Executive Summary
Study Group 17 meeting
(17 - 26 September 2014, Geneva/Switzerland)
Participation:
166 participants (21 more than at the previous SG17 meeting, +14%); 31 Member States, 17 Sector Members, 4 Associates, and 2 Academia participating. Several invited experts. Increased participation of Member States including of Developing Countries.
Organization of the meeting:
Busy and productive 4th meeting in the middle of this study period having 8 working days.
- Many parallel meetings per quarter each day. Many sessions were equipped with AdobeConnect or GotoMeeting teleconferencing.
- Two SG17 open, extended management team meetings held (one late afternoon prior to the opening plenary and the other during the weekend), complemented by the SG17 security coordination meeting.
- Contributions: 80 (63 last time, +27% increase) - from Asia/Pacific: 67 (22 from Korea, 13 from China Unicom, 6 each from China Telecom and China Mobile), USA/CAN: 4, Africa: 1, LAM: 0, CIS: 1, Europe: 6, Arab: 1.
- TDs: 405 (55 more than in the previous meeting). This includes 45 incoming liaison statements, and 66 outgoing liaison statements.
- Two of the nine SG17 vice chairmen again did not attend (unexcused); 6 Associate Rapporteurs also did not attend. The SG17 management team meeting developed a plan for action to contact them.
Recommendations approved (TAP – WTSA-12 Resolution 1):
The SG17 plenary meeting approved the text announced for TAP in accordance with WTSA-12 Resolution 1, Section 9. There is one new Recommendation as listed below:
Q Acronym Title New / Revised Editor(s) Location of text Equivalent
e.g., ISO/IEC Start of work
4/17 X.1211
(X.eipwa) Techniques for preventing web-based attacks New Xie Wei,
Heung Youl Youm TD 1293 Rev.5 2009-09
Amendment approved, Supplements and Technical Report agreed:
The SG17 plenary meeting approved one new Amendment, agreed two new Supplements to the X-series, and one new Technical Report.
Q(1) Acronym Title New / Revised Editor(s) Location of Text Equivalent
e.g., ISO/IEC Start of work
2/17, (3/17) X.mgv6 Supplement 23 to ITU-T X-series Recommendations – ITU-T X.1037 – Supplement on Security management guideline for the implementation of an IPv6 environment in telecommunications organizations New Masashi Eto,
Koji Nakao TD 1399 Rev.3 2011-04
4/17 X.1500
Amd.6 Overview of cybersecurity information exchange – Amendment 6 – Revised structured cybersecurity information exchange techniques Note (2) Youki Kadobayashi TD 1353 2013-09
6/17 X.msec-8 Supplement 24 to ITU-T X-series Recommendations – ITU-T X.1120-X.1139 series – Supplement on a secure application distribution framework for communication devices New Mijoo Kim,
Yutaka Miyake,
Heung Youl Youm TD 1369 Rev.1 2012-03
11/17 TR HBPKI Technical Report: Current and new challenges for public-key infrastructure standardization New Eric Andersen TD 1336 2013-09
Notes:
(1) In case of joint Question activity, the lead Question is given without parentheses and other Questions are shown in parentheses; such entries are only shown in the table against the lead Question.
(2) Amendment 6 supersedes Amendment 5.
Recommendations determined (TAP – WTSA-12 Resolution 1):
The SG17 plenary meeting determined (TAP) the following draft new ITU-T Recommendation in accordance with WTSA-12 Resolution 1, Section 9.
Q Acronym Title New / Revised Editor(s) Location of text Equivalent
e.g., ISO/IEC Start of work
4/17 X.1525
(X.cwss) Common weakness scoring system New Robert A. Martin TD 1337 2009-09
Recommendations consented for Last Call (AAP – Recommendation ITU-T A.8):
The SG17 plenary meeting gave consent (AAP) to six draft new ITU-T Recommendations, ten draft revised ITU-T Recommendations, and four Technical Corrigenda for Last Call according to Recommendation ITU-T A.8:
Q(1) Acronym Title New / Revised Editor(s) Location of Text Equivalent
e.g., ISO/IEC Start of work
6/17 X.1311 Cor.1 Information technology – Security framework for ubiquitous sensor networks – Technical Corrigendum 1 Heung-Youl Youm TD 1296 Rev.1 ISO/IEC 29180 Cor.1 2014-09
6/17 X.1314
(X.unsec-1) Security requirements and framework of ubiquitous networking New Junjie Xia,
Shilin You TD 1349 2010-12
7/17 X.1157
(X.sap-7) Technical capabilities of fraud detection and response for services with high assurance level requirements New Tae Kyun Kim,
Hyung-Jin Lim TD 1351 Rev1. 2011-09
7/17 X.1158
(X.sap-8) Multi-factor authentication mechanisms using a mobile device New Keun Ok Kim,
Seong-Hyeon Song,
Heung-Youl Youm TD 1335 Rev.4 2012-09
7/17 X.1159
(X.sap-9) Delegated non-repudiation architecture based on ITU-T X.813 New Keun-ok Kim,
Hee-won Shim,
Seong-Hyeon Song TD 1332 Rev.1 2012-09
11/17 X.520 Cor.1 Information technology – Open Systems Interconnection – The Directory: Selected Attribute Types – Technical Corrigendum 1 Eric Andersen TD 1287 ISO/IEC 9594-6 Cor.1 2014-01
11/17 X.691 Cor.3 Information technology – Specification of Packed Encoding Rules (PER) – Technical Corrigendum 3 Paul. E. Thorpe TD 1346 Rev.1 ISO/IEC 8825-2 Cor.3 2014-01
11/17 X.691 Cor.4 Information technology – Specification of Packed Encoding Rules (PER) – Technical Corrigendum 4 Paul. E. Thorpe TD 1347 Rev.1 ISO/IEC 8825-2 Cor.4 2014-01
11/17, (7/17) X.1341
(X.cmail) Certified mail transport and certified post office protocols New David Keller,
Laura Prin
TD 1259 Rev.2
Note (3)
2013-04
12/17 Z.100
Annex F1 Specification and Description Language - Overview of SDL-2010 – SDL formal definition: General overview Revised Rick Reed TD 1281 2013-04
Note (2)
12/17 Z.100
Annex F2 Specification and Description Language - Overview of SDL-2010 – SDL formal definition: Static semantics Revised Rick Reed TD 1282 Rev.3 2013-04
Note (2)
12/17 Z.100
Annex F3 Specification and Description Language - Overview of SDL-2010 – SDL formal definition: Dynamic semantics Revised Rick Reed TD 1283 Rev.1 2013-04
Note (2)
12/17 Z.161 Testing and Test Control Notation version 3: TTCN-3 core language Revised Dieter Hogrefe
TD 1308 Rev.1
Note (4)
ETSI ES 201 873-1 2013-04
12/17 Z.161.1 Testing and Test Control Notation version 3: TTCN-3 language extensions: Support of interfaces with continuous signals Revised Dieter Hogrefe
TD 1309 Rev.1
Note (5)
ETSI ES 202 786 2013-04
12/17 Z.161.2 Testing and Test Control Notation version 3: TTCN-3 language extensions: Configuration and deployment support Revised Dieter Hogrefe
TD 1310 Rev.1
Note (6)
ETSI ES 202 781 2013-04
12/17 Z.161.3 Testing and Test Control Notation version 3: TTCN-3 language extensions: Advanced parameterization Revised Dieter Hogrefe
TD 1311 Rev.1
Note (7)
ETSI ES 202 784 2013-04
12/12 Z.161.5 Testing and Test Control Notation version 3: TTCN-3 Language extensions: Performance and real time testing New Dieter Hogrefe
TD 1312 Rev.1
Note (8)
ETSI ES 202 782 2014-01
12/17 Z.165 Testing and Test Control Notation version 3: TTCN-3 runtime interface (TRI) Revised Dieter Hogrefe
TD 1313 Rev.1
Note (9)
ETSI ES 201 873-5 2013-04
12/17 Z.165.1 Testing and Test Control Notation version 3: TTCN-3 extension package: Extended TRI Revised Dieter Hogrefe
TD 1314 Rev.1
Note (10)
ETSI ES 202 789 2013-04
12/17 Z.166 Testing and Test Control Notation version 3: TTCN-3 control interface (TCI) Revised Dieter Hogrefe
TD 1315 Rev.1
Note (11)
ETSI ES 201 873-6 2013-04
Notes:
(1) In case of joint Question activity, the lead Question is given without parentheses and other Questions are shown in parentheses; such entries are only shown in the table against the lead Question.
(2) AAP Last Call to be delayed.
(3) COM 17 – R 36 Annex A Attachment 2 contains the A.5 justification information for draft new Rec. ITU-T X.1341.
(4) COM 17 – R 36 Annex B Attachment 1 contains the A.5 justification information for draft revised Rec. ITU-T Z.161.
(5) COM 17 – R 36 Annex B Attachment 2 contains the A.5 justification information for draft revised Rec. ITU-T Z.161.1.
(6) COM 17 – R 36 Annex B Attachment 3 contains the A.5 justification information for draft revised Rec. ITU-T Z.161.2.
(7) COM 17 – R 36 Annex B Attachment 4 contains the A.5 justification information for draft revised Rec. ITU-T Z.161.3.
(8) COM 17 – R 36 Annex B Attachment 5 contains the A.5 justification information for draft new Rec. ITU-T Z.161.5.
(9) COM 17 – R 36 Annex B Attachment 6 contains the A.5 justification information for draft revised Rec. ITU-T Z.165.
(10) COM 17 – R 36 Annex B Attachment 7 contains the A.5 justification information for draft revised Rec. ITU-T Z.165.1
(11) COM 17 – R 36 Annex B Attachment 8 contains the A.5 justification information for draft revised Rec. ITU-T Z.166.
New work items:
The following 20 new work items were agreed to be added to the SG17 work programme:
Q(1) Acronym Title New/ Revised AAP/TAP/ Agreement Editor(s) Documents Equivalent
e.g., ISO/IEC
Timing*** 1/17 X.TRSM6ed
Technical Report
Security in telecommunications and information technology – An overview of issues and the deployment of existing ITU-T Recommendations for secure telecommunications; 6th edition
New Agreement Michael Harrop NWI template:
TD 1232 Rev.1 2015-09
2/17 X.sgmvno
Supplement to ITU-T X.805
Security guideline for mobile virtual network operator (MVNO)
New Agreement
Hongwei Luo, China;
Laifu Wang, China Telecom
NWI template:
TD 1317 Rev.2 2016-03
2/17 X.tigsc Technical implementation guidelines for ITU-T X.805 New AAP Heung Youl Youm, Korea (Republic of)
NWI template:
TD 1359 Rev.3
Base text:
TD 1359 Rev.3 Annex 2
2017-03
3/17 X.sup-gpim
Supplement to ITU-T X.gpim
Code of practice for personally identifiable information protection for telecommunications organizations
New Agreement
Lijun Liu, China Mobile;
Heung Youl Youm, Korea (Republic of)
NWI template:
TD 1328 Rev.4 2016-03
4/17 X.cogent Design considerations for improved end-user perception of trustworthiness indicators New TAP
Youki Kadobayashi, NICT;
Daisuke Miyamoto, University of Tokyo
NWI template:
TD 1340 Rev.2 2015-09
4/17 X.simef Session information message exchange format (SIMEF) New TAP
Ik-Kyun Kim, ETRI, Korea (Republic of);
Jong-Hyun Kim, ETRI, Korea (Republic of)
NWI template:
TD 1364 Rev.2 Annex 1
Base text:
TD 1364 Rev.2 Annex 2
2015-09
5/17 X.gcspi
Supplement to ITU-T X.1242
Guideline for countermeasures against short message service (SMS) phishing incidents
New Agreement
Lijun Liu, China Mobile, China (People's Rep. of);
Jae Hoon Nah, ETRI/ KISSF, Korea (Republic of);
Deawoo Park, Korea (Republic of)
NWI template:
TD 1391 Rev.3
Base text:
C 0255
2017
5/17 X.ticsc
Supplement to ITU-T X.1245
Technical measures and mechanism on countering the spoofed call in the visited network of VoLTE
New Agreement
Bo Yu, China Unicom;
Jie Yuan, China Mobile;
Chen Zhang, China Mobile
NWI template:
TD 1359 Rev.2
Base text:
C 0289
2016-03
6/17 X.iotsec-1 Simple encryption procedure for IoT device security New TAP Hirotaka Yoshida, Hitachi
NWI template:
TD 1437 Rev.1
Base text:
C 0286 Rev.1
2016-03
6/17 X.itssec-1 Software update capability for ITS communications devices New TAP
Masashi Eto, NICT
Koji Nakao, NICT / KDDI
NWI template:
TD 1409 Rev.3 Annex 1
Base text:
TD 1409 Rev.3 Annex 2
2016-03
6/17 X.itssec-2 Security guidelines for V2X communication systems New TAP
Sang-Woo Lee, ETRI;
Jae-Hoon Nah, ETRI
NWI template:
TD 1405 Rev.1 2016-03
6/17 X.sgsec-2 Security guidelines for home area network (HAN) devices in smart grid systems New TAP
Woong Go, KISA;
Haeryong Park, KISA;
Jeong-Jun Suh, KISA
NWI template:
TD 1386 Rev.2
Base text:
TD 1386 Rev.2
2017-03
6/17 X.msec-9 Functional security requirements and architecture for mobile phone anti-theft measures New TAP
Xia Junjie, China Unicom;
Heung Youl Youm, Korea (Republic of)
NWI template:
TD 1348 Rev.4
Base text:
TD 1348 Rev.4 Annex 1
2017-03
6/17 X.sdnsec-1 Requirements for security services based on software-defined networking New TAP
Hyoungshick Kim, Korea (Republic of);
JungSoo Park, ETRI
NWI template:
TD 1371
Base text:
TD 1371 Annex 1
2017-03
7/17 X.websec-6 Security framework and requirements for open capabilities of telecommunication services New AAP
Feng Gao, China Unicom;
Jae Hoon Nah, ETRI;
Junjie Xia, China Unicom
NWI template:
TD 1368 Rev.1
Base text:
C 0303 Rev.2
2016-09
7/17 X.websec-7 Reference monitor for online analytics services New AAP
Hyungjin Lim, Korea (Republic of);
Jongyoul Park, ETRI;
Junjie Xia, China Unicom
NWI template:
TD 1327 Rev.2
Base text:
C 0253
2017
8/17 X.CSCDataSec Guidelines for cloud service customer data security New TAP Nan Meng, MIIT/China
NWI template:
TD 1422 Rev.2
Base text:
TD 1422 Rev.2 Annex I
2017
10.17, (7/17) X.eaaa Enhanced entity authentication based on aggregated attributes New TAP
Tae Kyung Kim, Korea (Republic of)
Jae Hoon Nah, ETRI, Korea (Republic of);
Junjie Xia, China Unicom, P.R.China
NWI template: TD 1350 Rev.3 2016
10/17 X.1255sup
Supplement to Recommendation ITU-T X.1255
Proposed conceptual models based on ITU-T X.1255 frameworks
New Agreement Abbie Barbir, MBNA NWI template:
TD 1411 Rev.2 2015-04
11/17 X.oiddev Information technology – Use of object identifiers to identify devices in the Internet of Things New AAP Jun Seob LEE, ETRI
NWI template:
TD 1427 Rev.1
Base text:
TD 1363 Rev.2
yes 2016
Notes:
*** Target date for consent or determination of Recommendations or for approval of appendices,
supplements or implementers' guides.
(1) In case of joint Question activity, the lead Question is given without parentheses and other Questions are shown in parentheses; such entries are only shown in the table against the lead Question.
Work items discontinued:
The following two work items were agreed to be deleted from the work programme:
Q Acronym Title Action
4/17 X.cybex-beep Use of BEEP for cybersecurity information exchange delete
10/17 X.giim Mechanisms to support interoperability across different IdM services delete
Coordination and promotion activities:
- A fruitful joint meeting between SG17 and ITU-D SG2 Question 3/2 took place, which mutually envisioned further strengthened collaboration.
- SG17 reviewed the established liaison relationships between ITU-T and ISO TCs, SCs and JTC1/SCs, and checked if the Category A, B, C, or D designations still apply (for SG17).
- Two Joint Coordination Activity meetings under the SG17 parent-ship were held, JCA-IdM and JCA-COP.
- Updates were made to the Security Compendium, and to the ICT Security Roadmap.
Correspondence Groups:
Three new Correspondence Groups and one continued CG were agreed.
- CG-investigate: New Correspondence Group on investigation for new topics for SG17 standardization; convened by all 8 session chairmen of the ITU security workshop.
The CG will investigate any considerable topics from the results of the workshop, and to collect and analysis the further information related to the new topics for the purpose of identifying a set of new work items for SG17 near future. Envisioned topics are for example: Big Data security, IoT security, smart home/city (including smart-grid), CII resilience (CIIR)). - CG-rapp-guidelines, New Correspondence Group on guidelines for organizing Rapporteur Group meetings and meetings of Questions; convened by Mr. Jiang Hua. This CG will discuss a) review and provide comments to SG17 on the ITU-T SG16 guidelines for organizing Rapporteur Group meetings (TSAG TD 150); and b) provide to SG17 a proposal for unifying the agendas of meetings of Questions held during working party or study group meetings, in particular unifying the time table for taking up agendas items.
- CG-coll-strengthening, New Correspondence Group on strengthening collaboration between ITU-T SG17 and ITU-D SG2 Q3/2 on security. This new ITU intersectoral CG between the T- and the D- Sectors will identify areas for collaboration. Exact details of the technical implementation and convernership of this CG are subject for further coordination between TSB and BDT.
- CG-CYBEX, Continued Correspondence Group on cybersecurity information exchange capabilities.
Other highlights:
- Four special sessions were held to off-load the plenaries from debates: on bridging the standardization gap (with live interpretation); on outcomes of the ITU-T security workshop; on preparing for the joint meeting between SG17 and D-Q3/2; and the joint meeting with D-3/2. The meeting confirmed to continue organizing a BSG session at every SG17 meeting.
- SG17 agreement on the A.4 and A.5 qualification of the OpenID Foundation with SG17's expectation to receive their IdM specifications for standardization in SG17.
- SG17 agreement on the A.4 or A.6 qualification of GSMA for X.msec-9.
- SG17 invited the Fast Identity Online (FIDO) alliance to consider initiating a qualification according to Recs. ITU-T A.4 and A.5.
- SG17 initiated collaboration with OASIS TC IBOPS (Identity Based Attestation and Open Exchange Protocol Specification, i.e. IdM using telebiometrics).
- Due to procedural constraints imposed by Rec. ITU-T A.7 (12 days deadline for submission of proposals), a new Focus Group on Critical Infrastructure Protection and ICT Security (FG-CIPIS) with proposed terms of reference could not be established at this meeting.
- WP2/17 considered the few (2), non-representative responses to the questionnaire on spam and agreed that some other means should be tried instead to gather the desired information than using questionnaires.
Associated events:
Associated events below assisted in identifying new actions for the study group and leverage the collaboration with other organizations and hopefully attract new experts to the ITU-T and SG17 community.
- A successful, well attended ITU workshop on ICT Security Standardization Challenges for Developing Countries - Geneva, Switzerland, 15 – 16 September 2014 took place before the SG17 meeting.
- Mentoring programme for newcomers: Comprehensive programme through tutorials (see below), welcome, feedback session and guided tour, all attended with interest.
- Reception and social networking event sponsored by RANS with live harp music performance by artist Mr. Alexander Boldachev.
Tutorial presentations:
Seven tutorial presentations were given at this Study Group 17 meeting and found quite some positive interest.
- "SG17 orientation session for newcomers",
Arkadiy Kremer, SG17 Chairman. - "ENISA and standards",
Mr. Slawomir Gorniak, ENISA. - "Security aspects on Intelligent Transportation Systems (ITS) and how to keep cars secure",
Mr. Juergen Frank, Freescale Halbleiter Deutschland GmbH. - "Multinational Alliance for Collaborative Cyber Situational Awareness (MACCSA): Accelerating Information Sharing for Collaborative Cyber Situational Awareness (CCSA)",
Mr. Patrick Curry, CEO of MACCSA
This tutorial was further discussed by Q4/17. - "New SharePoint collaboration site created for SG17 work",
Mr. Al Dayao, TSB. - "Massive PII leak incident and national-level countermeasures in Korea",
Mr. Heung-Youl Youm, Soonchunhyang University, Korea. - "ITU's engagement in the Internet Governance Forum (IGF)",
Ms. Jeoung Hee Kim, ITU GenSec SPM; Mr. Chengetai Masango, IGF Secretariat.
Next SG17 meeting:
- WED 8 – FRI 17 April 2015, Geneva, Switzerland.
- Eight interim Rapporteur Group meetings (some of them virtual e-meetings) are planned until April 2015.