Focus Group 1B Cybersecurity

1
Focus Group 1B Cybersecurity Dr. Bill Hancock,
CISSP Cable and Wireless America FG1B
Chair bill.hancock_at_exodus.net 972-740-7347
2
Charter of FG1B Cybersecurity

• Generate Best Practices for cybersecurity
• Telecommunications sector
• Internet services
• Deliverables
• December 2002 prevention
• March 2003 restoration
• New team, very little previous material to use
  for a base or as a guideline

3
Composition and Organization

• Made up predominantly of Chief Security Officers
  or equivalent at most telecom companies in the
  U.S. as well as selected Subject Matter Experts
  (SMEs)
• Members include various U.S. Government agencies
  such as DoC, DoD, DoJ, FCC, Federal Reserve,
  etc.
• Group is divided into 10 working teams, each with
  a team leader

4
Working Efforts

• Focus is on gap filling for cybersecurity Best
  Practices (BP)
• Find and use existing BPs for cybersecurity
• Identify where there are gaps in completeness
• Create master list of existing BPs
• 75 focus areas identified in initial meetings
• Each team meets at the same time each week via
  conference call
• Working BPs are entered into an agreed-upon
  template that all teams use
• There is a process in-place to collect, share and
  provide documents between team members

5
Network Security Framework(Based on Bell Labs
model)
Proposed to the ITU as a standard.
6
FG1B Cybersecurity Teams

• Fundamentals
• Transport
• OAMP (operations, administration, maintenance
  and provisioning
• AAA (authentication, accounting, audit)
• Services
•  Personnel
•  Users
• Architecture
• Incidents

7
Security Framework Mapping
Users
Transport
Apply to all AAA Fundamentals Architectures I
ncidents
Services
OAMP
Personnel
8
FG1B Project Management

• First consolidation of BPs is in mid October
• First major edit process in early November
• Final assembly for FG1B cybersecurity prevention
  deliverable in mid November
• Deliverable for cybersecurity prevention on
  December 6, 2002
• Edit process for FG1B restoration in January 2003
• Deliverable for cybersecurity restoration in
  March 2003

9
Expectations on Deliverables

• Cybersecurity technologies are being implemented
  to varying degrees
• BPs identified will be evaluated for factors
  affecting implementation
• BPs will recommend what, not how to implement
  BPs for cybersecurity