Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.805 Word version: 12.0.0

1… 4… A…

4.1 Considerations on definition of the term "network products" 4.2 Sample 3GPP network products for the methodology study 4.3 Threat and attacker model for the Security Assurance study 4.4 3GPP network products subject to Security Assurance Specifications (SCAS) 4.5 Roles and processes applicable to all methodologies 5.1 Methodology 1: Common Criteria (CC) 5.2 Methodology 2 8.1 Chosen methodology description 8.2 Next steps for the normative phase

4 3GPP network products and threat model p. 11

4.1 Considerations on definition of the term "network products" p. 11

4.1.1 3GPP function specific requirements vs. platform/node requirements p. 11

4.1.2 Distribution of 3GPP functions over nodes p. 11

4.1.3 Environment of functions and nodes p. 12

4.1.4 Relationship between network products classes, SCAS and 3GPP functions p. 13

4.2 Sample 3GPP network products for the methodology study p. 15

4.3 Threat and attacker model for the Security Assurance study p. 16

4.3.1 Attacker potential p. 16

4.3.2 Threats model p. 16

4.4 3GPP network products subject to Security Assurance Specifications (SCAS) p. 17

4.4.1 Access network p. 17

4.4.2 Core network p. 17

4.5 Roles and processes applicable to all methodologies p. 18

4.5.1 Introduction p. 18

4.5.2 Security assurance process p. 18

4.5.2.1 Overview p. 18

4.5.2.2 Assurance level p. 19

4.5.2.3 Security baseline p. 20

4.5.3 Roles p. 22

4.5.3.1 Roles involved in the security assurance process p. 22

4.5.3.2 Implicit and existing roles p. 22

4.5.3.3 New roles p. 22

4.5.4 Sub-processes and documentation p. 23

4.5.4.1 Security Assurance Specification (SCAS) p. 23

4.5.4.2 Network product p. 23

4.5.4.3 Evaluation and evaluation report p. 23

4.5.4.4 Certification and certificate p. 23

4.5.4.5 Operator security acceptance decision p. 24

4.5.4.6 Revocation and dispute process p. 24

5 Proposed methodologies p. 25

5.1 Methodology 1: Common Criteria (CC) p. 25

5.1.1 Introduction p. 25

5.1.1.2 Assurance paradigm p. 26

5.1.1.3 Assurance approach p. 26

5.1.1.4 CC evaluation assurance scale p. 27

5.1.1.5 CC assurance and the significance of vulnerabilities p. 27

5.1.1.6 Concept of ST and PP p. 28

5.1.1.7 Specific issues on Protection Profiles (PPs) and Security Targets (STs) p. 28

5.1.2 Content of a Security Assurance Specification (SCAS) p. 29

5.1.2.1 Overview of SCAS p. 29

5.1.2.2 Description of the Protection Profile (PP) part p. 30

5.1.2.3 Hardening p. 31

5.1.2.4 Description of the software hardening part p. 32

5.1.2.5 Description of the hardware hardening part p. 32

5.1.2.6 Definition of the expected environment of the network product class in the context of writing the 3GPP evaluation profile p. 32

5.1.3 Methodology for development of a SCAS p. 33

5.1.3.1 Overview p. 33

5.1.3.2 How to identify suitable SFRs and SARs for the PP p. 33

5.1.3.3 How to help vendors and evaluators to use the PP p. 34

5.1.4 Evaluation of a network product against a SCAS p. 34

5.2 Methodology 2 p. 36

5.2.1 Overview p. 36

5.2.2 Methodology building p. 40

5.2.2.1 Overview p. 40

5.2.2.2 Security assurance process document creation p. 41

5.2.2.3 Vendor network product development and network product lifecycle management process document creation p. 41

5.2.2.4 Security Assurance Specification (SCAS) creation p. 43

5.2.2.4.1 Writing process overview p. 43

5.2.2.4.2 SCAS document structure and content p. 45

5.2.2.5 Security Assurance Specification instantiation documents creation p. 52

5.2.2.6 Accreditation and monitoring rules creation p. 53

5.2.3 Vendors and third-party laboratories accreditation p. 53

5.2.3.1 Overview p. 53

5.2.3.2 Methodology and quality accreditation p. 54

5.2.3.3 Audit and accreditation of Vendor network product development and network product lifecycle management process p. 55

5.2.3.4 Audit and accreditation of testing laboratories p. 56

5.2.3.5 Criteria on accreditation of security compliance testing laboratories p. 56

5.2.3.6 Criteria on accreditation of Basic Vulnerability testing laboratories p. 57

5.2.3.7 Criteria on accreditation of Enhanced Vulnerability Analysis (EVA) testing laboratories p. 57

5.2.4 Evaluation and evaluation report p. 58

5.2.4.1 Network product development process and network product lifecycle management p. 58

5.2.4.2 SCAS instantiation evaluation p. 58

5.2.4.2.1 Overview p. 58

5.2.4.2.2 Content p. 58

5.2.4.2.3 Process p. 63

5.2.4.3 Security Compliance testing p. 64

5.2.4.3.1 Inputs p. 64

5.2.4.3.2 Outputs p. 64

5.2.4.3.3 Activities p. 64

5.2.4.4 Basic Vulnerability Testing p. 65

5.2.4.5 Enhanced Vulnerability Analysis task p. 65

5.3.4.4.1 Inputs p. 65

5.3.4.4.2 Outputs p. 66

5.3.4.4.3 Activities p. 66

5.2.5 Self-declaration p. 67

5.2.6 Operator security acceptance decision p. 67

5.2.7 Administration of the accreditations and dispute resolution p. 67

5.2.7.1 Monitoring p. 67

5.2.7.2 Dispute resolution p. 67

5.2.8 Summary of SECAM deliverables p. 68

5.2.9 General considerations p. 69

5.2.9.1 Improvement of SCAS and new security requirements p. 69

5.2.9.2 Partial compliance and use of SECAM requirements in network product development cycle p. 69

5.2.9.3 Comparison between two SECAM evaluations p. 69

6 Criteria for the evaluation of the methodologies p. 70

7 Comparison of Proposed Methodologies p. 71

8 Conclusions p. 72

8.1 Chosen methodology description p. 72

8.2 Next steps for the normative phase p. 75