Content for TR 33.818 Word version: 17.1.0
4 Overview
5 Security Assurance Specification (SCAS) Creation
6 Vendor development and product lifecycle processes and test laboratory accreditation
7 Evaluation and SCAS instantiation
8 Conclusion
$ Change history
4 Overview p. 10
4.1 Introduction p. 10
4.1.1 Considerations on network product class when using NFV technology p. 10
4.1.2 Considerations on SECAM of the virtualised network products p. 12
4.2 Scope of a SECAM SCAS for 3GPP virtualised network products p. 12
4.2.1 Gap analysis p. 12
4.2.2 Scope of a SECAM SCAS p. 12
4.3 Scope of SECAM evaluation for 3GPP virtualised network products p. 13
4.3.1 Gap analysis p. 13
4.3.2 Scope of a SECAM evaluation p. 13
4.4 Scope of SECAM Accreditation for 3GPP virtualised network products p. 13
4.4.1 Gap analysis p. 13
4.4.2 Scope of SECAM Accreditation p. 14
4.5 Ultimate Output of SECAM Evaluation for 3GPP virtualised network products p. 14
4.6 3GPP virtualised network products evaluation process p. 14
4.7 Roles in SECAM for 3GPP virtualised network products p. 15
4.7.1 Gap analysis p. 15
4.7.2 SECAM Roles Overview p. 15
4.7.3 Examples of instantiation of roles in SECAM p. 15
4.8 Operator security acceptance decision for 3GPP virtualised network products p. 16
4.9 SECAM Assurance level for 3GPP virtualised network products p. 17
4.9.1 Gap analysis p. 17
4.9.2 SECAM Assurance level p. 17
4.10 Security baseline for 3GPP virtualised network products p. 17
4.10.1 Gap analysis p. 17
4.10.2 Security baseline p. 17
5 Security Assurance Specification (SCAS) Creation p. 18
5.1 Writing process overview p. 18
5.2 SCAS documents structure and content p. 18
5.2.1 General p. 18
5.2.2 ToE p. 18
5.2.3 Generic virtualised network product model class description p. 18
5.2.3.1 Introduction p. 18
5.2.3.2 Generic virtualised network product model of type 1 p. 19
5.2.3.2.1 Description of the GVNP model p. 19
5.2.3.2.2 Functions defined by 3GPP p. 19
5.2.3.2.3 Other functions p. 19
5.2.3.2.4 Operating system (OS) p. 19
5.2.3.2.5 Interfaces p. 19
5.2.3.3 Generic virtualised network product model of type 2 p. 20
5.2.3.3.1 Description of the GVNP model p. 20
5.2.3.3.2 Functions defined by 3GPP p. 21
5.2.3.3.3 Other functions p. 21
5.2.3.3.4 Virtualisation layer p. 21
5.2.3.3.5 Interfaces p. 21
5.2.3.4 Generic virtualised network product model of type 3 p. 21
5.2.4 Security Problem Definition (SPD) for 3GPP virtualised network products class p. 22
5.2.4.1 Introduction p. 22
5.2.4.2 Generic assets and threats of GVNP for type 1 p. 22
5.2.4.2.1 Generic assets of GVNP for type 1 p. 22
5.2.4.2.2 Generic threats for GVNP of type 1 p. 23
5.2.4.3 Generic assets and threats for GVNP of type 2 p. 28
5.2.4.3.1 Generic assets for GVNP of type 2 p. 28
5.2.4.3.2 Generic threats for GVNP of type 2 p. 28
5.2.4.4 Generic assets and threats for GVNP of type 3 p. 32
5.2.4.4.1 Generic assets for GVNP of type 3 p. 32
5.2.4.4.2 Generic threats for GVNP of type 3 p. 33
5.2.4.5 Generic assets and threats for network functions supporting SBA interfaces p. 36
5.2.5 Potential Security Requirements p. 36
5.2.5.1 Introduction p. 36
5.2.5.2 Incorporation of security requirements from existing 3GPP and ETSI specifications in current releases p. 37
5.2.5.3 Handling of security requirements p. 37
5.2.5.4 Guidelines for writing test cases p. 38
5.2.5.5 Potential security functional requirements and related test cases for GVNP of type 1 p. 38
5.2.5.5.1 Introduction p. 38
5.2.5.5.2 Potential security functional requirements deriving from 3GPP specifications and related test cases p. 38
5.2.5.5.3 Technical baseline for potential general security functional requirements p. 38
5.2.5.5.4 Operating systems p. 40
5.2.5.5.5 Web servers p. 40
5.2.5.5.6 Network devices p. 40
5.2.5.5.7 Potential security functional requirements deriving from virtualisation and related test cases p. 41
5.2.5.5.8 Potential security requirements and related test cases to Hardening for GVNP of type 1 p. 44
5.2.5.6 Potential security functional requirements and related test cases for GVNP of type 2 p. 46
5.2.5.6.1 Introduction p. 46
5.2.5.6.2 Potential security functional requirements deriving from 3GPP specifications and related test cases p. 47
5.2.5.6.3 Technical baseline p. 47
5.2.5.6.4 Operating systems p. 47
5.2.5.6.5 Web servers p. 47
5.2.5.6.6 Virtualised Network devices p. 47
5.2.5.6.7 Potential security functional requirements deriving from virtualisation and related test cases p. 47
5.2.5.6.8 Potential Security requirements and related test cases to Hardening for GVNP of type 2 p. 49
5.2.5.7 Potential security functional requirements and related test cases for GVNP of type 3 p. 50
5.2.5.7.1 Introduction p. 50
5.2.5.7.2 Potential security functional requirements deriving from 3GPP specifications and related test cases p. 50
5.2.5.7.3 Technical baseline p. 51
5.2.5.7.4 Operating systems p. 51
5.2.5.7.5 Web servers p. 51
5.2.5.7.6 Network devices p. 51
5.2.5.7.7 Potential security functional requirements deriving from virtualisation and related test cases p. 51
5.2.5.7.8 Security requirements and related test cases to Hardening for GVNP of type 3 p. 53
5.3 Improvement of SCAS and new potential security requirements p. 54
5.4 Basic vulnerability testing requirements for GVNP p. 54
5.4.1 Introduction p. 54
5.4.2 Port Scanning p. 54
5.4.3 Vulnerability Scanning p. 54
5.4.4 Robustness and Fuzz testing p. 54
6 Vendor development and product lifecycle processes and test laboratory accreditation p. 54
6.1 Overview p. 54
6.2 Audit and accreditation of Vendor network product development and network product lifecycle management processes p. 55
6.3 Audit and accreditation of test laboratories p. 55
6.4 Monitoring p. 55
6.5 Dispute resolution p. 55
7 Evaluation and SCAS instantiation p. 55
7.1 Security Assurance Specification (SCAS) instantiation documents creation p. 55
7.2 Evaluation and evaluation report p. 56
7.2.1 Network product development process and network product lifecycle management p. 56
7.2.2 SCAS instantiation evaluation p. 56
7.2.3 Security Compliance testing p. 56
7.2.4 Basic Vulnerability Testing p. 57
7.3 Self-declaration p. 57
7.4 Partial compliance and use of SECAM requirements in network product development cycle p. 57
7.5 Comparison between two SECAM evaluations p. 57
7.6 The evaluation of a new version p. 57
8 Conclusion p. 57
$ Change history p. 59
