ISO/IEC 27032:2012 Information technology — Security techniques — Guidelines for cybersecurity

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

ISO/IEC 27032 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques.

Introduction

The Cyberspace is a complex environment resulting from the interaction of people, software and services on the Internet, supported by worldwide distributed physical information and communications technology (ICT) devices and connected networks. However there are security issues that are not covered by current information security, Internet security, network security and ICT security best practices as there are gaps between these domains, as well as a lack of communication between organizations and providers in the Cyberspace. This is because the devices and connected networks that have supported the Cyberspace have multiple owners, each with their own business, operational and regulatory concerns. The different focus placed by each organization and provider in the Cyberspace on relevant security domains where little or no input is taken from another organization or provider has resulted in a fragmented state of security for the Cyberspace.

As such, the first area of focus of this International Standard is to address Cyberspace security or Cybersecurity issues which concentrate on bridging the gaps between the different security domains in the Cyberspace. In particular this International Standard provides technical guidance for addressing common Cybersecurity risks, including:

The technical guidance provides controls for addressing these risks, including controls for:

The second area of focus of this International Standard is collaboration, as there is a need for efficient and effective information sharing, coordination and incident handling amongst stakeholders in the Cyberspace. This collaboration must be in a secure and reliable manner that also protects the privacy of the individuals concerned. Many of these stakeholders can reside in different geographical locations and time zones, and are likely to be governed by different regulatory requirements. Stakeholders include:

Thus, this International Standard also provides a framework for

The framework includes

Given the scope of this International Standard, the controls provided are necessarily at a high level. Detailed technical specification standards and guidelines applicable to each area are referenced within this International Standard for further guidance.

1 Scope

This International Standard provides guidance for improving the state of Cybersecurity, drawing out the unique aspects of that activity and its dependencies on other security domains, in particular:

It covers the baseline security practices for stakeholders in the Cyberspace. This International Standard provides:

2.1 Audience

This International Standard is applicable to providers of services in the Cyberspace. The audience, however, includes the consumers that use these services. Where organizations provide services in the Cyberspace to people for use at home or other organizations, they may need to prepare guidance based on this International Standard that contains additional explanations or examples sufficient to allow the reader to understand and act on it.

2.2 Limitations

This International Standard does not address:

It is recognized that relationships exist between the domains mentioned and Cybersecurity. It is, however, beyond the scope of this International Standard to address these relationships, and the sharing of controls between these domains.

It is important to note that the concept of Cybercrime, although mentioned, is not addressed. This International Standard does not provide guidance on law-related aspects of the Cyberspace, or the regulation of Cybersecurity.

The guidance in this International Standard is limited to the realization of the Cyberspace on the Internet, including the endpoints. However, the extension of the Cyberspace to other spatial representations through communication media and platforms are not addressed, nor the physical security aspects of them.

3 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• ISO/IEC 27000 Information technology — Security techniques — Information security management systems — Overview and vocabulary

4 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 27000, and the following apply.

4.1 adware

4.2 application

4.3 application service provider

4.4 application services

4.5 application software

4.6 asset

4.7 avatar

4.8 attack

4.9 attack potential

4.10 attack vector

4.11 blended attack

4.12 bot

4.13 botnet

4.14 cookie

4.15 cookie

4.16 cookie

4.17 control

4.18 Cybercrime

4.19 Cybersafety

4.20 Cybersecurity

4.21 the Cyberspace

4.22 Cyberspace application services

4.23 cyber-squatter

4.24 deceptive software

4.25 hacking

4.26 hactivism

4.27 information asset

4.28 internet

4.29 the Internet

4.30 Internet crime

4.31 Internet safety

4.32 Internet security

4.33 Internet services

4.34 Internet service provider

4.35 malware

4.36 malicious contents

4.37 organization

4.38 phishing

4.39 physical asset

4.40 potentially unwanted software

4.41 scam

4.42 spam

4.43 spyware

4.44 stakeholder

4.45 stakeholder

4.46 threat

4.47 trojan

4.48 unsolicited email

4.49 virtual asset

4.50 virtual currency

4.51 virtual world

4.52 vulnerability

4.53 zombie

5 Abbreviated terms

The following abbreviated terms are used in this International Standard.

6.1 Introduction

Security on the Internet and in the Cyberspace has been a subject of growing concern. Stakeholders have been establishing their presence in the Cyberspace through websites and are now attempting to further leverage the virtual world provided by the Cyberspace.

While some individuals are careful in managing their online identity, most people are uploading details of their personal profiles to share with others. Profiles on many sites, in particular social networking sites and chat rooms, can be downloaded and stored by other parties. This can lead to the creation of a digital dossier of personal data that can be misused, disclosed to other parties, or used for secondary data collection. While the accuracy and integrity of this data are questionable, they create links to individuals and organizations that often cannot be completely erased. These developments in the communication, entertainment, transportation, shopping, financial, insurance, and healthcare domains create new risks to stakeholders in the Cyberspace. Thus, risks can be associated with loss of privacy.

The convergence of information and communication technologies, the ease of getting into the Cyberspace, and the narrowing of personal space between individuals are gaining the attention of individual miscreants and criminal organizations. These entities are using existing mechanisms, such as phishing, spam and spyware, as well as developing newer attack techniques, to exploit any weaknesses they can discover in the Cyberspace. In recent years, security attacks in the Cyberspace have evolved from hacking for personal fame to organized crime, or Cybercrime. A plethora of tools and processes previously observed in isolated Cybersecurity incidents are now being used together in multi-blended attacks, often with far reaching malicious objectives. These objectives range from personal attacks, identity theft, financial frauds or thefts, to political hactivism. Specialist forums to highlight potential security issues have also served to showcase attack techniques and criminal opportunities.

The multiple modes of business transactions that are carried out in the Cyberspace are becoming the target of Cybercrime syndicates. Ranging from business-to-business, business-to-consumer to consumer-to-consumer services, the risks posed are inherently complex. Concepts such as what constitute a transaction or an agreement are dependent on the interpretation of the law and how each party in the relationship manages their liability. Often, the issue of usage of data collected during the transaction or relationship is not addressed adequately. This can eventually lead to security concerns such as the leakage of information.

The legal and technical challenges posed by these Cybersecurity issues are far-reaching and global in nature. The challenges can only be addressed by having the information security technical community, legal community, nations and community of nations coming together through a coherent strategy. This strategy should take into account the role of each stakeholder and existing initiatives, within a framework of international cooperation.

Current progress to address these challenges has been hampered by many issues, and Cybersecurity issues are increasing and continuing to evolve.

While there is no lack of Cybersecurity threats, and as many, albeit not standardized, ways to counter them, the focus of this International Standard is on the following key issues:

In addition, some Cybersecurity tools will be discussed briefly in this International Standard. These tools and areas closely relate to Cybercrime prevention, detection, response, and investigation. Further details can be found in Annex A.

6.2 The nature of the Cyberspace

The Cyberspace can be described as a virtual environment, which does not exist in any physical form, but rather, a complex environment or space resulting from the emergence of the Internet, plus the people, organizations, and activities on all sort of technology devices and networks that are connected to it. Cyberspace security, or Cybersecurity, is about the security of this virtual world.

Many virtual worlds have a virtual currency, such as used to purchase in-game items. There is an associated real world value to the virtual currency and even in-game items. These virtual items are frequently traded for real currency on online auction sites and some games even have an official channel with published virtual or real currency exchange rates for the monetization of virtual items. It is often these monetization channels which make these virtual worlds a target for attack, usually by phishing or other techniques for stealing account information.

6.3 The nature of Cybersecurity

Stakeholders in the Cyberspace have to play an active role, beyond protecting their own assets, in order for the usefulness of the Cyberspace to prevail. The applications within the Cyberspace are expanding beyond the business-to-consumers, and consumers-to-consumers models, to a form of many-to-many interactions and transactions. The requirements are expanding for individuals and organizations to be prepared to address the emerging security risks and challenges to effectively prevent and respond to misuse and criminal exploitations.

Cybersecurity relates to actions that stakeholders should be taking to establish and maintain security in the Cyberspace.

Cybersecurity relies on information security, application security, network security, and Internet security as fundamental building blocks. Cybersecurity is one of the activities necessary for CIIP, and, at the same time, adequate protection of critical infrastructure services contributes to the basic security needs (i.e., security, reliability and availability of critical infrastructure) for achieving the goals of Cybersecurity.

Cybersecurity is, however, not synonymous with Internet security, network security, application security, information security, or CIIP. It has a unique scope requiring stakeholders to play an active role in order to maintain, if not improve the usefulness and trustworthiness of the Cyberspace. This International Standard differentiates Cybersecurity and the other domains of security as follows:

Figure 1 summarizes the relationship between Cybersecurity and other security domains. The relationship between these security domains and Cybersecurity is complex. Some of the critical infrastructure services, for example water and transportation, need not impact the state of Cybersecurity directly or significantly. However, the lack of Cybersecurity can have a negative impact on the availability of critical information infrastructure systems provided by the critical infrastructure providers.

Figure 1

On the other hand, the availability and reliability of the Cyberspace in many ways rely on the availability and reliability of related critical infrastructure services, such as the telecommunications network infrastructure. The security of the Cyberspace is also closely related to the security of the Internet, enterprise/home networks and information security in general. It should be noted that the security domains identified in this section have their own objectives and scope of focus. To deal with Cybersecurity issues, therefore requires substantial communications and coordination between different private and public entities from different countries and organizations. Critical infrastructure services are regarded by some governments as national security related services, and therefore may not be discussed or disclosed openly. Furthermore, knowledge of critical infrastructure weaknesses, if not used appropriately, can have a direct implication on national security. A basic framework for information sharing and issue or incident coordination is therefore necessary to bridge the gaps and provide adequate assurance to the stakeholders in the Cyberspace.

6.4.1 Introduction

This clause presents a general model used throughout this International Standard. This clause assumes some knowledge of security and does not propose to act as a tutorial in this area.

This International Standard discusses security using a set of security concepts and terminology. An understanding of these concepts and the terminology is a prerequisite to the effective use of this International Standard. However, the concepts themselves are quite general and are not intended to restrict the class of IT security problems to which this International Standard is applicable.

6.4.2 General security context

Security is concerned with the protection of assets from threats, where threats are categorised as the potential for abuse of protected assets. All categories of threats should be considered; but in the domain of security greater attention is given to those threats that are related to malicious or other human activities. Figure 2 illustrates these high level concepts and relationships.

NOTE

Figure 2 is adapted from ISO/IEC 15408-1:2005, Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model.

Figure 2

Safeguarding assets of interest is the responsibility of stakeholders who place value on those assets. Actual or presumed threat agents may also place value on the assets and seek to abuse assets in a manner contrary to the interests of the applicable stakeholders. Stakeholders will perceive such threats as potential for impairment of the assets such that the value of the assets to the stakeholders would be reduced. Security specific impairment commonly includes, but is not limited to, damaging disclosure of the asset to unauthorised recipients (loss of confidentiality), damage to the asset through unauthorised modification (loss of integrity), or unauthorised deprivation of access to the asset (loss of availability).

Stakeholders assess risks taking into account threats that apply to their assets. This analysis can aid in the selection of controls to counter the risks and reduce it to an acceptable level.

Controls are imposed to reduce vulnerabilities or impacts, and to meet security requirements of the stakeholders (either directly or indirectly by providing direction to other parties). Residual vulnerabilities may remain after the imposition of controls. Such vulnerabilities may be exploited by threat agents representing a residual level of risk to the assets. Stakeholders will seek to minimise that risk given other constraints.

Stakeholders will need to be confident that the controls are adequate to counter the threats to assets before they will allow exposure of assets to the specified threats. Stakeholders may not themselves possess the capability to judge all aspects of the controls, and may therefore seek evaluation of the controls using external organizations.

6.5 Approach

An effective way to confront Cybersecurity risks involves a combination of multiple strategies, taking into consideration the various stakeholders. These strategies include:

This guideline focuses on providing industry best practices and broad consumer and employee education to assist stakeholders in the Cyberspace in playing an active role to address the Cybersecurity challenges. It includes guidance for:

Figure 3 provides an overview of the salient points in the approach taken in this International Standard. This International Standard is not intended to be directly used to provide broad consumer education. Instead, it is intended to be used by providers of services in the Cyberspace, as well as organizations providing Cyberspace related education to consumers, to prepare materials for broad consumer education.

Figure 3

7.1 Overview

The Cyberspace belongs to no one; everyone can participate and has a stake in it.

For the purpose of this International Standard, stakeholders in the Cyberspace are categorized in the following groups:

7.2 Consumers

As described in Figure 3, consumers refer to individual users as well as private and public organizations. Private organizations include small and medium enterprises (SMEs), as well as large enterprises. Government and other public agencies are collectively referred to as public organizations. An individual or an organization becomes a consumer when they access the Cyberspace or any services available in the Cyberspace.

A consumer can also be a provider if it in turn provides a service in the Cyberspace or enables another consumer to access the Cyberspace. A consumer of a virtual world service may become a provider by making available virtual products and services to other consumers.

7.3 Providers

Providers refer to providers of services in the Cyberspace, as well as Internet service providers that enable consumers to access the Cyberspace and the various services available in the Cyberspace.

Providers might also be understood as carriers or wholesalers, versus distributors and retailers of access services. This distinction is important from a security and, especially, law enforcement perspective, because, in the event that a distributor or retailer is unable to provide adequate security or lawful access, support services will often default back to the carrier or wholesaler. Understanding the nature of a given service provider is a useful element in Cyberspace risk management.

Application service providers make services available to consumers through their software. These services take many forms and include combinations of the following non-exhaustive list:

8.1 Overview

An asset is anything that has value to an individual or an organization. There are many types of assets, including but not limited to:

1. a) information;
2. b) software, such as a computer program;
3. c) physical, such as a computer;
4. d) services;
5. e) people, their qualifications, skills, and experience; and
6. f) intangibles, such as reputation and image.

NOTE 1

Often, assets are simplistically seen only as information or resources.

NOTE 2

ISO/IEC 15408-1:2005 defines an asset as information or resources to be protected by controls of a TOE (target of evaluation).

NOTE 3

ISO/IEC 19770-1 has been developed to enable an organization to prove that it is performing Software Asset Management (SAM) to a standard sufficient to satisfy corporate governance requirements and ensure effective support for IT service management overall. ISO/IEC 19770 is intended to align closely to, and to support, ISO/IEC 20000.

NOTE 4

ISO/IEC 20000-1 promotes the adoption of an integrated process approach when establishing, implementing, operating, monitoring, measuring, reviewing and improving a Service Management System (SMS) to design and deliver services which meet business needs and customer requirements.

For the purpose of this International Standard, assets in the Cyberspace are classified into the following classes:

For both classes, an asset can also be further classified as

8.2 Personal assets

One of the key virtual assets is an individual consumer’s online identity and his online credit information. Online identity is considered an asset, since it is the key identifier for any individual consumer in the Cyberspace.

Other individual consumer virtual assets include references in virtual worlds. In virtual worlds, members often use virtual avatars to represent or identify themselves, or to act on their behalf. Often a virtual currency is used for virtual transactions. These avatars and currencies can be considered as assets belonging to an individual consumer.

IT hardware and software, as well as personal digital devices or endpoints that allow a consumer to connect to and communicate in the Cyberspace, are also considered as assets in the context of this International Standard.

8.3 Organizational assets

A key aspect of the Cyberspace is the infrastructure that makes it all possible. This infrastructure is a meshed interconnection of networks, servers and applications which belongs to many service providers. However, the reliability and availability of this infrastructure is crucial in ensuring that the Cyberspace services and applications are available to anyone in the Cyberspace. While any infrastructure that allow any consumer to connect to the Cyberspace, or allow any consumer to access services in the Cyberspace, is considered a physical asset that must be addressed in this International Standard, there may be overlaps with security measures that are proposed in, for example, CIIP, Internet security and network security. However, this International Standard shall focus on ensuring that security issues that may affect these organizational assets are appropriately addressed without overly emphasizing other issues that are not within the scope of this International Standard.

Besides physical assets, virtual organizational assets are increasingly becoming more valuable. The online brand and other representations of the organization in the Cyberspace uniquely identify the organization in the Cyberspace and are as important as the brick and mortar of that organization.

Other organizational assets which are exposed through vulnerabilities in the Cyberspace include intellectual property (formulas, proprietary processes, patents, research results) and business plans and strategies (product launch and marketing tactics, competitive information, financial information and reporting data).

9.1.1 Overview

The threats that exist in the Cyberspace are discussed in relation to assets in the Cyberspace.

Threats to the Cyberspace can be divided into two key areas:

9.1.2 Threats to personal assets

Threats to personal assets revolve mainly around identity issues, posed by the leakage or theft of personal information.

If a person's online identity is stolen or masqueraded, that person can be deprived of access to key services and applications. In more serious scenarios, the consequences can range from financial to national level incidents.

Unauthorized access to a person's financial information also opens up the possibility of theft of the person's money and fraud.

Another threat is the possibility of the endpoint being made a zombie or bot. Personal computing devices can become compromised and so become part of a larger botnet.

Besides the above, other virtual assets that are being targeted are personal assets in virtual worlds and online games. Assets in a virtual world or the world of online games are subject to attack and exploitation as well.

Virtual theft and virtual mugging are some of the newly coined terms for this type of attack. Security, in this case, will depend on how much of the real world information is accessible, as well as the security framework of the virtual world itself as defined and implemented by its administrator.

As rules and regulations for the protection of real physical assets, in connection with the Cyberspace, are still being written, those pertaining to virtual assets are almost non-existent. Extra care and caution must be undertaken by prospecting participants to ensure proper protection of its virtual assets.

9.1.3 Threats to organizational assets

Organizations' online presence and online business are often targeted by miscreants whose intent is more than plain mischief.

In the event of a successful attack, personal information from employees, clients, partners or suppliers could be disclosed and result in sanctions, against the organizations, if it was found to have been managed or protected insufficiently, contributing to the loss.

Financial filing regulations could also be breached if organizational results are disclosed in an unauthorized manner.

Governments hold information on national security, strategic, military, intelligence issues among many other elements relating to the government and state, but also a vast array of information on individuals, organizations and society as a whole.

Governments must protect its infrastructure and information from undue access and exploitation. With a growing and expanding trend of offering e-government services through the Cyberspace, this is a new channel, among others, to launch attacks and access the above information which, if successful, may result in serious risks to a nation, its government and its society.

On a larger scale, the infrastructure that supports the Internet, and thus the Cyberspace, can be targeted as well. While this will not affect the functioning of the Cyberspace permanently, it will affect the reliability and availability of the infrastructure, which contributes to the security of the Cyberspace.

On a national or international level, the Cyberspace is a grey area in which terrorism thrives. One of the reasons is the ease of communication provided by the Cyberspace. Due to the nature of the Cyberspace, specifically the challenges in defining boundaries and borders, it is difficult to regulate and control the way that it can be used.

Terrorist groups can either legitimately buy the applications, services and resources that facilitate their cause, or they can resort to illegal means of securing these resources to avoid detection and tracking. This can include acquiring massive computing resources through botnets.

9.2 Threat agents

A threat agent is an individual or group of individuals who have any role in the execution or support of an attack.

Thorough understanding of their motives (religious, political, economic, etc.), capabilities (knowledge, funding, size, etc.) and intentions (fun, crime, espionage, etc.) is critical in the assessment of vulnerabilities and risks, as well as in the development and deployment of controls.

9.3 Vulnerabilities

A vulnerability is a weakness of an asset or control that can be exploited by a threat. Within the context of an information system, ISO/IEC TR 19791:2006 also defines vulnerability as a flaw, weakness or property of the design or implementation of an information system (including its security controls) or its environment that could be intentionally or unintentionally exploited to adversely affect an organization’s assets or operations.

Vulnerability assessment must be an on-going task. As systems receive patches, updates or new elements are added, new vulnerabilities may be introduced. Stakeholders require a thorough knowledge and understanding of the asset or control in question, as well as the threats, threat agents and risks involved, in order to perform a comprehensive assessment.

NOTE

ISO/IEC 27005 provides guidelines on identifying vulnerabilities.

An inventory of known vulnerabilities should be kept with the strictest access protocol and preferably separate, physically and logically, from the asset or control it is applicable to. Should a breach of access occur and the vulnerability inventory be compromised, the vulnerability inventory would be one of the most effective tools in the arsenal of a threat agent to use to perpetrate an attack.

Solutions to vulnerabilities must be sought, implemented and, when a solution is not possible or feasible, controls must be put in place. This approach should be applied on a priority basis so the vulnerabilities posing a higher risk are addressed first. Vulnerability disclosure procedures could be defined under the framework of information sharing and coordination in clause 13 of this International Standard.

NOTE

A future International Standard, ISO/IEC 29147, will provide guidance on vulnerability disclosure.

9.4.1 Introduction

Many of the attacks in the Cyberspace are carried out using malicious software, such as spyware, worms and viruses. Information is often gathered through phishing techniques. An attack can occur as a singular attack vector or carried out as a blended attack mechanism. These attacks can be propagated via, for example, suspicious websites, unverified downloads, spam emails, remote exploitation, and infected removable media.

The attacks can come from two major categories:

There are cases though that attacks are a combination of both inside and outside of a private network. Other mechanisms growing in use and sophistication, for carrying out attacks, are those based on social networking websites and the use of corrupted files on legitimate websites.

Individuals tend to implicitly trust messages and content received from contacts previously accepted in their profiles on their social networking websites. Once an attacker, through identity theft, can disguise him/herself as a legitimate contact, the attacker can engage others, and a new avenue is open for launching the various types of attacks previously discussed.

Legitimate websites can also be hacked into and have some of its files corrupted and used as a means for perpetrating attacks. Individuals tend to implicitly trust commonly visited websites, often bookmarked in their Internet browsers for a long time, and even more those which use security mechanisms such as SSL (Secure Sockets Layer). While party authentication and integrity of the information being transmitted or received are still in place, SSL does not differentiate between the original content and the new corrupted content, planted by an attacker, thus exposing users of that website to attacks.

Despite the perceived legitimate source, such as in instances like the above, individuals must still take the precautions outlined in clause 11 to better protect themselves.

9.4.2 Attacks from inside the private network

These attacks are normally launched inside an organization's private network, typically the local area network, and can be initiated by employees or someone who gets access to a computer or network within an organization or individual's premises.

The attacker can use mechanisms such as packet sniffer software to obtain passwords or other identity information. Alternatively, the attacker can masquerade as an authorized entity and act as man-in-the-middle to steal identity information.

Besides the attacks launched by human attackers, malware infected computers also launch various attacks to surrounding computers inside the private network.

9.4.3 Attacks from Outside the Private Network (e.g. Internet)

There are many different attacks that can be launched from outside the private network, including the Internet.

While the initial attack will always target a publicly facing system (e.g. router, server, firewall, website, etc.), attackers may also be seeking to exploit assets residing inside the private network.

Old attack methods are improved and new ones are developed on an on-going basis. Attackers are increasingly sophisticated and normally combine different attack techniques and mechanisms to maximize their success, which makes attack detection and prevention even more difficult.

Port scanners are one of the oldest, and still very effective, tools used by attackers. They scan all ports available on a server to confirm which ports are “open”. This normally is one of the first steps executed by a prospective attacker on the target system.

These attacks can manifest into various DoS attacks to either the application servers or other networking equipment by exploiting protocol or application design vulnerabilities.

With the proliferation of peer-to-peer applications, commonly used to share files such as digital music, video, photos, etc., attackers are becoming increasingly sophisticated in how to disguise themselves and their malicious code using the exchanged files as a trojan horse for their attacks.

Buffer overflows (a.k.a. buffer overruns) are another popular method of compromising servers on the Internet. By exploiting coding vulnerabilities and sending much longer than expected strings of character, attackers cause the server to operate outside its normal (controlled) environment, thus facilitating the insertion/execution of malicious code.

Another technique is IP Spoofing, which consists in the attacker manipulating the IP address associated with his/her messages in an attempt to disguise as a known, trusted source, thus gaining unauthorized access to systems.

10.1 Overview

To improve the state of Cybersecurity, stakeholders in the Cyberspace need to play an active role in their respective use and development of the Internet. These roles may at times overlap with their individual and organizational roles within their personal or organization networks. The term organization network refers to the combination of an organization's private networks (typically an intranet), extranets and publicly visible networks. For the purpose of this International Standard, publicly visible networks are those networks exposed to the Internet, for example to host a website. Because of this overlap, these roles can appear to have insignificant or no direct benefit for the individual and organization concerned. They are, however, significant to enhancing Cybersecurity when all involved act accordingly.

10.2.1 Introduction

Consumers can view or collect information, as well as provide certain specific information within a Cyberspace application’s space, or open to limited members or groups within the application’s space, or the general public. Actions taken by consumers in these roles can be passive or active, and can contribute directly and indirectly to the state of Cybersecurity.

10.2.2 Roles of individuals

Individual consumers of the Cyberspace may assume different roles in different context and applications.

Consumer roles can include, but are not limited to, the following:

In each of these roles, individuals can view or collect information, as well as provide certain specific information within a Cyberspace application’s space, or open to limited members or groups within the application’s space, or the general public. Actions taken by individuals in these roles can be passive or active, and can contribute directly and indirectly to the state of Cybersecurity.

Consequently, as in the real world, individual consumers need to exercise caution in each and every role they play in the Cyberspace.

10.2.3 Roles of organizations

Organizations often use the Cyberspace to publicise company and related information, as well as market related products and services. Organizations also utilize the Cyberspace as part of their network for delivery and receipt of electronic messages (for example, emails) and other documents (for example, file transfer).

In line with the same principles of being a good corporate citizen, these organizations should extend their corporate responsibilities to the Cyberspace by proactively ensuring that their practices and actions in the Cyberspace do not introduce further security risks into the Cyberspace. Some proactive measures include:

10.3 Roles of providers

Service providing organizations can include two categories:

Service providers are also consumer organizations. They are thus are expected to observe the same roles and responsibilities as consumer organizations. As service providers, they have additional responsibilities in maintaining or even enhancing security of the Cyberspace by:

11.1 Overview

The guidance in this clause focuses on three main areas:

The recommendations are structured as follows:

1. a) an introduction to risk assessment and treatment;
2. b) guidelines for consumers; and
3. c) guidelines for organizations, including service providers:

11.2 Risk assessment and treatment

ISO 31000, Risk management – Principles and guidelines, provides principles and generic guidelines on risk management while ISO/IEC 27005, Information technology – Security techniques – Information security risk management, provides guidelines and processes for information security risk management in an organization, supporting in particular the requirements of an ISMS according to ISO/IEC 27001. These guidelines and processes are considered sufficient for addressing risk management in the context of the Cyberspace.

ISO/IEC 27005:2011 does not provide any specific methodology for information security risk management. It is up to the consumers and providers to define their approach to risk management. A number of existing methodologies can be used under the framework described in ISO/IEC 27005 to implement the requirements of an ISMS.

The following aspects have to be taken into account when defining an approach to risk management:

In general, the risk management methodology in ISO/IEC27005 covers the full life-cycle of a generic system, thus making it usable for new security systems as well as for legacy systems. Since it deals with the treatment of systems, it is applicable to all business models. The processes within the framework may treat the service providers’ networks and services as an integrated system, consisting of subsystems that provide public services and private subsystems that support internal services, or it may treat each of the individual services (e.g., web hosting) separately, and describe their provision in terms of separate interacting systems. It may be advantageous, for simplicity, to consider everything that is needed to support the provider’s services as a large system that can be decomposed into smaller systems, each of which provides a marketable service or forms part of the infrastructure.

Important aspects to remember when considering the goals and objectives of Cybersecurity are:

1. a) protect the overall security of the Cyberspace;
2. b) plan for emergencies and crises through participation in exercise, and update response plans and plans for continuity of operations;
3. c) educate stakeholders on Cybersecurity and risk management practices;
4. d) ensure timely, relevant and accurate threat information sharing between law enforcement and intelligence communities and key decision makers relevant to the Cyberspace; and
5. e) establish effective cross-sector and cross-stakeholder coordination mechanisms to address critical interdependencies, including incident situational awareness and cross-sector and cross-stakeholder incident management.

Goals and objectives a) to c) flow down directly to the service providers, who are responsible for the equipment and services under their control. For goals and objectives d) and e), the service providers are involved as active participants in the information sharing and coordination activities.

Specific service provider goals, such as what services to supply, flow down from the business context.

11.3 Guidelines for consumers

This International Standard is not directed at individuals of the Cyberspace specifically, but focuses on organizations providing services to consumers, and organizations that require their employees or end-users to practice secure use of the Cyberspace to manage the Cybersecurity risk effectively. The guidance on the roles and security of users in the Cyberspace and how they could positively influence the state of Cybersecurity aims to serve as a guide for the design and development contents by these organizations, in the context of their service provisioning and awareness and training programs for delivery to their end-users.

As explained in clause 10.2, consumers can view or collect information, as well as provide certain specific information within a Cyberspace application’s space, or open to limited members or groups within the application’s space, or the general public. Actions taken by consumers in these roles can be passive or active, and can contribute directly and indirectly to the state of Cybersecurity.

For example, as an IAP, if the application provided contains security vulnerabilities, they could result in exploitation by cyber-miscreants leveraging them as a channel to reach innocent users of the application. As bloggers or other forms of contents contributors, they can receive a request in the form of innocent questions on their contents in which they can unintentionally reveal more personal or company information to the public than desired. As a buyer or seller, a consumer can unknowingly participate in criminal transactions of selling stolen goods or money laundering activities. Consequently, as in the physical world, consumers need to exercise caution in each and every role they play in the Cyberspace.

In general, consumers should take note of the following guidance:

1. a) Learn and understand the security and privacy policy of the site and application concerned, as published by the site provider.
2. b) Learn and understand the security and privacy risks involved and determine appropriate controls applicable. Participate in related online discussion forums or ask someone who knows about the site or application before providing personal or organization information, or participating and contributing information to the discussion.
3. c) Establish and practice a personal privacy policy for identity protection by determining the categories of personal information available and sharing principles relating to that information.
4. d) Manage online identity. Use different identifiers for different web applications, and minimize the sharing of personal information to each website or application requesting such information. Register one’s online identity on popular social networking sites even if the account is left dormant.
   EXAMPLE

   Single sign on is a form of online identity management.

5. e) Report suspicious events or encounters to the relevant authorities (see Annex B for as an example of a publicly available list of contacts).
6. f) As a buyer or seller, read and understand the online marketplace’s site security and privacy policy, and take steps to verify the authenticity of the interested parties involved. Do not share personal data, including banking information, unless a genuine interest to sell or buy has been established. Use a trustworthy payment mechanism.
7. g) As an IAP, practice secure software development and provide a hash value of the code online so that receiving parties can verify the value if necessary to ensure integrity of the code. Provide documentation of the code security and privacy policies and practices and respect the privacy of code users.
8. h) As a blogger or other content contributor (including website maintainers), ensure that applicable stakeholder privacy and sensitive information are not disclosed through the blogs or online publications. Review comments and postings received on the site and ensure that they do not contain any malicious content such as links to phishing websites or malicious downloads.
9. i) As a member of an organization, an individual consumer should learn and understand the organization’s corporate information security policy and ensure that classified and/or sensitive information are not released intentionally or by accident on any websites in the Cyberspace, unless prior authorization for such disclosure has been formally granted.
10. j) Other roles. When a consumer visits a site which requires authorization, and unintentionally gains access, the user may be labelled as an intruder. Exit the site immediately and report to the relevant authority, since the fact that it was possible to gain access can be an indication of a compromise.

11.4.1 Overview

Controls for managing Cybersecurity risks depend significantly on the maturity of the security management processes within organizations (including service providers). While the guidelines suggested here are mainly discretionary for organizations, it is recommended that service providers treat the guidelines as baseline mandatory measures.

The guidelines in this clause can be summarized as:

11.4.2.1 Information security management system

At the enterprise level, organizations connecting to the Cyberspace should implement an information security management system (ISMS) to identify and manage related information security risk to the business. The ISO/IEC 27000 series of International Standards for information security management systems provides the required guidance and best practices for implementing such a system.

A key consideration in implementing an ISMS is to ensure that the organization has a system to continuously identify, assess, treat, and manage information security risk relating to its business, including the provision of services on the Internet, directly to end-users or subscribers, should it be a service provider.

NOTE 1

ISO/IEC 27005, Information technology – Security techniques – Information security risk management, provides guidelines for information security risk management in an organization, supporting in particular the requirements of an ISMS according to ISO/IEC 27001.

NOTE 2

ISO 31000, Risk management – Principles and guidelines, provides principles and generic guidelines on risk management.

Organizations may also consider a formal certification of its compliance with ISMS requirements, such as ISO/IEC 27001.

As part of the implementation of an ISMS, an organization should also establish a security incident monitoring and response capability and coordinate their incident response activities with external CIRT, CERT, or CSIRT organizations in the country. The incident and emergency response provision should include monitoring and assessing the security status of th use of the organization’s services by end-users and customers, and provide guidance to assist the affected parties in responding to security incidents effectively.

NOTE

ISO/IEC 27035, Information technology – Security techniques – Information security incident management, provides guidance on information security incident management.

11.4.2.2 Provide secure products

Some organizations develop¹ and release their own web browser toolbars, diallers, or code to provide value-added services to end-users, or facilitate ease of access to the organization’s services or applications. In such instances, there should be a proper end-user agreement in a suitable language, incorporating statements about the organization’s coding policy, privacy policy, and means whereby users can change their acceptance later or escalate any issues they might have regarding the policy and practices. When such an agreement is used, it should be placed under version control and the organization should make sure that end-users sign it consistently.

Where there is a high degree of reliance on the security of software products, these should be independently validated under the Common Criteria scheme, as described at ISO/IEC 15408.

Organizations should document code behaviour and make an assessment as to whether the behaviour can fall in potential areas that might be considered as spyware or deceptive software. In the latter case, it should engage a suitably qualified assessor to evaluate whether the code fall within anti-spyware vendors objective criteria that adheres to best practices so that the organization-provided software tools for the end-users, would not be labelled as spyware or adware by anti-spyware vendors. Many anti-spyware vendors publish the criteria by which they rate software.

Organizations should implement digital code signing for their binaries so that anti-malware and anti-spyware vendors could easily determine the owner of a file, and ISVs, who consistently produce software that follows best practices, would be categorized as being likely secure even prior to analysis.

Should an organization discover useful software techniques that could help to reduce the spyware or malware problem, the organization should consider partnering and working with the vendor to make them broadly available.

In order to fulfill these requirements, security education of developers is very important. A secure software development life cycle should be used where software vulnerabilities can be minimized hence providing a more secure software product.

NOTE

ISO/IEC 27034, Information technology – Security techniques – Application security, provides guidelines to define, develop, implement, manage, support and retire an application.

11.4.2.3 Network monitoring and response

Network monitoring is commonly used by organizations to ensure reliability and quality of their network services. At the same time, this capability can be leveraged to look for exceptional network traffic conditions and detect malicious activities emerging on the network. In general, organizations should perform the following:

11.4.2.4 Support and escalation

Businesses, including service providers and government organizations normally have a support service to answer customers queries and provide technical assistance and support to address end-users’ problems. With the increasing proliferating of malware on the Internet, a service providing organization can receive reports relating to malware and spyware infections and other Cybersecurity issues. Such information are important and useful for relevant vendors to assess the risk and malware situation, and provide updates to necessary tools to ensure that any new malware or spyware detected can be removed or disabled effectively. In this regard, an organization should establish contact with security vendors and submit relevant reports and malware samples to the vendors for follow-up – particularly if there appears to be a spike in prevalence. Most vendors maintain an email list for receiving such reports or samples for analysis and follow-up. For example, see Table B.1 in Annex B.

11.4.2.5 Keeping up-to-date with latest developments

As part of the ISMS implementation to manage the enterprise information security risk, and also ensure that organizations continue to follow-up industry best practices and keep tap with the latest vulnerabilities and exploits/attacks situation, organizations should participate in relevant community or industry forums to share their best practices and learn from other fellow providers.

11.4.3 Security requirements for hosting web and other cyber-application services

Most service providers provide hosting services on their network and data centre as part of their business services. These services, which include websites and other online applications, are often re-packaged and re-sold by hosting subscribers to other consumers, such as small businesses and end-users. Should the hosting subscribers set up an insecure server, or host malicious contents in their sites or applications, the security of the consumers will be adversely affected. As such, it is important that services, at a minimum, meet best practices standards by complying with policy or terms of agreements.

Where multiple providers are used, the interaction between the providers should be analysed and the respective service agreements should address any critical interaction. For example, updates or patches to one provider’s systems should be coordinated with other providers, should the update result in a negative interaction.

The terms of agreements should at least cover the following:

1. a) Clear Notices, describing the online site or application security and privacy practices, data collection practices, and the behaviour of any code (for example, Browser Helper Object) that the online site or application can distribute and execute in end-user desktops or web browser environments.
2. b) User Consent, facilitating user’s agreement or disagreement with the terms of services described in the Notices. This would allow a user to exercise discretion and determine whether he/she can accept the terms of services accordingly.
3. c) User Controls, facilitating users to change their settings or otherwise terminate their acceptance anytime in the future after the initial agreement.

The terms are important to ensure that the end-users are clear about the behaviour and practices of the online site or application, in relation to the end-users’ privacy and security. The terms should be developed with the aid of a legal professional to ensure that they will also indemnify the service provider from potential legal action from the end-users, as a result of specific losses or harm incurred due to malicious contents or unclear policies and practices on the website.

In addition to the data protection and personal privacy provisions on the online site or application, service providers should require online sites or applications hosted on their networks to implement a set of best practices security controls at the application level before they could go live. These should include but are not limited to examples given in clause 12.2.

As part of a service provider’s hosting infrastructure, servers should be protected against unauthorized access and the ability to host malicious content. See clause 12.3 for examples of controls.

To permit the enforcement of these security controls, in particular, those relating to the online site and application security, service providers should consider incorporating these provisions in the terms of services agreements.

11.4.4 Security guidance for consumers

Service providers should provide guidance to consumers on how to stay secure online. Service providers may either create the guidance directly, or refer the users to available guidance sites that could provide the contents. It is critical to educate end-users on how they can contribute to a secure Internet in relation to the multiple roles that they can play in the Cyberspace, as described in clause 7. In addition, end-users should be advised to take necessary technical security controls in which service providers could also play an active role, as described in clause 11.3. Examples of guidance activities may include:

1. a) Periodic (for example, monthly) security newsletters to advise on specific security techniques (for example, how to choose a good password); updates on security trends; and to provide notices of security webcasts, other on-demand videos, audio broadcasts, and security information that are available from the organization’s web portal or other security content providers.
2. b) Direct broadcasts of on-demand security education videos or webcasts covering a variety of security topics to improve end-users’ security practices and awareness.
3. c) Incorporating a security column in the service provider’s hard-copy newsletter that are sent to end-users’ resident or office addresses to highlight key security events or contents.
4. d) Annual or other periodic end-user security seminars or road shows, possibly in partnership with other industry players, vendors, and governments.

Service providers using email as the primary way of communicating with end-users should do so in a way that helps end-users resist social engineering attacks. In particular, end-users should be consistently reminded that unsolicited emails from the service provider will never ask for

When a service provider wishes a user to go to its site for information they should tell the user how to safely connect to the required URL. For example, they might ask a user to type a quoted URL into their browser and make sure that the quoted URL does not contain a clickable link.

As part of the user security education and guidance against deceptive software and spyware, organizations and service providers should advise their end-users on the use of suitable technical security controls to protect their systems against known exploits and attacks. As a general guide, consumers should be encouraged to implement the controls in clause 12.4.

Annex B provides an example list of references and online resources that could be used to support the implementation of the above recommendations.

12.1 Overview

Once the risks to Cybersecurity are identified and appropriate guidelines are drafted, Cybersecurity controls that support the security requirements can be selected and implemented. This clause gives an overview of the key Cybersecurity controls that can be implemented to support the guidelines laid out in this International Standard.

12.2 Application level controls

Application level controls include the following:

1. a) Display of short notices, which provide clear, concise one-page summaries (using simple language) of the company’s essential online policies. With this, users are able to make more informed choices about sharing their information online. The short notices should conform to all regulatory requirements and provide links to full legal statements and other relevant information, so customers who want more detail can easily click through to read the longer version. With a single notice, customers can have a more consistent experience across all of the company’s properties, with the same privacy standards and expectations extended to many sites.
2. b) Secure handling of sessions for web applications; this can include online mechanisms such as cookies.
3. c) Secure input validation and handling to prevent common attacks such as SQL-Injection. Based on the fact that websites, which are generally considered as trustworthy, are increasingly used for malicious code distribution, input and output validation have to be carried out by active content as well as by dynamic content.
4. d) Secure web page scripting to prevent common attacks such as Cross-site Scripting.
5. e) Code security review and testing by appropriately skilled entities.
6. f) The organization's service, whether provided by the organization or by a party representing the organization, should be provided in a fashion that the consumer can authenticate the service. This may include having the provider use a sub-domain from the organization's branded domain name and possibly the use of HTTPS credentials registered to the organization. The service should avoid the use of deceptive methods where the consumer may have difficulty determining with whom they are dealing.

12.3 Server protection

The following controls can be used to protect servers against unauthorized access and the hosting of malicious content on servers:

1. a) Configure servers, including underlying operating systems in accordance to a baseline security configuration guide. This guide should include proper definition of server users versus administrators, enforcement of access controls on program and system directories and files, and enabling of audit trails, in particular, for security and other failure events on the system. Furthermore it is recommended to install a minimal system on a server in order to reduce the attack vector.
2. b) Implement a system to test and deploy security updates, and ensure the server operating system and applications are kept up-to-date promptly when new security updates are available.
3. c) Monitor the security performance of the server through regular reviews of the audit trails.
4. d) Review the security configuration.
5. e) Run anti-malicious software controls (such as anti-virus and anti-spyware) on the server.
6. f) Scan all hosted and uploaded content regularly using up to date anti-malicious software controls. Recognize that a file can, for example, still be spyware or malware even if not detected by the current controls due to the constraints of imperfect information.
7. g) Perform regular vulnerability assessments and security testing for the online sites and applications to ensure that their security is adequately maintained.
8. h) Regularly scan for compromises.

12.4 End-user controls

The following is an incomplete list of controls that end-users can use to protect their systems against known exploits and attacks:

1. a) Use of supported operating systems, with the most updated security patches installed. Organizational consumers have a responsibility to be aware of, and follow, organizational policy regarding supported operating systems. Individual consumers should be aware of, and consider using, provider recommended operating systems. In all cases, the operating system should be kept up to date regarding security patches.
2. b) Use of the latest supported software applications, with the most updated patches installed. Organizational consumers have a responsibility to be aware of, and follow, organizational policy regarding supported application software. Individual consumers should be aware of, and consider using, provider recommended application software. In all cases, the application software should be kept up to date regarding security patches.
3. c) Use anti-virus and anti-spyware tools. If feasible, a service provider such as an ISP should consider partnering with trusted security vendors to offer end-users these tools as part of the service subscription package so that the security controls are made available upon signing-up the subscription, or upon renewal. Organizational consumers have a responsibility to be aware of, and follow, organizational policy regarding the use of security software tools. Individual consumers should use security software tools. They should look to the provider for any recommended, provided, or discontinued security software. In all cases, the security software should be kept up to date regarding security patches and signature databases.
4. d) Implement appropriate anti-virus and anti-spyware safeguards. Common web browser and browser toolbars have now incorporated capabilities such as pop-up blockers, which will prevent malicious websites from displaying windows that contain spyware or deceptive software that could exploit system or browser weaknesses, or use social engineering to trick users into downloading and installing them on their systems. Organizations should establish a policy to enable the use of such tools. Service providing organizations should collate a list of recommended tools, and their use should be encouraged to end-users, with guidance on their enablement and permission granting for websites that users would like to allow.
5. e) Enable script blockers. Enable script blockers or a higher web security setting to ensure that only scripts from trusted sources are executed on a local computer.
6. f) Use phishing filters. Common web browser and browser toolbars often incorporates this capability, which could determine whether a site that a user is visiting is found within a database of known phishing websites, or contains script patterns that are similar to those found typical phishing websites. The browser would provide alerts, normally in the form of colour-coded highlights, to warn users of the potential risk. Organizations should establish a policy to enable the use of such tool.
7. g) Use other available web browser security features. From time to time, as new Cybersecurity risk emerges, web browsers and browser toolbar providers add new security capabilities to protect users against risks. End-users should keep abreast of these developments by learning about such updates that are normally provided by the tool providers. Organizations and service providers should similarly review these new capabilities and update related policies and services to better serve the needs of their organizations and customers, and address related Cybersecurity risk.
8. h) Enable a personal firewall and HIDS. Personal firewalls and HIDS are important tools for controlling network services accessing the user systems. A number of newer operating systems have personal firewalls and HIDS incorporated. While they are enabled by default, users or applications might disable them, resulting in undesirable network security exposures. Organizations should adopt a policy on the use of a personal firewall and HIDS and evaluate suitable tools or products for implementation so that their use is enabled by default for all employees. Service providers should encourage the use of a personal firewall and HIDS functions, and/or suggest other third-party personal firewall and HIDS products that has been evaluated and considered as trusted, and educate and help users in enabling basic network security at the end-user system level.
9. i) Enable automated updates. While the above technical security controls are capable of dealing with most malicious software at their respective operating levels, they are not very effective against exploitation of vulnerabilities that exist in operating systems and application products. To prevent such exploits, the updating function available in operating systems, as well as those provided by user-trusted applications (for example, trusted third-party evaluated anti-spyware and anti-virus products), should be enabled for automated updates to be performed. This would then ensure that systems are updated with the latest security patches whenever they are available, closing the time gap for exploits to take place.

12.5.1 Overview

Cybercriminals are increasingly resorting to psychological or social engineering tactics in order to succeed.

The proliferation of social networking and community sites provides new vehicles that further enable more believable scams and frauds to be conducted. Increasingly, such attacks are also transcending technology, beyond the PC systems and traditional network connectivity, leveraging mobile phones, wireless networks (including Bluetooth), and voice-over-IP (VoIP).

This clause provides a framework of controls applicable for managing and minimizing the Cybersecurity risk in relation to social engineering attacks. The guidance provided in this clause is based on the notion that the only effective way to mitigate the threat of social engineering is through the combination of:

The framework therefore covers:

12.5.2 Policies

In line with common practices for information security risk management, basic policies governing the creation, collection, storage, transmission, sharing, processing and general use of organizational and personal information and intellectual property on the Internet and in the Cyberspace should be determined and documented. In particular, this relates to applications such as instant messaging, blogging, P2P file sharing, and social networking, which are normally beyond the scope of enterprise network and information security.

As part of corporate policies, statements and penalties relating to the misuse of Cyberspace applications should also be incorporated to deter against practices of misuse by employees and third-parties on the corporate network or systems accessing the Cyberspace.

Administrative policies promoting awareness and understanding of Cybersecurity risks, and encouraging, if not mandating, the learning and development of skills against Cybersecurity attacks, in particular, social engineering attacks, should be developed and promulgated. This should include requirements for regular attendance to such briefings and training.

By promoting suitable policies and awareness on social engineering risks, employees can no longer claim ignorance of such risks and requirements, and at the same time develop an understanding of best practices and policies expected of external social networking and other Cyberspace applications, for example, the security policy agreement of the service provider.

12.5.3.1 Categorization and classification of information

To support policies to promote awareness and protection of corporate classified and personal sensitive information, including intellectual properties, processes for categorization and classification of information should be implemented.

For each category and classification of information involved, specific security controls for protection against accidental exposure, and intended unauthorized access should be developed and documented.

Users in organizations could then differentiate between the different categories and classification of information that they generate, collect, and handle. Users can then exercise the required caution and protective controls when using the Cyberspace.

Procedures on how to handle company intellectual properties, personal data, and other confidential information should also be developed and promulgated.

12.5.3.2 Awareness and training

Security awareness and training, including regular updating of relevant knowledge and learning are an important element for countering social engineering attacks.

As part of an organization’s Cybersecurity program, employees and third-parties contractors should be required to undergo a minimum number of hours of awareness training in order to ensure that they are aware of their roles and responsibilities in the Cyberspace, and technical controls that they should implement as individuals using the Cyberspace. In addition, as part of the program to counter social engineering attacks, such awareness training should include contents such as the following:

1. a) The latest threats and forms of social engineering attacks, for example, how phishing has evolved from fake websites alone to a combination of Spam, Cross Site Scripting, and SQL Injection attacks.
2. b) How individual and corporate information can be stolen and manipulated through social engineering attacks, providing understanding on how attackers can take advantage of human nature, such as a tendency to comply to requests that are made with authority (even though it can be unreal), friendly demeanour, posing as a victim, and reciprocation by first giving something of value or help.
3. c) What information needs to be protected and how to protect it, in accordance with the information security policy.
4. d) When to report or escalate a suspected event or malicious application to approach authorities or response agency, and information on these contacts available. For example, see Annex B.

Organizations providing Cyberspace applications and services online should provide awareness materials to subscribers or consumers covering the above contents within the context of their applications or services.

12.5.3.3 Testing

Employees should sign an acknowledgement that they accept and understand the contents of the organization’s security policy. As part of the process to improve awareness and ensure due attention to such risk, an organization should consider conducting periodic tests to determine the level of awareness and compliance with related policies and practices. Employees can perform a written test or undergo CBT to determine if they understand the contents of the organization’s security policy. Such tests may include but are not limited to the creation of targeted but controlled phishing sites, Spam, and scam mails using believable social engineering contents. When conducting such tests, it is important to ensure that:

1. a) the test servers and contents are all within the control and command of the testing team;
2. b) professionals who have prior experience of running such a test are engaged where possible;
3. c) users are prepared for such tests through the awareness and training programs; and
4. d) all test results are presented in aggregated format in order to protect an individuals’ privacy as the content presented in such tests can embarrass individuals and cause privacy concerns if not adequately managed.

   NOTE

   The ethics and legislation of each country must be taken into consideration.

12.5.4 People and organization

While individuals are the primary targets of social engineering attacks, an organization can also be the intended victim. People, however, remain the main entry point for social engineering attacks. As such, people need to be aware of related risks in the Cyberspace, and organizations should establish relevant policies and take proactive steps to sponsor related programs to ensure people's awareness and competency.

As a general guide, all organizations (including enterprise, service providers, and government) should encourage consumers in the Cyberspace to learn and understand social engineering risks in the Cyberspace, and the steps they should take to protect themselves against potential attacks.

12.5.5 Technical

In addition to establishing policies and practices against social engineering attacks, technical controls should also be considered and where possible, adopted to minimize exposure and potential for cyber miscreants’ exploitations.

At the personal level, Cyberspace users should adopt the guidance discussed in clause 11.3.

Organizations and service providers should undertake relevant steps described in clause 11.4.4 to facilitate users’ adoption and use of technical security controls.

Organizations and service providers should also adopt the guidance provided in clause 11.4, which are important as baseline controls against social engineering attacks in the Cyberspace.

In addition, the following technical controls that are useful against specific social engineering attacks should be considered:

1. a) Where personal or corporate sensitive information are involved in online applications, consider the provision of strong authentication solutions either as part of the login authentication, and/or when critical transactions are being executed. Strong authentication refers to the use of two or more additional factors of identity verification, over and above the use of a user ID and password. The second and additional factors may be provided using smartcard, biometrics, or other hand-held security tokens.
2. b) For web-based services, organizations should consider the use of a “High Assurance Certificate” to provide added assurance to online users. Most commercial Certification Authorities (CA) and Internet browsers are capable of supporting the use of such certificates, which reduce the threat of phishing attacks.
3. c) To ensure the security of users’ computers connecting to the organization or service provider’s site or application in the Cyberspace, additional controls to ensure a minimum level of security, such as installation of latest security updates, should be considered. Use of such controls should be published in the End-user Service Agreement and/or the Site Privacy and Security Policy whichever is applicable.

12.6 Cybersecurity readiness

Annex A describes additional technical controls that are applicable for improving an organization’s Cybersecurity readiness in the area of event detection, through Darknet Monitoring, investigation, through Traceback, and response, through Sinkhole Operation.

12.7 Other controls

Other controls may include controls related to alerting and quarantine of devices which are engaging in suspicious activity as observed through correlation of events from service provider and/or enterprise elements such as DNS servers, router net flow, outbound message filtering and peer-to-peer communications.

13.1 General

Cybersecurity incidents often cross national geographical and organizational boundaries, and the speed of information flow and changes from the unfolding incident often gives limited time for the responding individuals and organizations to act. A system needs to be established for information sharing and coordination to help prepare and respond to Cybersecurity events and incidents. This is an important step that organizations should take as part of their Cybersecurity controls. Such a system for information sharing and coordination should be secure, effective, reliable and efficient.

The system should be secure to ensure that the information being shared, including details about the coordination of activities, are protected against unauthorized access, in particular by the perpetrator of the incident concerned. Security of information relating to Cybersecurity events is also necessary to prevent misinterpretation and causing undue panic or alarms to the public. At the same time, integrity and authenticity of information are critical to ensure its accuracy and reliability irrespective of whether such information is shared within a closed group, or disclosed publicly. The system should be effective and efficient so that it serves its purpose with minimum resources and within the required time and space.

This clause provides a basic framework for implementing a system for information sharing and coordination. The framework includes four areas for consideration, namely, policies, methods and processes, people, and technical elements.

NOTE

ITU-T’s Study Group 17 is undertaking extensive work on Cybersecurity information exchange. Refer to Table C.17 — Cybersecurity information exchange for further information.

13.2.1 Information providing organizations and Information receiving organizations

For the purpose of this framework, two types of information sharing organizations are introduced:

As IPO, basic policies with regard to the classification and categorization of information, the severity of events and incidents, and the form of sharing possible should be determined prior to the occurrence of any Cybersecurity incidents, or any sharing takes place (in the case of an IPO turning into an IRO to share received information with other authorized entities in the information chain).

At the receiving end, IRO should agree to enforce the security protection and relevant procedures upon receiving information from the IPO, in accordance with the agreement previously reached, and based on the classification and categorization of information involved.

13.2.2 Classification and categorization of information

IPOs should determine the different categories of information that they collect, collate, safe-keep, and distribute. Examples of information categories can include security events, security threats, security vulnerabilities, suspected/confirmed perpetrators’ profiles, organized groups, victims’ information, and ICT system profile categories.

For each category, it should be further broken down into two or more classifications based on the contents of the information involved. The minimum classification may be sensitive and unrestricted. If information contains personal data, privacy classifications may also be applied.

13.2.3 Information minimization

For each category and classification, IPO should exercise caution to minimize the information to be distributed. The minimization is necessary to prevent information overload at the receiving end, to ensure efficient use of the sharing system, without compromising effectiveness. Another objective of the minimization is omitting sensitive information to preserve the privacy of people in IPO and IRO. In this regards, IPO and IRO should determine the desired level of details, wherever possible, for each category and classification of information that can be identified prior to the actual sharing.

13.2.4 Limited audience

In line with the minimization principle, a policy to limit the audience, which may be to a specific contact person, group, or organization, for distribution is necessary when sharing information containing private or confidential data. For less sensitive information, such a policy should be considered to prevent information overload, unless the benefits of maximum distribution (such as the sharing of critical security alerts) outweigh the impact of information overload for the IRO.

13.2.5 Coordination protocol

A high-level policy for coordinating the request and distribution (whether it is IPO or IRO initiated) should be established. Such a policy formalizes the protocol involved, which provides a means for the IPO and IRO to respond effectively and efficiently. Mutual authentication and verification procedures could then be built upon such a protocol to ensure the authenticity of origin and proof of delivery where desired, in particular, for sensitive, personal, and/or confidential information.

13.3.1 Overview

To effect the information sharing policies, and ensure consistency of practice, effectiveness, efficiency, and reliability of execution, related methods and processes should be developed and implemented. Such methods and processes should be based on available standards. Otherwise, upon operational validation, they may be formalized for standardization. The following clauses provide guidance on the methods and processes that are commonly used by organizations in the industry for achieving relevant objectives and policies of information sharing and coordination in the context of Cybersecurity.

13.3.2 Classification and categorization of information

Information to be shared will come from both open and closed sources. Open source information is often to be found on the internet or from other public sources, such as newspapers. Open source information is generally of the lowest classification because the originators of the information can be multiple or unknown, the age of the information can be undetermined and the accuracy subject to question. Closed source information is not publicly available, often attributable to a source and of known age. Examples of closed source information are proprietary research and analytics, or empirically gathered intelligence.

NOTE

the guidance for this clause may be based on the outcome of the Study Period on this topic, referencing the standard if the SP proceeds to development, or adopting a summary of the text from the SP if it terminates without further development.

13.3.3 Non-disclosure agreement

An NDA may be used for at least two purposes in the context of information sharing and coordination for improving Cybersecurity. A typical use of an NDA is to ensure adequate handling and protection of sensitive, personal, and/or confidential information shared among IPO and IRO, and pre-establishing the condition of sharing and further distribution and use of such information.

In the context of responding to Cybersecurity events, the pre-establishment of an NDA enables swift sharing and distribution amongst authorized entities to take place efficiently even if the information classification has not been clearly defined.

13.3.4 Code of practice

One commonly used method to ensure adequate sharing and handling of sensitive information is the establishment of a code of practice, covering detailed procedures, responsibilities, and commitments from stakeholder organizations (i.e., IPO and IRO) for responses and actions to be taken by respective entities involved for each category and classification of information.

13.3.5 Testing and drills

To ensure effectiveness and reliability and to achieve the desired level of efficiency, methods and processes should be developed for conducting regular testing and exercising scenario drills.

A standard methodology should be used as a reference for security testing, in order to fit it down and match with the organization’s goals and needs.

Security tests can be performed on high risk assets. This can be assisted by using the organization’s own data classification nomenclature.

Security assessments should be performed on a regular basis on the:

13.3.6 Timing and scheduling of information sharing

The requirement to share information either proactively or during an incident response will vary from entity to entity. Some organizations will have a requirement for real-time information: the moment an alert or alarm occurs they will want the intelligence for further analysis. Other entities will not possess the resources to manage real-time information sharing. In fact, many organizations may not have the ability to manage schedule information sharing on any interval.

Information sharing timing and schedules should be defined clearly, with specific service level objectives defined for voluntary relationships and service level agreements for commercial relationships.

13.4.1 Overview

People and organizations are the key determinants to the success of Cybersecurity. People refer to individuals involved in executing the methods and processes for information sharing and coordinating to make a positive difference to the outcomes of Cybersecurity events. Organizations refer to groups of people within a company up to entire company involved in such activities. For effectiveness and efficiency, the needs of both people and organizations should to be considered.

13.4.2 Contacts

A list of contacts should be compiled by the IPO and IRO and mutually exchanged so that each entity can identify the person who requested or sent information on the sharing community.

More granular contact lists may also be developed and shared in accordance with a limited audience (clause 13.2.4) and information classification and categorization (clause 13.2.2) policies.

The contact list should not contain sensitive personal information, in accordance with the information minimization policy (clause 13.2.3). For privacy purposes, an alias may also be considered in place of full name. The minimum information for the contact list should include name (or alias), contactable numbers (mobile phone if possible), and email address. An alternative contact may also be established for each key person in the contact list.

In addition to a contact list for information sharing and coordination, a separate contact list for incident escalation may also be compiled to facilitate swift escalation. Such a list usually includes external contacts that are not in the sharing network. For example, see Annex B.

At the minimum, the contact list should be protected against unauthorized modification to prevent corruption and maintain integrity. Technical controls (clause 13.5) should be applied as appropriate.

13.4.3 Alliances

To facilitate information sharing, and establish common and consistent practices governed by an agreed code of practice, and/or NDA, organizations and groups of individuals may form alliances based on their areas of interest, which may be industry, technology, or other special interest areas. See Annex B for a sample list of existing alliances and non-profit organizations that serve such a purpose.

13.4.4 Awareness and training

People in organizations should be made aware of emerging and new Cybersecurity risks and trained so that they develop the required skills and expertise to respond effectively and efficiently when they encounter specific risk involved, or received information requiring their actions to mitigate or improve a given situation. To achieve these objectives,

This awareness, training and testing may be performed by internal experts involved, external consultants, or other experts from members of the related alliances involved in the information sharing and coordination efforts.

The use of scenarios as part of the training and testing processes is strongly recommended as such an approach enables individuals to gain near real-life experience of relevant situations and learn and practice the responses required. In addition, past incidents may be used as part of the scenarios to maximize sharing of lessons learnt and understanding gained from those situations.

13.5.1 Overview

Technical controls and standardization may be used to improve efficiency, reduce human error, and enhance security involved in the information sharing and coordination processes. A number of technical systems and solutions may be designed, developed and implemented. This International Standard provides some of the commonly used approaches and techniques that have been adopted by some organizations, and may be further adapted for improving the information sharing and coordination needs and processes to deal with the changing Cybersecurity risk environment.

13.5.2 Data standardization for automated system

As part of the sharing network, automated systems may be developed and deployed amongst coordinating organizations to collect data on evolving Cybersecurity events for real-time and offline analysis and assessment, in order to determine the latest security status in the Cyberspace within the boundary of the organizations involved. Such data may include network traffic data, security updates for software systems and hardware devices, security vulnerabilities data, and malware, spam, and spyware data, including their payloads and intercepted information. Automated systems supporting the first responders and incident escalation, as described in clause 13.4.2, would also contain data relating to organizations and people. In view of the sensitivity and volume of the contents of the data involved in these systems, organizations (in particular, alliances of organizations) should evaluate the data schemas and contents to determine suitable technical controls for improving efficiency, effectiveness, and security. These can include, but are not limited to the following:

1. a) standardization of the data schema for each category and classification of data collected enforcing the information minimization and privacy policy, and providing technical assurance to all participating entities, and data owners of such a practice;
2. b) standardization of data format to ease sharing and improve storage, transmission, handling and interoperability between systems. For example, see ITU-T X.1205; and
3. c) standardization of basic data processing functionality and algorithms used, for example, hash function and procedures for IP address anonymization and other pre-processing requirements.

13.5.3 Data visualization

Consider using data visualization techniques to present events information, which helps to improve visibility of changes and the emerging security incident taking place without the need for the operators to read the details of each event as it emerges. For example, see Annex A, which presents a visual representation of Darknet activities, which facilitates a more efficient response to the changes.

13.5.4 Cryptographic key exchange and software/hardware backups

To facilitate sharing of confidential information, a cryptographic system, including a system for key exchange that could be quickly deployed should be considered for implementation. The system should include adequate backups for the software and hardware, as well as the keys used in preparation for the sharing purposes and emergency recovery needs.

13.5.5 Secure file sharing, instant messaging, web portal, and discussion forum

To facilitate online interaction and quick and secure information sharing, which may include sharing of digital contents such as text and multimedia files, and both online and offline discussions, the sharing organizations (IPO and IRO) should consider adopting suitable file sharing tools, instant messenger, and online discussion forum tools that could meet the security, effectiveness, efficiency, and reliability needs.

Web portal provision feeds on Cybersecurity events and status should be implemented as a form of communication for both public and private community interested and involved, respectively. Where such a web portal is used, there should be clear administrative ownership and responsibility to ensure its security and availability, and private areas should be provided for limited audience information where necessary.

13.5.6 Testing systems

While each technical system and related methods and processes should be tested rigorously to ensure their reliability and integrity, one or more technical systems dedicated for improving the efficiency and effectiveness of testing, in particular, scenarios testing, should be considered. Such a system may be in the form of a simulation system to simulate the operating environments as perceived by each organization of the Cyberspace, and evolving Cybersecurity situation, providing the capability for introducing a series of security events to facilitate required test to be performed.

13.6 Implementation guidance

The implementation of such a framework requires collaborating organizations and individuals to get together (virtually or physically) to determine specific policy, controls and steps to take in order to achieve its objectives of secure, effective, reliable, and efficient information sharing and coordination in response to emerging Cybersecurity incidents. The following high-level steps are recommended as a guide for the implementation:

1. a) Identify and gather relevant organizations and individuals to form the required information sharing and coordination network community, either informally or formally;
2. b) Determine the role(s) of each organization/individual involved either as IPO, IRO, or both (clause 13.2.1).
3. c) Establish the kind of information and coordination required that would be beneficial to the community;
4. d) Perform information categorization and classification to determine if any sensitive and/or privacy information are involved (clause 13.2.2);
5. e) Establish policies and principles governing the community and the information involved (clause 13.2);
6. f) Determine the methods and processes required for each category and classification of information involved (clause 13.3);
7. g) Determine performance requirements and criteria, and establish Code of Practice and sign NDA as necessary (clauses 13.3.3 and 13.3.4);
8. h) Identify required and suitable standards and technical systems to support the implementation and operations of the community (clause 13.5);
9. i) Prepare for operation; collate contact list; and conduct awareness and training workshops to prepare stakeholders;
10. j) Conduct regular testing, including scenarios walkthrough and simulation, as necessary (clauses 13.3.5 and 13.5.6);
11. k) Conduct periodic, post-test, and post-incident reviews to improve the sharing and coordination systems, including people, processes, and technology involved; expand or reduce the size of the community as necessary.

    NOTE

    ISO/IEC 27001, Information technology – Security techniques – Information security management systems requirements and ISO/IEC 27003, Information technology – Security techniques – Information security management system implementation guidance provide requirements and implementation guidance respectively.

A.1 Overview

The Cybersecurity controls described in clause 12 minimize organizations and end-users’ exposure and risk to most of the known Cybersecurity attacks. Upon the emergence of Cybersecurity incidents, the framework for information sharing and coordination described in clause 11 provides for establishing a system for information sharing and coordination in preparation for responding to Cybersecurity events and incidents. Such information is adequately protected between the IPO and IRO.

While these controls reduce risk and improve incident handling and management, cyber criminals or other miscreants will continue to develop new or evolve current attacks to overcome existing protections. It is therefore also important for organizations to implement systems and infrastructures that enable a more dynamic and rigorous approach to security attack detection, investigation and response.

ISO/IEC 27031 provides guidance on management systems and related processes to prepare an organization’s ICT systems to detect and respond to emerging security events, including Cybersecurity events. This guideline highlights additional technical approaches that are applicable for improving an organization’s Cybersecurity readiness in the area of event detection, through Darknet Monitoring, investigation, through Traceback, and response, through Sinkhole Operation.

Organizations, in particular CIIPs should consider leveraging these approaches to improve their Cybersecurity readiness and therefore status.

A.2.1 Introduction

The Darknet is a set of IP addresses that are not used in organizations. IP addresses in Darknet are not assigned to any operational servers/PC systems. By using monitored packets in the Darknet IP domains, organizations could observe emerging network attacks, including malware-initiated network scanning, malware infection behaviour and DDoS Backscatters. Since IP addresses of the Darknet are public, but are not assigned to legitimate hosts, all incoming traffic belonging to Darknet IP domains can be inferred as a consequence of either malicious activities, or that of incorrect configurations.

There are, in general, three methods commonly used in Darknet to observe malicious activities related traffics on the Internet, namely, Black Hole Monitoring, and Low and High Interaction Monitoring.

A.2.2 Black hole monitoring

Black Hole monitoring refers to monitoring systems which do not respond to anything against incoming packets found within the Darknet IP domains. This type of monitoring system is often used to quietly observe network ports scanning by malware, and malware infection behaviour (UDP with payload including shell code) and DDoS Backscatters. Network port scanning is often the initial step taken by attackers to search for vulnerable host systems that can be exploited. The malware infection behaviours are normally the follow-up steps taken by the attackers after identifying the vulnerable host systems. Such infection actions are often observed to use UDP with payload on the black hole monitoring. Furthermore, DDoS Backscatters are also observed by means of Black Hole monitoring in the case of spoofing source IP addresses (attackers) and the target of DDoS can be recognized by this Backscatters traffic. Figure A.1 depicts a screen capture of a visualization of the malware activities detected by a Black Hole monitoring system. A sample video link can be found here: https://www.youtube.com/watch?v=asemvKgkib4&feature=related.

Figure A.1

The “arrows” above the world map (Figure A.1) depicts the traversal of IP packets from sources to the targeted locations. The different shades (colours in the video) depict the type of packet (e.g., TCP SYN, TCP SYN-ACK, other types of TCP, UDP, and ICMP). The altitude of each arrow is in proportion to its port number.

A.2.3 Low interaction monitoring

A low interaction monitoring system is a Darknet monitoring system that responds to detected Darknet IP packets by attempting to connect back to the suspicious host systems. The purpose of the attempted connection is to obtain more information regarding the attacking host systems, the attack network paths used, and other related attack information, if possible. The monitoring system is often configured to disguise itself as a system with unfixed vulnerabilities to attract attacks. Low interaction monitoring system is also used to observe further reaction of malicious behaviour and activities such as the execution of Shell Scripts after the initial network port scans.

A.2.4 High interaction monitoring

A high interaction monitoring system (also referred to as a high interaction honeypot) is also a Darknet monitoring system that responds to detected Darknet IP packets by attempting to connect back to the suspicious host systems and to interact with the systems as much as possible. The purpose of the interaction is to obtain much deeper information including the strategy of exploiting vulnerabilities, malware executables injected after exploitations, and the behaviour of the infecting malware. The high interaction monitoring system can be implemented on real or virtual operation systems with unfixed vulnerabilities so that they draw attentions from attackers, get exploited, and finally capture injected malware samples.

A.3 Sinkhole operation

A Sinkhole operation is defined as a method to redirect specific IP traffic to a sinkhole device (e.g., sinkhole router) for the purpose of traffic analysis, diversion of attacks, and detection of anomalous behaviours on a network. For example, if business operation of a target system is disrupted by means of a DDoS attack, one of the effective solutions is to initiate a Sinkhole operation by injecting an alternative route for the target and redirecting the DDoS traffic along the route instead of allowing it to flow downstream to the original target. The sinkhole device is capable of absorbing, analysing and/or discarding the DDoS traffic. The redirect route of the target, which is heading to a sinkhole router, is usually released by a BGP border router. The Sinkhole operation by use of the BGP configuration is described in RFC 3882. A disadvantage of this method is that the IP address being attacked cannot be used for communication with other network users until the route is removed.

The Sinkhole operations are often used for the protection against DDoS attacks as described above. It has also been deployed to protect against botnet attacks by redirecting botnet Command and Control (C&C) to a sinkhole device. Since every bot needs to establish connections with a C&C server in order to receive attack instructions form a botnet controller, they send DNS queries for resolving the URL of the C&C server. Then DNS servers send an IP address of the sinkhole device to the bots instead of the genuine IP address of the C&C server. Consequently, the botnet controller is deprived of the connection with the bots so as not to send attack instructions to them.

A.4 Traceback

In order to automate or expedite the manual tracking against malicious attacks such as DoS attacks where the originating host is falsified, many automatic traceback techniques have been studied. Traceback techniques are recognized as techniques that reconstruct the attack path, and locate the attacker nodes by correcting the attack traffic, routing information, marked packets, or audit log of the attack traffic.

No traceback techniques, which can reconstruct the attack path across several network domains, are employed or practiced in the real network operating environment yet. The difficulties of deploying inter-domain (across several network domains) traceback techniques are derived from the following operational issues:

1. a) For the purpose of inter-domain traceback, exchanging sensitive information such as detailed backbone topology can cause serious problems for network operators.
2. b) Since traceback operation can be closely tied to ISP backbone network security, arbitrary trials of traceback attempts by unauthorized people would not be acceptable to most ISPs. Therefore, there is a fear of misuse of the traceback technique on each network domain by others.
3. c) If a single and specific inter-domain traceback technique is applied across several network domains, the unique single technique should be deployed by participating Autonomous Systems (AS) at the same time. Furthermore, attackers will sooner or later develop evasion attacks. Practically speaking, many ISPs employ multiple detection and traceback tools in their networks.

The above operational issues arise when a trial of traceback attempts to expand beyond the network boundaries. Traceback techniques should consider the boundaries of network operation and the difference of the operational policies among different network domains. It is firmly believed that inter-domain traceback and attack mitigation mechanisms need to be deployed ubiquitously across the Internet.

In the development of inter-domain traceback techniques and systems in practice, the following traceback architecture should be considered:

1. a) For keeping the network operation boundaries, the traceback architecture must leave each AS to decide to inherit a request of tracking by each AS’ operational policy;
2. b) The traceback architecture also should leave each AS to decide whether or not to investigate the inside of its own network domain more deeply;
3. c) The architecture should also allow each sub-domain of an AS to decide whether or not to inspect each sub-domain’s network by its operation policy. The operation of traceback will consume many resources on the related ASes; therefore, the traceback architecture should not generate or flood meaningless requests if possible; therefore, the traceback architecture should not forward request messages to ASes which have no relation to the mounted attack;
4. d) In order to reduce the damage of misuses, the message should not convey such sensitive information that might cause the leakage of secrets or confidence of an AS; thus, the traceback architecture should not reveal sensitive information of an AS to others;
5. e) Even when a misuse or a compromised action occurred, the traceability of the message will identify the offender, hence, a message exchanged in the architecture should have its own traceability to prove or to confirm the issuers;
6. f) If the architecture depends on one specific traceback technique, attackers will develop evasion attacks and hide the location of the attacker nodes. To overcome evasion attacks, the traceback architecture should be independent from specific traceback techniques;
7. g) Many operation systems come to support the IPv4/IPv6 dual stack, and several attacks come through a 6to4 IPv6 tunnelling. If the traceback architecture cannot track back attacks on the IPv6 network or attacks through some translators, the majority of attacks will shift to such a complex attack. Therefore, the traceback architecture should track back an attack on a dual stack environment, even when the attack employs some address translation techniques;
8. h) To automate the process of attack mitigation, the architecture should be able to export the result of a traceback trial as a trigger of the attack mitigation. Therefore, the traceback architecture should allow each AS to take another action along with a tracking result such as a filtering or another tracking;
9. i) The architecture should have the capability to cooperate with detection systems or protection systems;
10. j) An attacker can change the pattern of attack traffic to avoid the effect of such mitigating actions. Combating with changes of a complex attack, the time spent to trace an attack path should be as short as possible. Therefore, the architecture should exclude human beings as much as possible.

B.1 Online security and anti-spyware references

There are a number of websites that can be referenced and leveraged for more information relating to Internet safety and Cybersecurity. The following is a non-exhaustive list of examples:

B.2 Sample list of incident escalation contacts

Table B.1 below provides a non-exhaustive list of examples of Internet security incident escalation contacts:

C.1 Introduction

This Annex provides a non-exhaustive list of examples of documents that may be useful when considering Cybersecurity. It is not intended to be a complete list of International Standards and Technical Reports for Cybersecurity.

C.2 ISO and IEC

C.3 ITU-T

NOTE

As of September 2011, as the CYBEX work is currently in progress at the ITU-T, only X.1500, X.1520, X.1521, and X.1570 are available as Recommendations or drafts. Several others will follow in the future, so it is recommended that users verify the ITU-T website for the latest information available.

Bibliography

Footnotes