
A creator of systems, components, or services for use on or with a 3GPP network.
Expert knowledge:
Possesing skills, training and experience in analysing and understanding security threats in a wide variety of situations.
Identifiable person:
one who can be identified, directly or indirectly, in particular by reference to an identification number, name or to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.
Local access:
Communication through a direct network access interface.
Machine Accounts:
accounts used for authentication and authorization from system to system or between applications on a system and cannot be assigned to a single person or a group of persons.
Network Element:
Network Function:
Network product:
Network product class:
Owner:
The person or enity responsible for creating and maintaining content. The person or enity determines who has access to the content and the content permissions.
Personal data:
any information relating to an identified or identifiable natural person ('data subject').
Remote access:
Communication through an external network access interface.
Screenshot:
A digital image that shows the contents of a display.
Sensitive data:
data used for authentication or may help to identify the user, such as user names, passwords, PINs, cryptographic keys, IMSIs, IMEIs, MSISDNs, or IP addresses of the UE, as well as files of a system that are needed for the functionality such as firmware images, patches, drivers or kernel modules.
System group account:
a predefined system account in the network product, usually with special privileges, which has a predefined user id and hence cannot be tied to a single user (individual) in a normal operating environment.
EXAMPLE: the
'root' account.
Vendor:
A commercial supplier of 3GPP network software or hardware.
Vulnerability:
For the purposes of the present document, the abbreviations given in
TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in
TR 21.905.
AAA
Authentication Authorization and Accounting
BOOTP
Bootstrap Protocol
BVT
Basic Vulnerability Testing
CAPTCHA
Completely Automated Public Turing test to tell Computers and Humans Apart
CD
Compact Disk
CDP
Customer Data Platform
CIS
Center for Internet Security
COTS
Commercial Off The Shelf
CVE
Common Vulnerabilities and Exposures
DTLS
Datagram Transport Layer Security
DVD
Digital Video Disk
FOSS
Free Open-Source Software
FTP
File Transfer Protocol
GTP-C
GPRS Tunnelling Protocol for Control Plane
GUI
Graphical User Interface
GUID
Globally Unique Identifer
IKE
Internet Key Exchange
IPsec
Internet Protocol Security
JSON
Java Script Object Notation
JWS
JSON Web Signature
LLDP
Local Loop Demarcation Protocol
MOP
Maintenance Operations Protocol
NRF
Network Repository Function
NSI
Network Slice Instance
NSI ID
Network Slice Instance Identifier
NSSAI
Network Slice Selection Assistance Information
PHP
Hypertext Preprocessor
PM
Performance Management
QMS
Quality Management System
RAM
Random Access Memory
RBAC
Role Based Access Control
RCP
Remote Copy Program
RDP
Remote Delete Program
RPH
Reverse Path Filter
RSH
Remote shell
SBA
Service Based Architecture
SBI
Service Based Interfaces
SCAS
Security Assurance Specification
SCP
Service Communication Proxy
SECAM
Security Assurance Methodology
SEPP
Security Edge Protection Proxy
SFTP
Secure File Transfer Protocol
SGID
Special Group Identification
S-NSSAI
Single Network Slice Selection Assistance Information
SSH
Secure Shell
SSI
Server Side Includes
SSO
Single Sign-On
SUID
Set owner User Idenification
SYN
Synchrounous Transmission
TFTP
Trivial File Transfer Protocol
WAS
Web Application Security
WebDAV
Web Distributed Authoring and Versioning