TR 33.936
Security Assurance Methodology (SECAM) for 3GPP Virtualized Network Products
V18.0.1 (PDF)
2023/03 19 p.
- Rapporteur:
- Mr. Qi, Minpeng
China Mobile Com. Corporation
full Table of Contents for TR 33.936 Word version: 18.0.1
1 Scope
2 References
3 Definitions of terms, symbols and abbreviations
4 Overview
5 Security Assurance Specification (SCAS) Creation
6 Vendor development and product lifecycle processes and test laboratory accreditation
7 Evaluation and SCAS instantiation
$ Change history
1 Scope p. 7
The present document defines the complete Security Assurance Methodology (SECAM) evaluation process (evaluation, relation to SECAM Accreditation Body, roles, etc.) as well as the components of SECAM that are intended to provide the expected security assurance for virtualized network product. It will thus describe the general scheme providing an overview of the entire scheme and explaining how to create and apply the Security Assurance Specifications (SCASs). It will detail the different evaluation tasks (vendor network product development and network product lifecycle management process assessment, Security Compliance Testing, Basic Vulnerability Testing and Enhanced Vulnerability Analysis) and the different actors involved. Enhanced Vulnerability Analysis is outside the scope of the present release of SECAM. The present document will help all involved parties to have a clear understanding of the overall process and the covered threats.
In another aspect, compared to [2], present document shows specific methodology to virtualized network product in addition.
2 References p. 7
3 Definitions of terms, symbols and abbreviations p. 8
4 Overview p. 8
4.1 Introduction p. 8
4.1.1 Considerations on network product class when using NFV technology p. 8
4.1.2 Considerations on SECAM of the virtualized network products p. 9
4.2 Scope of a SECAM SCAS for 3GPP virtualized network products p. 9
4.3 Scope of SECAM evaluation for 3GPP virtualized network products p. 9
4.4 Scope of SECAM Accreditation for 3GPP virtualized network products p. 10
4.5 Ultimate Output of SECAM Evaluation for 3GPP virtualized network products p. 10
4.6 3GPP virtualized network products evaluation process p. 11
4.7 Roles in SECAM for 3GPP virtualized network products p. 11
4.8 Operator security acceptance decision for 3GPP virtualized network products p. 11
4.9 SECAM Assurance level for 3GPP virtualized network products p. 12
4.10 Security baseline for 3GPP virtualized network products p. 12
5 Security Assurance Specification (SCAS) Creation p. 12
5.1 Introduction p. 12
5.2 SCAS documents structure and content p. 12
5.3 Improvement of SCAS and new potential security requirements p. 14
5.4 Basic vulnerability testing requirements for generic virtualized network product p. 14
6 Vendor development and product lifecycle processes and test laboratory accreditation p. 15
6.1 Overview p. 15
6.2 Audit and accreditation of Vendor network product development and network product lifecycle management processes p. 15
6.3 Audit and accreditation of test laboratories p. 16
6.4 Monitoring p. 16
6.5 Dispute resolution p. 16
7 Evaluation and SCAS instantiation p. 16
7.1 Security Assurance Specification (SCAS) instantiation documents creation p. 16
7.2 Evaluation and evaluation report p. 17
7.2.1 Network product development process and network product lifecycle management p. 17
7.2.2 SCAS instantiation evaluation p. 17
7.2.3 Security Compliance testing p. 18
7.2.4 Basic Vulnerability Testing p. 18
7.3 Self-declaration p. 18
7.4 Partial compliance and use of SECAM requirements in network product development cycle p. 18
7.5 Comparison between two SECAM evaluations p. 18
7.6 The evaluation of a new version p. 18
$ Change history p. 19
