1、 International Telecommunication Union ITU-T X.1208TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (01/2014) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cyberspace security Cybersecurity A cybersecurity indicator of risk to enhance confidence and security in the use of telecommu
2、nication/information and communication technologies Recommendation ITU-T X.1208 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEM
3、S X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Securit
4、y management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.
5、1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE
6、Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING S
7、ECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For further details, please refe
8、r to the list of ITU-T Recommendations. Rec. ITU-T X.1208 (01/2014) i Recommendation ITU-T X.1208 A cybersecurity indicator of risk to enhance confidence and security in the use of telecommunication/information and communication technologies Summary Recommendation ITU-T X.1208 describes a methodolog
9、y for organizations to use cybersecurity indicators when computing a risk measure and it provides a list of potential cybersecurity indicators. Recommendation ITU-T X.1208 is intended to help organizations that implement or operate a portion of the global infrastructure of information and communicat
10、ion technologies to evaluate their own cybersecurity capability and risk. These guidelines are intended to facilitate the decision-making process within organizations on how to lower their risks and how to identify where they could/should invest resources to improve their cybersecurity capabilities.
11、 Recommendation ITU-T X.1208 does not propose the use of an index or a single indicator to express the cybersecurity capabilities of an organization. History Edition Recommendation Approval Study Group Unique ID*1.0 ITU-T X.1208 2014-01-24 17 11.1002/1000/11950 Keywords Cybersecurity indicator, cybe
12、rsecurity indicator of risk _ *To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1208 (01/2014) FOREWORD The International Tele
13、communication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and t
14、ariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Reco
15、mmendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recomm
16、endation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interopera
17、bility or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that co
18、mpliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, valid
19、ity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be requi
20、red to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2014 All rights reserved. No part of this publication may be reproduce
21、d, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1208 (01/2014) iii Table of Contents Page 1 Scope 1 2 References. 1 3 Definitions 2 3.1 Terms defined elsewhere 2 3.2 Terms defined in this Recommendation . 3 4 Abbreviations and acronyms 3 5 Conventions 4 6 Cybers
22、ecurity indicator . 4 6.1 Introduction 4 6.2 General principles for cybersecurity indicators 5 6.3 Guidelines for selecting cybersecurity indicators . 6 6.4 Classification of indicators . 6 7 Cybersecurity indicator development process 7 7.1 Introduction 7 7.2 Methodology for the construction of a c
23、ybersecurity indicator suite . 7 7.3 Cybersecurity indicators development process 8 8 Potential cybersecurity indicators . 9 Appendix I Examples of indicators of information security risk measures and metrics 25 Appendix II Classifying indicators by nature . 26 Appendix III Experimental indicators .
24、 29 Bibliography. 33 Rec. ITU-T X.1208 (01/2014) 1 Recommendation ITU-T X.1208 A cybersecurity indicator of risk to enhance confidence and security in the use of telecommunication/information and communication technologies 1 Scope This Recommendation provides a guideline to assist organizations in t
25、he development, selection and identification of the data to be captured (based on selected indicators) and shows how this information can be used to compute a cybersecurity indicator of risk (CSIR). Note that an organization may generate a cybersecurity indicator of risk with respect to a specific s
26、et of cybersecurity indicators (CSI) while departments within an organization may also generate a cybersecurity indicator of risk with respect to their specific set of cybersecurity indicators (CSI). The purpose of the cybersecurity indicator is to allow for the evaluation of the level of cybersecur
27、ity competency at a particular point in time of an organization and, when this process is repeated at other points in time, it allows the status of an organizations cybersecurity programmes progress over time to be determined. This Recommendation also provides a list of potential indicators and desc
28、ribes a methodology to be used when these cybersecurity indicators are used to compute a cybersecurity indicator of risk. This Recommendation is intended to help organizations that implement or operate a portion of the global infrastructure of information and communication technologies to evaluate t
29、heir own cybersecurity capabilities and calculate their cybersecurity indicator of risk. These guidelines are intended to facilitate the decision-making process within organizations on how to improve cybersecurity and how to lower their cybersecurity risks. Furthermore, these guidelines provide an i
30、ndication of where organizations could/should invest resources to improve their cybersecurity. This Recommendation is not to be used to generate a cybersecurity indicator of risk on a country-level basis. Furthermore, this Recommendation does not propose the use of an index or a single indicator to
31、express the cybersecurity capabilities of an organization (see clause 6.1). NOTE 1 Comparisons of the calculated cybersecurity indicator of risk between organizations should not be made. This is because each organization or community is supposed to select what they deem to be an appropriate set of c
32、ybersecurity indicators for their organization. Furthermore, they are expected to develop their own measurement methodology and criteria to address their risks and concerns. In some cases subjective information, as opposed to objective data, may be used. Consequently, it is recommended that a cybers
33、ecurity indicator of risk for one organization should never be compared to that of another organization, as it is highly context dependent. NOTE 2 The indicators described in this Recommendation may not be compatible with those developed by other industry sectors due to the different purposes of tho
34、se industries. 2 References None. 2 Rec. ITU-T X.1208 (01/2014) 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 audit b-ITU-T X.800: An independent review and examination of system records and activities in order to test for adequacy of
35、 system controls, to ensure compliance with established policy and operational procedures, to detect breaches in security, and to recommend any indicated changes in control, policy and procedures. 3.1.2 bot b-ITU-T X-Sup.8: An automated software program used to carry out specific tasks designed for
36、malicious purposes. It is interchangeable with a robot. 3.1.3 cybersecurity b-ITU-T X.1205: Cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be us
37、ed to protect the cyber environment and organization and users assets. Organization and users assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment.
38、 Cybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and users assets against relevant security risks in the cyber environment. The general security objectives comprise the following: Availability Integrity, which may include authenticity and
39、 non-repudiation Confidentiality. 3.1. 4 measurement b-ENISA: The act or the process of measuring, where the value of a quantitative variable in comparison to a (standard) unit of measurement is determined. 3.1.5 metric b-ENISA: A system of related measuring enabling quantification of some character
40、istic of a system, component or process. A metric is composed of two or more measures. 3.1.6 patch b-ITU-T X.1206: A broadly released fix for a product-specific, security-related vulnerability. A method of updating a file that replaces only the parts being changed, rather than the entire file. 3.1.7
41、 personally identifiable information (PII) b-ITU-T X.1252: Any information a) that identifies or can be used to identify, contact, or locate the person to whom such information pertains; b) from which identification or contact information of an individual person can be derived; or c) that is or can
42、be linked to a natural person directly or indirectly. 3.1.8 risk b-ISO/IEC 27000: Effect of uncertainty on objectives. 3.1.9 risk management b-ISO/IEC 27000: Coordinated activities to direct and control an organization with regard to risk. 3.1.10 security certificate b-ITU-T X.810: A set of security
43、-relevant data issued by a security authority or a trusted third party, together with security information which is used to provide the integrity and data origin authentication services for the data. 3.1.11 security controls b-NIST FIPS 199: The management, operational, and technical controls (i.e.,
44、 safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. 3.1.12 security incident b-ITU-T E.409: A security incident is any adverse event whereby some aspect of security could be threatened. Re
45、c. ITU-T X.1208 (01/2014) 3 3.1.13 spam b-ITU-T X.1242: The electronic information delivered from senders to recipients by terminals such as computers, mobile phones, telephones, etc., which is usually unsolicited, unwanted, and harmful for recipients. 3.1.14 threat b-ISO/IEC 27000: Potential cause
46、of an unwanted incident, which may result in harm to a system or organization. 3.1.15 vulnerability b-ITU-T X.1500: Any weakness that could be exploited to violate a system or the information it contains. (Aligned with Annex A of b-ITU-T X.800.) 3.1.16 weakness b-ITU-T X.1500: A shortcoming or imper
47、fection that, while not itself being recognized as a vulnerability, could, at some point become a vulnerability, or could contribute to the introduction of other vulnerabilities. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 cybersecurity indicator:
48、Any one of a collection of indicators used to calculate or measure the risk status of a cybersecurity capability or competence for an organization or community. NOTE Selected cybersecurity indicators are indicators that are selected because they are relevant, i.e., they are related in some fashion t
49、o the risk concerns. 3.2.2 cybersecurity indicator of risk: The result from implementing a methodology that computes a cybersecurity indicator of risk. 3.2.3 cybersecurity indicator suite: A selected set of cybersecurity indicators that will be used to compute a cybersecurity indicator of risk. NOTE There is not one unique cybersecurity indicator suite. 3.2.4 indicator: It is interchangeable with metric in clause 3.1.5. 3.2.5 information security management s
