Cyber Security Across Complex Networks – Protecting Your Systems with TM Forum Frameworx

By Christy Coffey, Head of Government/Defense Support Center, TM Forum and John Reilly, Senior Program Manager, TM Forum

Reflective of the urgency established by our Defense Community and Service Provider members, in late 2009 TM Forum launched an aggressive Security Management Initiative to enrich its Frameworks and certification processes with full-spectrum Security Management guidance concerning architecture, processes, information, applications, interfaces and testing.

In January 2010, a generous contribution of intellectual property from the National Security Agency (NSA) and the Defense Information Systems Agency (DISA) in the form of a Computer Net-Defense (NetD) data model, Implementation Guide and accompanying data dictionary provided TM Forum with valuable insights on how to model information related to assets, vulnerabilities, threats, events and incidents. The National Institute of Standards and Technology (NIST) Security Content Automation Protocol (SCAP) suite of standards were embraced during the creation of the NSA's NetD data model.

TM Forum completed a project in October 2010 to extend its Information Framework, or SID, to include the NetD entities and attributes. This work will be available to TM Forum members in the next Frameworx release, scheduled for delivery on March 15. The Information Framework describes the structure of business entities and their relationships, which are of interest to a business. With the inclusion of NetD concepts in the new Enterprise Security Management Aggregate Business Entity (ABE), the Information Framework now supports the following:

• What vulnerabilities do the assets (resources) have?
• What threats are targeting the vulnerabilities on those assets?
• What events are occurring on the network?
• What incidents are discovered from assessments of the events?

This project is only an initial step to incorporating security into Frameworx. The Enterprise Security Management ABE, along with future security enhancements to Frameworx, can be used to integrate security management capabilities into a service provider's Operations Support System (OSS). This will improve the service provider's ability to detect, analyze and act on security vulnerabilities, threats, events and incidents as they relate to its assets and to the services and products it provides.

As security features are incorporated into TM Forum's Frameworx, service providers and suppliers will be able to certify their conformance to Frameworx security-oriented best practices and standards using Frameworx Conformance Certification Assessment. Service Providers can then confidently procure standards-based products rich with security management features.

Other security related topics being pursued within the security management community include: Mobility Security, Cyber Security (sharing of real-time data on attacks), Digital Policy Management, Privacy and Governance and Federated Identity Management and Auditing. TM Forum is actively recruiting Subject Matter Experts to join our community and encourages participation in forthcoming projects.