First ITU-T SG 17 meeting in new 2005-2008 study period was hold in Moscow. Dr. Arkadiy Kremer presented a contribution for the ITU-T SG17 project “Security Baseline for Network Operators”. The project objective is to develop a baseline requirement specification, based on international security standards, that defines a basic level of security for network operators.
      The resulting baseline requirement specification should provide a "floor" of security and must ensure balance of cost vs benefit. It must also be flexible enough to respect different national regulatory regimes and different types of network operator (e.g. wireline vs wireless.)
      The project won a highest priority and attracted a big interest of the participants.
      Considering to the high importance of the project, ITU-T SG 17 decided to create a Focus Group on the project on the second ITU-T meeting 5-14 October 2006. The objective of the focus group is to develop a security baseline for network operators to help advance the work of the ITU-T SG17 and to encourage the participation in this activity of members of other standards organizations, including experts and individuals who may not be members of ITU.
       The Focus Group proposes a Security Baseline for Network Operators that will provide meaningful criteria against which each network operator can be assessed if required. Use of these criteria depends from regulatory regime and from type of the operator depending on the underlying network technology. For example, some regulatory regimes may wish to impose a requirement that a certain level of the criteria be met as a condition of licensing. Some network operators may themselves require that other network operators meet certain criteria as a prerequisite to interconnection. Regardless of any externally-imposed requirements, publication of recognized criteria will provide an incentive for network operators to declare that their networks meet a certain level of security.

An action plan was divided into two phases:

Phase 1

To assess the interest of network operators and other stakeholders in the project by inviting them to participate in the Focus Group activity;
To assess existing activities and previous work in this area and to develop a report on the findings of this assessment;
To develop a proposed approach to baseline security for Network Operators.
To run a Focus Group Workshop to consolidate and to confirm the approach with the stakeholders;
To develop a proposed schedule for Phase 2 activities;
Present a written report to SG17 on results of Phase 1 for assessment and evaluation.

Phase 2

To develop a Questionnaire/survey and conduct the survey;
To prepare a report on the results of the survey;
To identify candidate standards for the security baseline;
To identify any perceived gaps or inadequacies in the identified standards;
To identify the core business applications for which the security baseline may apply;
To identify suitable methods of information and network security evaluation;
To draft the proposed security baseline;
and To prepare input for the development of appropriate ITU-T Recommendations based on the above work.

      Participation in the project is open. All interested bodies are invited to become members of the project team and join our efforts in such an interesting collaboration.


ITU-T SG-17 Focus Group "Security Baseline for Network Operators" document