Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
I. Infrastructure security layer constituting network transmission facilities and
devices that are fundamental building blocks of the network (e.g., servers,
routers, base stations, links between base stations and switching centre).
II. Services security layer addressing security of services provided by the
network (e.g., Internet access services, voice calls, VPN, SDS/SMS
messaging).
III. Applications security layer addressing security of network-based
applications accessed by network users (e.g., email, web browsing, file
transfer, online training, electronic/mobile-commerce).
3. Security planes: are categories of network-related activities protected by
security dimensions. The three activity planes in the security architecture are:
I. The management security plane concerned with protection of OAM&P
functions of network elements, services and application. Includes the fault,
capacity, administration, provisioning, and security (FCAPS) functions.
II. The control security plane concerned with the protection of activities that
enable efficient delivery of information, services and applications across
the networks. Includes machine-to-machine communication of control or
signalling information for configuring devices to route traffic across
network.
III. The end-user security plane addresses security in the user’s process of
accessing and utilizing services provided by network. This also includes
actual end-user payload or data flows (e.g., images, data files, streaming
video).
Each of the aforementioned security planes along with the three security layers
must be secured to provide an effective end-to-end security posture.
Utilization of the ITU-T X.805 Security Architecture
The ITU-T X.805 security architecture components described previously enable
the identification of security issues that need to be addressed in countering threats
adopted from ITU-T X.800, namely: destruction, corruption, removal, disclosure
and interruption. Table 7 shows the security dimensions and the corresponding
security threats that are addressed by each dimension. For instance, the
authentication security dimension counters the threat of removal or disclosure of
information.
The ITU-T X.805 security architecture enables modular, systematic and
organized assessment and planning of network security. Figure 17 illustrates in
tabulated form how the intersection of three security layers and three security
planes provide nine unique perspectives or modules for consideration of the eight
security dimensions. Notably, the security dimensions of different modules would
have a different set of objectives and hence different set of security measures. This
tabular form provides a convenient way of describing the security dimension
objectives for each module.
The objective of each one of the aforementioned modules is summarized
briefly in Table 8.
112 NORDREGIO REPORT 2007:5