ISO Security Standardization An update on ISO/IEC JTC 11// SC 27 IT Security Techniques

Dr. Marijke De Soete Vice Chair ISO/IEC JTCJTC11 / SC2727SC Managing Director SecuritySecurity44BizBiz

ETSI Security Workshop 16-17 January 2013 Sophia-Antipolis, France Agenda • ISO/IEC JTC 1/SC 27 – IT Security Techniques o Scope, organization, work programme o Recent achievements - New projects and Study periods o Main challenges SC27 Mission SC 27 is an internationally recognized centre of information and IT security standards expertise serving the needs of business sectors as well as governments. Its work covers the development of standards for the protection of information and ICT. This includes generic methods, techniques and guidelines to address both security and privacy aspects, such as:

• Information Security Management Systems (ISMS), requirements, controls and conformance assessment, accreditation and auditing requirements in the area of information security; • Cryptographic mechanisms; • Security evaluation criteria and methodology; • Security services; • Security aspects of identity management, biometrics and privacy. ISO/IEC JTC 1/SC 27 Structure

ISO/IEC JTC 1/SC 27 SC 27 IT Security techniques Secretariat Chair: Mr. W. Fumy DIN Vice-Chair: Mrs. M. De Soete Ms. K. Passia

WG 1 WG 2 WG 3 WG 4 WG 5 Information Cryptography Security Security Id- management security and security evaluation controls and and privacy management mechanisms criteria services technologies systems Convener: Convener: Convener: Convener: Convener: Mr. T. Humphreys Mr. T. Chikazawa Mr. M. Bañón Mr. J. Amsenga Mr. K. Rannenberg Vice Convener: Vice Convener: Vice Convener: Vice Convener: Vice Convener: Mr. D. Johnstone Mr. T. Tatsuta Mr. N. Kai Mr. L. Mr. J. Schallaböck Vodzislawsky Security and Privacy Topic Areas

Information security and privacy governance

Information security management system (ISMS) requirements, methods and processes

Privacy controls and

and privacy and identity Security controls Security services management auditing auditing and and (including (including application methods (including application and and sector specific application specific sector specific e.g. Cloud), IT network rd e.g. Cloud), methods for Management Management Management for for methods methods e.g. Cloud, security, 3 party Systems techniques, Telecoms, Energy, services, IDS, incident frameworks, WG 1 FInance), codes management, cyber biometric of practice, security, application WG 2 information frameworks secuirty, disaster protection, WG 3 recovery, forensics devices devices (products, (products, Specification Specification

biometric certification Accreditation, and system of products) products) of system and WG 4 and requirements Economics of information security security information of Economics Economics of information security security information of Economics WG 5 Security Evaluation, Testing, Processes, Processes, Processes, Testing, Testing, Evaluation, Evaluation, Security Security Cryptographic and security mechanisms and technologies Methods and and Methods SC27 Members

P-members (voting) Algeria, Australia, Austria, Belgium, Brazil, Canada, China, Côte-d'Ivoire, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, India, Italy, Ireland, Israel, Japan, Kazakhstan, Kenya, Rep. of Korea, Luxembourg, Malaysia, Mauritius, Mexico, Morocco, The Netherlands, New Zealand, Norway, Peru, Poland , Romania, Russian Federation, Singapore, Slovakia, Slovenia, South Africa, Spain, Sri Lanka, Sweden, , Thailand, Ukraine, United Arab Emirates, United Kingdom, United States of America, Uruguay. (Total: 49)

O-members (observing) Argentina, Belarus, Bosnia and Herzegovina, Costa Rica, El Salvador , Ghana, Hong Kong, Hungary, Iceland, Indonesia, Iran, Kingdom of Saudi Arabia, Lithuania, Portugal, Serbia, Swaziland, Turkey (Total: 17) Projects Facts & Figures

• Projects - Total no of projects: 176 - No of active projects: 75 - Current number of published standards: 114 • Standing Documents (all freely available from the sites given below) - SD6 Glossary of IT Security terminology (http://www.jtc1sc27.din.de/sbe/SD6 ) - SD7 Catalogue of SC 27 Projects and Standards (http://www.jtc1sc27.din.de/sbe/SD7 - SD11 Overview of SC 27 (http://www.jtc1sc27.din.de/sbe/SD11 ) - SD12 Assessment of cryptographic algorithms and lengths (http://www.jtc1sc27.din.de/sbe/SD12) SC27 Liaison Partners

Internal Liaisons within ISO Internal Liaisons within IEC • ISO/CASCO • IEC/TC 65 Industrial-process measurement, control • ISO/JTCG Joint technical Coordination Group on and automation - WG 10 Security for industrial process measurement and control - Network and system MSS security • ISO/TC 46/SC 11 Information and documentation – Archives/Records management Internal Liaisons within ISO/IEC JTC 1 • ISO/TC 68/SC 2 Financial services -- Security • JTC 1 Ad Hoc on Vocabulary • • ISO/TC 176 /SC 3 - Quality management and quality JTC 1/WG 6 Corporate Governance of IT • assurance - Supporting technologies JTC 1/WG 7 Sensor networks • SC 6 Telecommunications and information exchange • ISO/TC 176/SC 3/WG 16 Quality management and between systems quality assurance – Supporting technologies - Joint • SC 7 Software engineering WG with TC 207/SC2 for the revision of ISO 19011 • SC 17/WG 3 Machine readable travel documents • ISO/TC 204 Intelligent transport systems - WG 1 • SC 17/WG 4 cards with contacts Architecture • SC 17/WG 11 Application of Biometrics to Cards and Personal Identification • ISO/TC 208 Thermal turbines for industrial application • SC 22 Programming languages, their environments (steam turbines, gas expansion turbines) and system software interfaces • ISO/TC 215 Health Informatics - WG 4 Security • SC 25 Interconnection of IT Equipment • ISO/TC 223 Societal Security • SC 31/WG 4 (Automatic Identification and Data Capture Techniques • ISO/PC 246 Anti-counterfeiting tools • SC 36 for learning, education, • ISO/PC 251 Project committee: Asset management and training • ISO/PC 262 Project committee: • SC 37 Biometrics • SC 38 Distributed application platforms and services (DAPS) SC27 Liaison Partners External CAT A Liaisons External CAT Liaisons • ECMA International • European Telecommunications Standards Institute (ETSI) • ENISA (European Network and Information Security • Forum of Incident Response and Security Teams (FIRST) Agency) • Future of Identity in the Information Society (FIDIS) • European Payment Council • European Network of Excellence for Cryptology II • ITU Development Sector (ITU-D) (ECRYPT II) • ITU-T Joint Coordination Activity for Identity • Information Security Forum (ISF) Management (JCA-IdM) • Information Systems Audit and Control Association/IT • ITU-T Joint Coordination Activity on Cloud Computing Governance Institute (ISACA / ITGI) (JCA -Cloud) • Instituto Latinoamericano de Aseguramiento de la • ITU-T Study Group 13 (ITU-T SG 17) Calidad A. C. (INLAC) (The Latin-American Institute for • ITU-T Study Group 17 (ITU-T SG 13) Quality Assurance A.C.) • MasterCard • International Conference of Data Protection and • VISA Europe Privacy Commissioners • International Smart Card Certification Initiatives External CAT C Liaisons • International Systems Security Association (ISSA) • ABC4Trust • Interpol • ARTICLE 29 Data Protection Working Party • Kantara Initiative • ASIS International • Privacy and Identity Management for Community • CEN TC 224 Personal identification, electronic Services (PICOS) signature and cards and their related systems and • Privacy and Identity Management in Europe for Life operations (PrimeLife) • Cloud Computing Association (CSA) • Smart Card Certification Initiatives (ISCI) • Development Board (CCDB) • The Open Group • Cyber Security Naming and Information Structure • Group (TCG) Group Corporation • TAS3 (Trusted Architecture for Securely Shared Services) SC27 WG1 Mission

Information Security Management Systems The scope covers all aspects of standardisation related to information security management systems:

a) Requirements; b) Methods and processes; c) Security controls; d) Sector and application specific use of ISMS; e) Accreditation, certification, auditing of ISMS; f) Governance; g) Information security economics. SC 27/WG 1

ISMS27001: Family 2005 of Standards ISMS Requirements

27000: 2009 27010 27006: 2011 ISMS Overview and ISMS for inter-sector and inter- Accreditation Requirements Vocabulary organisational communications 27011: 2008 | ITU-T X.1051 27002: 2005 (pka 17799) 27007: 2011 Telecom Sector ISMS Code of Practice ISMS Auditing Guidelines Requirements 27003: 2010 TR 27008: 2011 27014 | ITU-T X.1054 ISMS Implementation ISMS Guide for auditors on Governance of information Guidance ISMS controls security 27004: 2009 TR 27015 Information Security Mgt Information security mgt Measurement guidelines for financial services 27005: 2011 TR 27016 Information Security Information security mgt - Risk Management Organizational economics

Accreditation Requirements and Sector Specific Requirements and Supporting Guidelines Auditing Guidelines Guidelines SC27 WG2 Mission Cryptography and Security Mechanisms • The Terms of Reference: o Identify the need and requirements for these techniques and mechanisms in IT systems and applications; and o Develop terminology, general models and standards for these techniques and mechanisms for use in security services. • The scope covers both cryptographic and non - cryptographic techniques and mechanisms including; o Confidentiality; o Entity authentication; o Non-repudiation; o ; and o Data integrity such as • Message authentication, • Hash-functions, and • Digital signatures. SC27/ WG 2

Entity Time Non- Authentica Key Mgt Stamping Repudiation tion Cryptographic(IS 11770) Protocols Services (IS 13888) (IS 9798) (IS 18014)

Cryptographic Message Check Techniques Signatures Signatures Hash Authentica Character based on giving Msg with Functions Messagetion Authentication Codes Systems Elliptic CurvesDigital Recovery SignaturesAppendix (IS 10118) (IS 9797) (IS 7064) (IS 15946) (IS 9796) (IS 14888)

Biometric Authentica Random Prime Modes of Template Encryptionted & Encryption BitParameter Number Operation Protection Encryption (IS 18033) Generation Generation Modes of Operation(IS 10116) Generation (NP 24745) (IS 19772) (IS 18031) (IS 18032) WG3 Mission

Security Evaluation, Testing and Specification The scope covers aspects related to security engineering, with particular emphasis on, but not limited to standards for IT security specification, evaluation, testing and certification of IT systems, components, and products. The following aspects may be distinguished:

a) security evaluation criteria; b) methodology for application of the criteria; c) security functional and assurance specification of IT systems, components and products; d) testing methodology for determination of security functional and assurance conformance; e) administrative procedures for testing, evaluation, certification, and accreditation schemes. SC 27/WG 3

Secure System Responsible Vulnerability Trusted Platform Module Engineering Principles Disclosure (IS 11889) and Techniques (NWIP) (WD 29147)

SSE-CMM Security Requirements for Cryptographic Modules (IS 21827) A Framework for (IS 19790) IT Security Assurance Security Assessment of (TR 15443) Test Requirements for Operational Systems Cryptographic Modules (TR 19791) (IS 24759)

IT Security Evaluation Criteria (CC) (IS 15408)

PP/ ST Protection Profile Evaluation Methodology Guide Registration Procedures (CEM) (IS 18045) (TR 15446) (IS 15292)

Verification of Security Evaluation of Cryptographic Protocols Biometrics (IS 29128) (IS 19792) SCSC2727 WG4WG 4 Mission Security controls and services • Developing and maintaining International Standards, Technical Specifications and Technical Reports for information security in the area of Security Controls and Services , to assist organizations in the implementation of the ISO/IEC 27000-series of Information Security Management Systems (ISMS) International Standards and Technical Reports

• Also the Scope of WG4 includes evaluating and developing International Standards for addressing existing and emerging information security issues and needs and other security aspects that resulted from the proliferation and use of ICT and Internet related technology in organizations (such as multi- nationals corporations, SMEs, government departments, and non-profit organisations). SC27/ WG 4

ICT Readiness for Business Continuity (IS 27031) Unknown or emerging Cybersecurity (FDIS 27032) security issues

Network Security (CD 27033-1, WD 27033-2/3/4)

Application Security (IS 27034-1) Security Info -Objects for Access Control (TR 15816) Known security issues Security of Outsourcing (27036)

TTP Services Security (TR 14516; 15945) Time Stamping Services (TR 29149)

Information security incident management (27035) Security breaches and ICT Disaster Recovery Services (24762) compromises Identification, collection and/or acquisition, and preservation of digital evidence (NP) SCSC2727 WG 5 Mission

Identity Management & Privacy Technologies • Development and maintenance of standards and guidelines addressing security aspects of o Identity management o Biometrics, and o Privacy SC 27/WG 5 oFrameworks & Architectures • A framework for identity management (ISO/IEC 24760, IS/WD/WD) • Privacy framework (ISO/IEC 29100, IS) • Privacy reference architecture (ISO/IEC 29101, CD) • Entity authentication assurance framework (ISO/IEC 29115 / ITU-T X.1254, DIS) • A framework for access management (ISO/IEC 29146, WD) oProtection Concepts • Biometric information protection (ISO/IEC 24745, IS) • Requirements for partially anonymous, partially unlinkable authentication (ISO/IEC 29191, CD) oGuidance on Context and Assessment • Authentication context for biometrics (ISO/IEC 24761, 2009) • Privacy capability assessment framework (ISO/IEC 29190, WD) Recent Achievements During the past year • 23 International Standards and Technical Reports have been published • 12 new projects have been approved • 17 new study periods were established

• 3 additional P-members • continued growth of liaisons Approved New Projects (I)

• ISO/IEC 18367: Cryptographic algorithms and security mechanisms conformance testing • ISO/IEC 18370-1: Blind digital signatures -- Part 1: General • ISO/IEC 18370 -2: Blind digital signatures -- Part 2: Discrete logarithm based mechanisms • ISO/IEC 27044: Security information and event management (SIEM) • ISO/IEC 29003: Identity proofing • ISO/IEC 29134: Privacy impact assessment -- Methodology Approved New Projects (II)

• ITU-T X.bhsm | ISO/IEC 17922: Telebiometric authentication framework using biometric module • ISO/IEC 27018: Code of practice for data protection controls for public cloud computing services • ISO/IEC 27036-5: Information security for supplier relationships -- Part 5: Guidelines for security of Cloud services • ISO/IEC 27041: Information technology – Security techniques – Guidance on assuring suitability and adequacy of investigation methods • ISO/IEC 27042: Information technology – Security techniques – Guidelines for the analysis and interpretation of digital evidence • ISO/IEC 27043: Information technology – Security techniques – Investigation principles and processes SC27 New Study Periods • SC 27 study period on Cloud computing security and privacy • SC 27 study period on Information security within Smart Grid environments • Capability maturity framework for information security management (WG 1) • Privacy / Personal Information Management Systems (PIMS) (WG 1/WG 5) • Adjustment of ISO/IEC 27000 family of standards vocabulary to align with ISO/IEC 27002 revision process (WG 1) • International certification of information security management specialists (WG 1) • Criteria for the standardization of encryption algorithms(WG 2) • -based anonymous entity authentication (WG 2) • Lightweight hash-functions (WG 2) • Key derivation mechanisms (WG 2) • Security evaluation of anti-spoofing techniques for biometrics (WG 3/WG 5) • Standards for privacy seal programs (WG 3/WG 5) • Electronic discovery (WG 4) • Cloud security technology standards (WG 4) • Coordination of investigative projects (WG 4) • Documentation of data deletion principles for personally identifiable information in organizations (WG 5) • Privacy impact assessment (WG 5) Main challenges

•Development cycle versus timeliness to market •Maintenance of appropriate liaisons with respect to application sectors •Revision of the SC27 Modus Operandi in view of the constant growth of the SC regarding members, projects, liaisons and an increased need for co-operation between WGs on specific topics Participation & More Information

Next SC 27 meetings: o April 22-30, 2013 Sophia Antipolis, France (WGs + Plenary) o Oct 21 -25 , 2013 Songdo, Korea (WGs)

• http://www.jtc1sc27.din.de/en Thank You! WG1 Standards Standard Title Status Abstract

ISO/IEC 27001 Information security 1st ed. 2005 This International Standard specifies the requirements for management systems Under establishing, implementing, operating, monitoring, reviewing, – Requirements revision maintaining and improving a documented information security management system within the context of the organization’s business activities and the risks it faces. ISO/IEC 27002 Code of practice for 1st ed. 2005 This International Standard offers a collection of commonly information security Under accepted information security control objectives and controls and controls revision includes guidelines for implementing these controls. This standard may serve as a practical guideline for developing organizational security standards and effective security management practices. ISO/IEC 27003 Information security 1st ed. 2010 This will provide further information about using the PDCA management system model and give guidance addressing the requirements of the implementation different stages on the PDCA process to establish, implement and guidance operate, monitor and review and improve the ISMS. ISO/IEC 27004 Information security 1st ed. 2009 This International Standard provides guidance on the management Under specification and use of measurement techniques for providing measurements revision assurance as regards the effectiveness of information security management systems. This International Standard provides guidance for measurement procedures and techniques to determine the effectiveness of information security controls and information security processes applied in an ISMS. ISO/IEC 27005 Information security 2nd ed. This standard ISO/IEC 27005 provides guidelines for information risk management 2011 security risk management. This International Standard supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach. WG1 Standards

Standard Title Status Abstract

ISO/IEC 27006 International 2nd ed. 2011 The scope of this standard is to specify general requirements a accreditation Under third-party body operating ISMS (in accordance with ISO/IEC guidelines for the revision 27001:2005) certification/registration has to meet, if it is to be accreditation of recognized as competent and reliable in the operation of ISMS bodies operating certification / registration. This International Standard follows certification / the structure of ISO/IEC 17021 with the inclusion of additional registration of ISMS-specific requirements and guidance on the application of information security ISO/IEC 17021 for ISMS certification. management systems ISO/IEC 27007 Guidelines for 1st ed. 2011 This International Standard provides guidance on conducting information security information security management system (ISMS) audits, as well management systems as guidance on the competence of ISMS auditors, in addition to auditing the guidance contained in ISO 19011. It is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme. ISO/IEC 27008 Guidelines for 1st ed. 2012 This Technical Report provides guidance for assessing the auditors on ISMS implementation of ISMS controls selected through a risk-based controls approach for information security management. It supports the information security risk management process and assessment of ISMS controls by explaining the relationship between the ISMS and its supporting controls. It provides guidance on how to verify the extent to which required ISMS controls are implemented. WG1 Standards

Standard Title Status Abstract

ISO/IEC 27010 Information security 1st ed. 2012 This International Standard provides guidelines in addition to management for guidance given in the ISO/IEC 27000 family of standards for inter-sector and inter- implementing information security management within organisational information sharing communities. This International Standard communications provides controls and guidance specifically relating to initiating, implementing, maintaining, and improving information security in inter-organisational and inter-sector communications. ITU-T X.1051 | Information security 1st ed. 2008 This Recommendation | International Standard: a) establishes ISO/IEC 27011 management guidelines and general principles for initiating, implementing, guidelines for maintaining, and improving information security management telecommunications in telecommunications organizations based on ISO/IEC 27002; b) organizations based provides an implementation baseline of Information Security on ISO/IEC 27002 Management within telecommunications organizations to ensure the confidentiality, integrity and availability of telecommunications facilities and services. ISO/IEC 27013 Guidelines on the 1st ed. 2012 This International Standard provides guidance on the integrated integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 for those implementation of organizations which are intending to either: ISO/IEC 27001 and a. Implement ISO/IEC 27001 when ISO/IEC 20000-1 is already ISO/IEC 20000-1 adopted, or vice versa; b. Implement both ISO/IEC 27001 and ISO/IEC 20000-1 together; or c. Align existing ISO/IEC 27001 and ISO/IEC 20000-1 management system (MS) implementations. WG1 Standards

Standard Title Status Abstract

ISO/IEC 27014 Information security 1st ed. 2013 This International Standard provides guidance on the development governance framework and use of governance of information security (GIS) through which organisations direct and control the information security management system (ISMS) process as specified in ISO/IEC 27001. This International Standard provides guiding principles for top management of organisations on the effective, efficient, and acceptable use of information security within their organisations. ISO/IEC 27015 Guidelines for 1st ed. 2012 This International Standard provides requirements, guidelines and information security general principles for initiating, implementing, maintaining, and management system for improving the information security management within finance and financial and insurance insurance sectors based upon ISO/IEC 27001 and ISO/IEC 27002. services sector ISO/IEC 27016 Information security 4th WD 2012 This technical report provides guidelines on how an organization can management - make decisions to protect information and understand the economic Organisational consequences of these decisions in the context of competing economics requirements for resources. This Technical Report is applicable to all types and sizes of organizations and provides information to enable economic decisions in information security management by managers who have responsibility for information security decisions. ISO/IEC 27017 Guidelines on 3rd WD 2012 The scope of this Technical Specification/ International Standard is to Information security define guidelines supporting the implementation of Information controls for the use of Security Management for the use of cloud service. The adoption of this cloud computing Technical Specification/ International Standard allows cloud services based on consumers and providers to meet baseline information security ISO/IEC 27002 management with the selection of appropriate controls and implementation guidance based on risk assessment for the use of cloud service. WG2 Standards Standard Title Status Abstract ISO/IEC 18033-1 Encryption algorithms 1st ed. 2005 This International Standard specifies Part 1: General Under revision asymmetric ciphers (including identity- based ciphers) and symmetric ciphers (block -2 Part 2: Asymmetric ciphers 1st ed. 2006 ciphers and stream ciphers). -3 Part 3: Block ciphers 2nd ed. 2010 This International Standard specifies symmetric ciphers (block ciphers and stream -4 Part 4: Stream ciphers 2nd ed. 2011 ciphers) and mechanisms using asymmetric -5 Part 4: Identity-based ciphers Under development techniques (authentication, key exchange and identity-based signature) which are st ISO/IEC 29192-1 Lightweight cryptography 1 ed. 2012 suitable for lightweight cryptographic Part 1: General applications. -2 Part 2: Block ciphers 1st ed. 2012 This International Standard specifies methods for authenticated encryption, i.e., -3 Part 3: Stream ciphers Under development defined ways of processing a data string for -4 Part 4: Mechanisms using asymmetric techniques Under development data confidentiality, data integrity and data origin authentication. ISO/IEC 19772 Authenticated encryption 1st ed. 2009 ISO/IEC 29150 Signcryption 1st ed. 2011 This International specifies mechanisms for signcryption that employ public key ISO/IEC 10116 Modes of operation for an n-bit block cipher 3rd ed. 2006 cryptographic techniques requiring both the algorithm originator and the recipient of protected data to their own public and private key pairs. ISO/IEC 10118-1 Hash-functions 2nd ed. 2000 Part 1: General This International Standard specifies modes of operation for a block cipher algorithm, i.e., -2 Part 2: Hash-functions using an n-bit block cipher 3rd ed. 2010 ECB, CBC, OFB, CFB and CTR. -3 Part 3: Dedicated hash-functions 3rd ed. 2006 This International Standard specifies some kinds of hash-functions which map arbitrary -4 Part 4: Hash-functions using modular arithmetic 1st ed. 1998 strings of bits to a given range. ISO/IEC 15946-1 Cryptographic techniques based on elliptic curves 2nd ed. 2008 This International Standard describes the Part 1: General mathematical background and general techniques in addition to the elliptic cuerve -5 Part 5: Elliptic curve generation 1st ed. 2009 generation techniques. WG2 Standards Standard Title Status Abstract ISO/IEC 9796-2 schemes giving message recovery 3rd ed. 2010 This International Standard specifies Part 2: Integer factorization based mechanisms digital signature mechanisms giving

nd partial or total message recovery -3 Part 3: Discrete logarithm based mechanisms 2 ed. 2006 aiming at reducing storage and transmission overhead. ISO/IEC 14888-1 Digital signatures with appendix 2nd ed. 2008 Part 1: General This International Standard specifies digital signature mechanisms with nd -2 Part 2: Integer factorization based mechanisms 2 ed. 2008 appendix. -3 Part 3: Discrete logarithm based mechanisms 2nd ed. 2006 This International Standard specifies anonymous digital signature ISO/IEC 20008-1 Anonymous digital signatures Under development mechanisms, in which a verifier Part 1: General makes use of a group public key to -2 Part 2: Mechanisms using a group public key Under development verify a digital signature. ISO/IEC xxxxx-1 Blind digital signatures Under development This International Standard specifies Part 1: General blind digital signature mechanisms which allow a recipient to obtain a -2 Part 2: Discrete logarithm based mechanisms Under development signature without giving signer any ISO/IEC 9798-1 Entity authentication 3rd ed. 2010 information about the actual message Part 1: General or resulting signature. This International Standard specifies -2 Part 2: Mechanisms using symmetric encipherment algorithms 3rd ed. 2008 several kinds of entity authentication -3 Part 3: Mechanisms using digital signature techniques 2nd ed. 1998 mechanisms that an entity to be authenticated proves its identity by nd -4 Part 4: Mechanisms using cryptographic check function 2 ed. 1999 showing its knowledge of a secret. -5 Part 5: Mechanisms using zero knowledge techniques 3rd ed. 2009 This International Standard specifies -6 Part 6: Mechanisms using manual data transfer 2nd ed. 2010 anonymous entity authentication mechanisms in which a verifier makes ISO/IEC 20009-1 Anonymous entity authentication Under development use of a group signature scheme to Part 1: General authenticate the entity with which it is -2 Part 2: Mechanisms based on signatures using a group public Under development communicating, without knowing key this entity’s identity. -3 Part 3: Mechanisms based on blind signatures Under development WG2 Standards Standard Title Status Abstract ISO/IEC 9797-1 Message authentication codes (MACs) 2nd ed. 2011 This International Standard specifies message Part 1: Mechanisms using a block cipher authentication code (MAC) algorithms, which

nd are data integrity mechanisms that compute a -2 Part 2: Mechanisms using a dedicated hash-function 2 ed. 2011 short string. -3 Part 3: Mechanisms using a universal hash-function 1st ed. 2011 This International Standard specifies a set of

st check character systems capable of protecting ISO/IEC 7064 Check character systems 1 ed. 2003 strings against errors. ISO/IEC 11770-1 Key management 2nd ed. 2010 This International Standard describes general Part 1: Framework models on which key management mechanisms

nd are based, defines the basic concepts of key -2 Part 2: Mechanisms using symmetric techniques 2 ed. 2008 management, and defines several kinds of key -3 Part 3: Mechanisms using asymmetric techniques 2nd ed. 2008 establishment mechanisms . Under revision The goal of the non -repudiation service is to -4 Part 4: Mechanisms based on weak secrets 1st ed. 2004 generate, collect, maintain, make available and validate evidence concerning a claimed event or -5 Part 5: Group key management 1st ed. 2011 action in order to resolve disputes about the ISO/IEC 13888-1 Non-repudiation 3rd ed. 2009 occurrence or non-occurrence of the event or Part 1: General action. The event or act on can be the generation of a message, sending of a message, receipt of a -2 Part 2: Mechanisms using symmetric techniques 2nd ed. 2010 message, submission of a message transport of a

nd message. This International Standard specifies -3 Part 3: Mechanisms using asymmetric techniques 2 ed. 2009 for the provision of non-repudiation services. ISO/IEC 18014-1 Time-stamping services 2nd ed. 2008 This International Standard defines time- Part 1: Framework stamping services that are provided using time-

nd stamp tokens between the participanting entities -2 Part 2: Mechanisms producing independent tokens 2 ed. 2009 in addition to the traceability of time sources. -3 Part 3: Mechanisms producing linked tokens 2nd ed. 2009 This International Standard specifies a conceptual model for a random bit generator for -4 Part 4: Traceabilityof time sources Under development cryptographic purposes, together with the ISO/IEC 18031 Random bit generation 2nd ed. 2011 elements of this model. ISO/IEC 18032 Prime number generation 1st ed. 2005 This standard presents methods for generating prime numbers as required in cryptographic protocols and algorithms. WG3 Standards

Standard Title Status Abstract

ISO/IEC 11889 Trusted Platform 1st Ed ISO/IEC 11889 defines the Trusted Platform Module (TPM), a Module device that enables trust in computing platforms in general. ISO/IEC 15408 Evaluation criteria for 3rd Ed ISO/IEC 15408-1:2009 establishes the general concepts and IT security principles of IT security evaluation and specifies the general model of evaluation given by various parts of ISO/IEC 15408 which in its entirety is meant to be used as the basis for evaluation of security properties of IT products. ISO/IEC TR A framework for IT 1st Ed ISO/IEC TR 15443 guides the IT security professional in the 15443 security assurance Under selection of an appropriate assurance method when specifying, revision selecting, or deploying a security service, product, or environmental factor such as an organization or personnel. ISO/IEC TR Guide for the 2nd Ed. ISO/IEC TR15446:2009 provides guidance relating to the 15446 production of construction of Protection Profiles (PPs) and Security Targets Protection Profiles (STs) that are intended to be compliant with the third edition of and Security Targets ISO/IEC 15408. ISO/IEC 17825 Testing methods for 3rd WD This International Standard specifies the non-invasive attack the mitigation of non- mitigation test metrics for determining conformance to the invasive attack requirements specified in ISO/IEC 19790:2012 for Security Levels classes against 3 and 4. cryptographic modules ISO/IEC 18045 Methodology for IT 3rd Ed ISO/IEC 18045:2008 defines the minimum actions to be security evaluation performed by an evaluator in order to conduct an ISO/IEC 15408 evaluation, using the criteria and evaluation evidence defined in ISO/IEC 15408. WG3 Standards

Standard Title Status Abstract

ISO/IEC 19790 Security 2nd Ed ISO/IEC 19790:2012 specifies the security requirements for a requirements for cryptographic module utilised within a security system cryptographic protecting sensitive information in computer and modules telecommunication systems ISO/IEC TR Security assessment 2nd Ed ISO/IEC TR 19791:2010 provides guidance and criteria for the 19791 of operational security evaluation of operational systems. systems ISO/IEC 19792 Security evaluation of 1st Ed ISO/IEC 19792:2009 specifies the subjects to be addressed during biometrics a security evaluation of a biometric system. ISO/IEC 21827 Systems Security 2nd Ed ISO/IEC 21827:2008 specifies the Systems Security Engineering - Engineering -- Capability Maturity Model® (SSE-CMM®), which describes the Capability Maturity essential characteristics of an organization's security engineering Model® (SSE- process that must exist to ensure good security engineering. CMM®) ISO/IEC TR Refining software 1st Ed ISO/IEC TR 20004:2012 refines the AVA_VAN assurance family 20004 vulnerability analysis activities defined in ISO/IEC 18045:2008 and provides more under ISO/IEC 15408 specific guidance on the identification, selection and assessment and ISO/IEC 18045 of relevant potential vulnerabilities in order to conduct an ISO/IEC 15408 evaluation of a software target of evaluation. ISO/IEC 24759 Test requirements for 1st Ed ISO/IEC 24759:2008 specifies the methods to be used by testing cryptographic Under laboratories to test whether a cryptographic module conforms to modules review the requirements specified in ISO/IEC 19790:2006. ISO/IEC 28128 Verification of 1st Ed ISO/IEC 29128:2011 establishes a technical base for the security cryptographic proof of the specification of cryptographic protocols. protocols WG3 Standards

Standard Title Status Abstract

ISO/IEC 29147 Vulnerability DIS This International Standard gives guidelines for the disclosure of Disclosure potential vulnerabilities in products and online services. ISO/IEC TR Secure system PDTR ISO/IEC TR 29193 offers guidance on secure system engineering 29193 engineering for Information and Communication Technology systems or principles and products. techniques ISO/IEC TR Physical security WD This Technical Report addresses how security assurance can be 30104 attacks, mitigation stated for products where the risk of the security environment techniques and requires the support of physical protection mechanisms. security requirements ISO/IEC 30111 Vulnerability CD This International Standard describes processes for vendors to handling processes handle reports of potential vulnerabilities in products and online services. ISO/IEC 30127 Detailing software WD This Technical Report provides guidelines for the planning, penetration testing development and execution of penetration testing under under ISO/IEC 15408 ISO/IEC 15408 and ISO/IEC 18045 Vulnerability Assessment for and ISO/IEC 18045 software targets of evaluation. vulnerability analysis WG4 Standards

Standard Title Status Abstract

ISO/IEC TR Guidelines for the 1st Ed. 2002 This Technical Report provides guidance for the use and 14516 use and management management of Trusted Third Party (TTP) services, a clear of Trusted Third definition of the basic duties and services provided, their Party services description and their purpose, and the roles and liabilities of TTPs and entities using their services. This Technical Report identifies different major categories of TTP services including time stamping, non-repudiation, key management, certificate management, and electronic notary public. ISO/IEC 15816 Security information 1st Ed. 2002 This International Standard provides object definitions that are objects for access commonly needed in security standards to avoid multiple and control different definitions of the same functionality. Precision in these definitions is achieved by use of the Abstract Syntax Notation One (ASN.1). ISO/IEC 15945 Specification of TTP 1st Ed. 2002 This International Standard defines the services required to services to support support the application of digital signatures for non-repudiation the application of of creation of a document. Since this implies integrity of the digital signatures document and authenticity of the creator, the services described can also be combined to implement integrity and authenticity services. ISO/IEC 18028-2 IT network security – 1st Ed. 2006 This International Standard defines a network security Part 2: Network (Being architecture for providing end-to-end network security. The security architecture revised by architecture can be applied to various kinds of networks where ISO/IEC end-to-end security is a concern and independently of the 27033-2) network's underlying technology. WG4 Standards

Standard Title Status Abstract

ISO/IEC 18028-3 IT network security – 1st Ed. 2005 This International Standard provides an overview of security Part 3: Securing (Being gateways through a description of different architectures. It communications revised by outlines the techniques for security gateways to analyse network between networks ISO/IEC traffic, and provides guidelines for the selection and using security 27033-4) configuration of security gateways. gateways ISO/IEC 18028-4 IT network security – 1st Ed. 2005 This International Standard provides guidance for securely Part 4: Securing using remote access – a method to remotely connect a computer remote access either to another computer or to a network using public networks – and its implication for IT security. In this it introduces the different types of remote access including the protocols in use, discusses the authentication issues related to remote access and provides support when setting up remote access securely. ISO/IEC 18028-5 IT network security – 1st Ed. 2006 This International Standard provides detailed direction with Part 5: Securing (Being respect to the security aspects of using Virtual Private Network communications revised by (VPN) connections to inter-connect networks, and also to across networks ISO/IEC connect remote users to networks. It provides an overview of using virtual private 27033-5) VPNs, presents VPN security objectives, and summarizes VPN networks security requirements. It gives guidance on the selection of secure VPNs, on the implementation of secure VPNs, and on the network monitoring of VPN security. It also provides information on typical technologies and protocols used by VPNs. WG4 Standards Standard Title Status Abstract

ISO/IEC 18043 Selection, 1st Ed. 2006 This International Standard provides guidelines to assist organizations deployment and (Being in preparing to deploy Intrusion operations of revised by Detection System (IDS). In particular, it addresses the selection, intrusion detection ISO/IEC deployment and operations of IDS. It also systems 27039) provides background information from which these guidelines are derived. ISO/IEC 24762 Guidelines for 1st Ed. 2008 This International Standard provides guidelines on the provision of information and information and communications technology disaster recovery (ICT communications DR) services as part of business continuity management, applicable to technology disaster both “in-house” and “outsourced” ICT DR service providers of recovery services physical facilities and services. It covers the requirements that service providers should meet, recognizing that individual organizations may have additional requirements that are specific to them. ISO/IEC 27031 Guidelines for ICT 1st Ed. 2011 This International Standard describes the concepts and principles of readiness for information and communication technology (ICT) readiness for business continuity business continuity, and provides a framework of methods and processes to identify and specify all aspects (such as performance criteria, design, and implementation) for improving an organization's ICT readiness to ensure business continuity. ISO/IEC Network Security 1st Ed. 2009 This International Standard provides an overview of network security 27033-1 – Part 1: Overview (Revision and related definitions. It defines and describes the concepts and concepts of 18028-1) associated with, and provides management guidance on, network security. (Network security applies to the security of devices, security of management activities related to the devices, applications/services and end-users, in addition to security of the information being transferred across the communication links.) Overall, it provides an overview of the ISO/IEC 27033 series and a “road map” to all other parts. WG4 Standards

Standard Title Status Abstract

ISO/IEC 27033-3 Network Security – 1st Ed. 2010 This International Standard describes the threats, design Part 3: Reference techniques and control issues associated with reference network networking scenarios scenarios. For each scenario, it provides detailed guidance on – Risks, design the security threats and the security design techniques and techniques and controls required to mitigate the associated risks. control issues The information in this International Standard is for use when reviewing technical security architecture/design options and when selecting and documenting the preferred technical security architecture/design and related security controls. ISO/IEC 27034-1 Application security 1st Ed. 2011 ISO/IEC 27034 provides guidance to assist organizations in – Part 1: Overview integrating security into the processes used for managing their and concepts applications. This International Standard presents an overview of application security. It introduces definitions, concepts, principles and processes involved in application security. ISO/IEC 27035 Information security 1st Ed. 2011 This International Standard provides a structured and planned incident management approach to detect, report and assess information security incidents; respond to and manage information security incidents; detect, assess and manage information security vulnerabilities; and continuously improve information security and incident management as a result of managing information security incidents and vulnerabilities. ISO/IEC TR Best practice on the 1st Ed. 2012 This Technical Report explains how to provide and use time- 29149 provision and use of stamping services so that time-stamp tokens are effective when time-stamping used to provide timeliness and data integrity services, or non- services repudiation services (in conjunction with other mechanisms). It covers time-stamp services, explaining how to generate, renew, and verify time-stamp tokens. WG 5 Standards

Standard Title Status Abstract ISO/IEC 24761 Authentication 1st ed. 2009 ISO/IEC 24761 specifies the structure and the data context for elements of Authentication Context for Biometrics biometrics Technical (ACBio), which is used for checking the validity of the corr. result of a biometric verification process executed at a under vote remote site. It allows any ACBio instance to accompany any data item that is involved in any biometric process related to verification and enrolment. The specification of ACBio is applicable not only to single modal biometric verification but also to multimodal fusion. ISO/IEC 24761 also specifies the cryptographic syntax of an ACBio instance based on an abstract Cryptographic Message Syntax (CMS) schema. ISO/IEC 24745 Biometric 1st ed. 2011 ISO/IEC 24745 provides guidance for the protection of information biometric information under various requirements for st protection 1 confidentiality, integrity and renewability/revocability Pre-review during storage and transfer. Additionally, it provides 2014 requirements and guidelines for the secure and privacy-compliant management and processing of biometric information. It does not include general management issues related to physical security, environmental security and key management for cryptographic techniques. WG 5 Standards

Standard Title Status Abstract

ISO/IEC A framework for 1st ed. 2011 ISO/IEC 24760-1 24760:1 identity • defines terms for identity management, and management -- 1st • specifies core concepts of identity and identity Part 1: Terminology Pre-review management and their relationships. and concepts 2014 To address the need to efficiently and effectively implement systems that make identity-based decisions ISO/IEC 24760 specifies a framework for the issuance, administration, and use of data that serves to characterize individuals, organizations or information technology components which operate on behalf of individuals or organizations. ISO/IEC 24760 specifies fundamental concepts and operational structures of identity management with the purpose to realize information system management so that information systems can meet business, contractual, regulatory and legal obligations. Pat 1 of ISO/IEC 24760 specifies the terminology and concepts for identity management, to promote a common understanding in the field of identity management. It also provides a bibliography of documents related to standardization of various aspects of identity management. WG 5 Standards

Standard Title Status Abstract

ISO/IEC 29100 Privacy 1st ed. 2011 ISO/IEC 29100 provides a privacy framework which framework • specifies a common privacy terminology; st 1 • defines the actors and their roles in processing Pre-review personally identifiable information (PII); 2014 • describes privacy safeguarding considerations; and • provides references to known privacy principles for information technology. ISO/IEC 29100 is applicable to natural persons and organizations involved in specifying, procuring, architecting, designing, developing, testing, maintaining, administering, and operating information and communication technology systems or services where privacy controls are required for the processing of PII.