Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.927 Word version: 18.2.0

1… 4…

4 Generic Virtualized Network Product (GVNP) class description p. 8

4.1 Overview p. 8

4.2 Minimum set of functions defining the GNP class p. 9

4.3 Generic virtualized network product model p. 9

4.3.1 Introduction p. 9

4.3.2 Generic virtualized network product model of type 1 p. 10

4.3.2.1 Description of the GVNP model p. 10

4.3.2.2 Functions defined by 3GPP p. 10

4.3.2.3 Other functions p. 10

4.3.2.4 Operating system (OS) p. 10

4.3.2.5 Interfaces p. 10

4.4 Scope of the present document p. 11

4.4.1 Introduction p. 11

4.4.2 Scope regarding GVNP functions defined by 3GPP p. 11

4.4.3 Scope regarding other functions p. 11

4.4.4 Scope regarding Operating System (OS) p. 11

4.4.5 Scope regarding hardware p. 12

4.4.6 Scope regarding interfaces p. 12

5 Generic assets and threats p. 12

5.1 Introduction p. 12

5.2 Critical assets p. 12

5.2.1 Generic assets of GVNP for type 1 p. 12

5.3 Threats p. 12

5.3.1 Generic threats format p. 12

5.3.2 Generic threats for GVNP of type 1 p. 13

5.3.2.1 Introduction p. 13

5.3.2.2 Threats relating to 3GPP-defined interfaces p. 13

5.3.2.3 Threats relating to ETSI-defined interfaces p. 13

5.3.2.4 Spoofing identity p. 13

5.3.2.4.1 Default Accounts p. 13

5.3.2.4.2 Weak Password Policies p. 14

5.3.2.4.3 Password peek p. 14

5.3.2.4.4 Direct Root Access p. 14

5.3.2.4.5 IP Spoofing p. 14

5.3.2.4.6 Malware p. 14

5.3.2.4.7 Eavesdropping p. 14

5.3.2.5 Tampering p. 14

5.3.2.5.1 Software Tampering p. 14

5.3.2.5.2 Ownership File Misuse p. 14

5.3.2.5.3 Boot tampering for GVNP of type 1 p. 15

5.3.2.5.4 Log Tampering p. 15

5.3.2.5.5 OAM traffic Tampering p. 15

5.3.2.5.6 File Write Permissions Abuse p. 15

5.3.2.5.7 User Session Tampering p. 15

5.3.2.6 Repudiation p. 15

5.3.2.6.1 Lack of User Activity Trace p. 15

5.3.2.7 Information disclosure p. 15

5.3.2.7.1 Poor key generation p. 15

5.3.2.7.2 Poor key management p. 15

5.3.2.7.3 Weak cryptographic algorithms p. 15

5.3.2.7.4 Insecure Data Storage p. 15

5.3.2.7.5 System Fingerprinting p. 16

5.3.2.7.6 Malware p. 16

5.3.2.7.7 Personal Identification Information Violation p. 16

5.3.2.7.8 Insecure Default Configuration p. 16

5.3.2.7.9 File/Directory Read Permissions Misuse p. 16

5.3.2.7.10 Insecure Network Services p. 16

5.3.2.7.11 Unnecessary Services p. 16

5.3.2.7.12 Log Disclosure p. 16

5.3.2.7.13 Unnecessary Applications p. 16

5.3.2.7.14 Eavesdropping p. 16

5.3.2.7.15 Security threat caused by lack of GVNP traffic isolation p. 16

5.3.2.8 Denial of Service p. 16

5.3.2.9 Elevation of privilege p. 17

6 Generic assets and threats for network functions supporting SBA interfaces p. 17

$ Change history p. 18