ETSI TR 103 369 V1.1.1 (2016-07)

CYBER; Design requirements ecosystem

DTR/CYBER-0011

General Information

• Status: Published
• Publication Date: 25-Jul-2016
• Technical Committee: CYBER - Cyber Security
• Current Stage: 12 - Completion
• Due Date: 01-Aug-2016
• Completion Date: 26-Jul-2016

Standards Content (Sample)

ETSI TR 103 369 V1.1.1 (2016-07)






TECHNICAL REPORT
CYBER;
Design requirements ecosystem

---------------------- Page: 1 ----------------------
2 ETSI TR 103 369 V1.1.1 (2016-07)



Reference
DTR/CYBER-0011
Keywords
cyber security, secure by default
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88

Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the
print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.

© European Telecommunications Standards Institute 2016.
All rights reserved.

TM TM TM
DECT , PLUGTESTS , UMTS and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members.
TM
3GPP and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI

---------------------- Page: 2 ----------------------
3 ETSI TR 103 369 V1.1.1 (2016-07)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Executive summary . 5
Introduction . 5
1 Scope . 6
2 References . 6
2.1 Normative references . 6
2.2 Informative references . 6
3 Definitions and abbreviations . 6
3.1 Definitions . 6
3.2 Abbreviations . 6
4 A "by design" ecosystem . 7
4.0 Description . 7
4.1 Availability . 7
4.1.0 Availability generally . 7
4.1.1 Public services . 7
4.1.2 Specific resilience and survivability requirements . 7
4.1.3 Bandwidth non-discrimination. 7
4.1.4 Outage reporting . 7
4.2 Emergency and public safety communication . 8
4.2.0 Emergency and public safety communication generally . 8
4.2.1 Authority to many . 8
4.2.2 One to authority . 8
4.2.3 Access/prioritization during emergency . 8
4.2.4 Device discovery/disablement . 8
4.3 Lawful interception . 8
4.3.0 Lawful interception generally . 8
4.3.1 Signalling . 9
4.3.2 Metadata analysis . 9
4.3.3 Content . 9
4.4 Retained data . 9
4.4.0 Retained data generally . 9
4.4.1 Criminal investigative . 9
4.4.2 Civil investigative/eDiscovery . 9
4.4.3 Compliance, contractual requirements and business auditing . 9
4.5 Identity management . 9
4.5.0 Identify management generally. 9
4.5.1 Access identity . 10
4.5.2 Communicating or process party identity . 10
4.5.3 Communicating or process party blocking . 10
4.6 Cyber Security . 10
4.6.0 Cyber security generally . 10
4.6.1 Defensive measures . 10
4.6.2 Structured threat information exchange . 10
4.7 Personally Identifiable Information protection (Privacy) . 10
4.8 Content control . 10
4.8.0 Content control generally . 10
4.8.1 Intellectual Property Rights . 10
4.8.2 Societal or organization norms . 11
4.8.3 Privacy . 11
4.9 Operations control . 11
4.9.0 Operations control generally . 11
ETSI

---------------------- Page: 3 ----------------------
4 ETSI TR 103 369 V1.1.1 (2016-07)
4.9.1 Emissions controls . 11
4.9.2 Equipment characteristics . 11
4.10 Support for persons with disabilities . 11
4.11 Network Management . 11
4.11.0 Network management generally . 11
4.11.1 Traffic management . 12
4.11.2 Device management . 12
4.11.3 Charging and Billing . 12
5 Synergies and conflicts among design requirements . 12
History . 13


ETSI

---------------------- Page: 4 ----------------------
5 ETSI TR 103 369 V1.1.1 (2016-07)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (https://ipr.etsi.org/).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This Technical Report (TR) has been produced by ETSI Technical Committee Cyber Security (CYBER).
Modal verbs terminology
In the present document "should", "should not", "may", "need not", "will", "will not", "can" and "cannot" are to be
interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Executive summary
The present document provides a high level structured ecosystem of multiple "by-design" requirements that are related
to security and may be applicable to communication and IT networks and attached devices. All such networks and
devices whether for public or private infrastructure use, are commonly subject to eleven kinds of obligations - imposed
by regulation, contract, exposure to liabilities, societal expectation, or business necessity. At a more granular level,
there are even more than the eleven. Those engineering and operating the networks and devices are expected to
instantiate the capabilities for these obligations "by design". The present document is not intended to provide design
details. It simply enumerates the eleven obligations as a kind of ontology and identifies where there may be synergies or
conflicts among the design requirements, and provides a bibliography of reference information.
Introduction
Communication and IT networks in their most elementary form, consist of some network attached device used to
exchange or receive information from some arbitrary set of other attached devices that generally packaged as services
provided to user customers. Whether for physical or virtual capability instantiations, some design processes occur that
are governed by requirements that allow those capabilities to meet expectations.
There are innumerable engineering methods, technical standards, and law that guide and govern this activity. When all
of this guidance and governance is distilled, there emerge a set of recurring common capabilities that embedded "by
design." They are there for users or operators to make use of as a function of the conditions and context of the devices
and services.
Indeed, the term "by design" itself has been used in recent years to describe specific capabilities - perhaps the most
notable being "privacy by design". It is also common throughout the world for public networks and devices to institute
lawful inception or retained data capabilities by design. The ever growing enormous complexity of devices, software,
and networks has resulted in exponential increases in exploited vulnerabilities that in turn has necessitated cyber
security by design. When the recursive process of identifying all of these "by design" is undertaken, it appears there are
ten of them with various sub-variants that emerge. These are enumerated and described here together with noting the
synergies or conflicts that may exist among some of them.

ETSI

---------------------- Page: 5 ----------------------
6 ETSI TR 103 369 V1.1.1 (2016-07)
1 Scope
The present document provides a high level structured ecosystem of security design requirements that may be
applicable to communication and IT networks and attached devices. It identifies where there may be synergies or
conflicts among the design requirements, and provides a bibliography of reference information.
2 References
2.1 Normative references
Normative references are not applicable in the present document.
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] Directive of the European Parliament and of the Council concerning measures with a view to
achieving for a high common level of security of network and information security systems across
the Union, Brussels, 18 December 2015.
[i.2] CPNI: "Threat Intelligence: Collecting, Analysing, Evaluating," Center for the Protection of
National Infrastructure.
NOTE: Available at https://www.cpni.gov.uk/Documents/Publications/2015/23-March-2015-
MWR_Threat_Intelligence_whitepaper-2015.pdf.
[i.3] ETSI TR 103 305: "CYBER; Critical Security Controls for Effective Cyber Defence".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
by design: instantiation of an explicit technical or operational capability in a device, network or service offering
3.2 Abbreviations
For the purposes of the present document, the following abbreviations a
...