Preface xi -- Acknowledgments xv -- 1 INTRODUCTION 1 -- 1.1 Evolution of Networking Concepts 4 -- 1.1.1 The Public Switched Telephone Network 4 -- 1.1.2 Computer/Data Communications Networks 5 -- 1.1.3 Network Architectures 6 -- 1.1.4 Data Network Complexity 8 -- 1.2 A Network Security Historical Perspective 13 -- 1.2.1 ISO/IEC 7498-1 (ITU-T X.200) Coverage of Management 14 -- 1.2.2 ISO/IEC 7498-4 (ITU-T X.700) Coverage of Security Management 15 -- 1.2.3 ISO/IEC 7498-2 (ITU-T X.800) Coverage of Security and Management 15 -- 1.2.4 The Security Frameworks (ITU-T X.810-ITU-T X.816) 23 -- 1.2.5 The ITU-T X.805 Approach to Security 25 -- 1.3 Network and Security Management Systems 26 -- 1.3.1 Element and Network Management Systems 26 -- 1.3.2 Operations Support Systems 27 -- 1.4 Evolution of Network and Security Management Concepts 29 -- 1.4.1 Telecommunications Management Network 29 -- 1.4.2 Next Generation Operations Systems and Software 47 -- 1.4.3 Enhanced Telecom Operations Map 50 -- 1.5 How the Need for Information Security has Changed 57 -- 1.6 Summary 61 -- Further Reading and Resources 62 -- 2 OVERVIEW OF CURRENT AND FUTURE NETWORKS 63 -- 2.1 A Little Network History 63 -- 2.1.1 Point-to-Point Data Communications 64 -- 2.1.2 Early Commercial Packet Switching 64 -- 2.1.3 The ARPANET: Internet 64 -- 2.1.4 Ethernet and IEEE 802.3 70 -- 2.1.5 Network Address Translation 71 -- 2.2 Common Network Organizations 72 -- 2.2.1 Wired Local Area Networks 74 -- 2.2.2 Wireless Networks 83 -- 2.2.3 Metropolitan Area Networks 87 -- 2.2.4 Wide Area Networks 94 -- 2.2.5 Networks Are Now Layered upon Networks 96 -- 2.2.6 Additional Networking Developments 96 -- 2.2.7 Security Mechanisms in Modern Networks 105 -- 2.3 Next-Generation Networks and Interfaces 108 -- 2.3.1 Framework and Topology of the NGN 108 -- 2.3.2 IP Multimedia Subsystem 125 -- 2.4 Summary 133 -- Further Reading and Resources 136 -- 3 SECURITY MANAGEMENT IN CURRENT AND FUTURE NETWORKS 139 -- 3.1 Cybercrime as a Driver for Information Security Management 140.

3.2 Governance as a Driver for Information Security Management 142 -- 3.2.1 What Is Governance? 142 -- 3.2.2 Information System Security Governance 143 -- 3.3 Information Security Management Frameworks 145 -- 3.3.1 ISO/IEC 27000 Series 146 -- 3.3.2 The Information Technology Infrastructure Library Framework 164 -- 3.3.3 COBIT Framework 167 -- 3.3.4 FISMA Framework 173 -- 3.4 A Holistic Approach for Security Management 176 -- 3.4.1 Organizational Aspects of Security Governance and Management 176 -- 3.4.2 Policies and Policy Hierarchies 180 -- 3.4.3 Functional and Operational Security Requirements 183 -- 3.5 Summary 189 -- Further Reading and Resources 189 -- 4 RISK MANAGEMENT IN CURRENT AND FUTURE NETWORKS 191 -- 4.1 Asset Identification: Definition and Inventorying 193 -- 4.2 Impact Analysis 224 -- 4.2.1 Existing System Impact Analysis 224 -- 4.2.2 New System Impact Analysis 236 -- 4.2.3 Risk Mitigation Analysis 240 -- 4.2.4 Malicious Security Events and Threat Assessment 243 -- 4.3 Risk Mitigation Controls Acquisition or Development 257 -- 4.3.1 Procedural Risk Mitigation Controls 257 -- 4.3.2 New Technical Risk Mitigation Controls 258 -- 4.4 Risk Mitigation Controls Deployment Testing 273 -- 4.5 Summary 274 -- Further Reading and Resources 275 -- 5 OPERATIONAL MANAGEMENT OF SECURITY 277 -- 5.1 Securing Management Applications and Communications 278 -- 5.1.1 Security within Element and Network Management Systems 278 -- 5.1.2 Telecommunications Management Network Security 279 -- 5.1.3 Operations Support System Security Needs 281 -- 5.1.4 Reflections on Past ITU Treatment of Managing Security 285 -- 5.1.5 Management of Security Services and Mechanisms Revisited 288 -- 5.1.6 A Security Management Framework 291 -- 5.2 Security Operations and Maintenance 296 -- 5.2.1 Operational Security Compliance Programs 297 -- 5.2.2 Security Operations Reviews and Audits 301 -- 5.2.3 Security Event Response and Incident Management 302 -- 5.2.4 Penetration Testing 304 -- 5.2.5 Common Criteria Evaluated Systems 306.

5.2.6 Accreditation and Certification 309 -- 5.3 Withdrawal from Service 312 -- 5.4 Summary 314 -- 5.5 Concluding Remarks 314 -- Further Reading and Resources 314 -- Appendices 318 -- Appendix A: Role of Cryptography in Information Security -- Appendix B: Authentication of Subjects -- Appendix C: Network Security Mechanisms -- Appendix D: Example Company Security Policy -- Appendix E: Example Generic Detailed Security Requirements -- Appendix F: Securing Common Network Protocols -- Appendix G: Security Mapping between M.3400 and M.3050 320 -- Appendix H: State Privacy Laws as of 2010 328 -- Appendix I: Example RFP Security Appendix -- Appendix J: RFP Security Analysis of ABC Proposal -- Appendix K: Example Security Statement of Work 339 -- Appendix L: Example Solaris Operating System Audit Procedures 348 -- Appendix M: Example Procedure for Basic Hardening of a Windows XP Professional Operating System 352 -- Appendix N: Example Network Audit Procedure 356 -- Appendix O: Example Unix-Linux Operating System -- Audit Procedures 360 -- Index 365.