INTERNATIONAL ISO/IEC STANDARD 18028-1

IS0/IEC18028-1:2006(E)11 Review Networking Characteristics and Related Trust Relationships11.1 Network CharacteristicsThe characteristics of the existing or proposed network should be reviewed. It is particularly important toidentify whether the network is a:— public network - a network accessible by anyone, or— private network, e.g. a network consisting of owned or leased lines, therefore considered to be moresecure than a public network.It is also important to know the type of data transported by the network, for example a:— data network - a network transferring primarily data and making use of data protocols,— voice network - a network intended for telephone but also usable for data, or— network encompassing both data and voice, and possibly video.Other information, such as:— whether the network is a packet or switched network,— whether it supports a QoS, i.e. in an MPLS network,is also relevant.(QoS concerns consistent performance. Network services should be delivered to provide the minimumperformance level to be useable. For example, voice service will stutter and break up if the bandwidth isinadequate. QoS refers to a network system's ability to sustain a given service at or above its requiredminimum performance level.)Further, it should also be established whether a connection is permanent, or established at time of need.11.2 Trust RelationshipsOnce the characteristics of the existing or proposed networking have been identified, and at minimum it hasbeen established if the network is public or private (see Clause 11.1 above), then the related trustrelationships should be identified.Firstly, the applicable trust environment(s) associated with the network connection(s) should be identifiedusing the simple list shown below— Low, such as a network with an unknown community of users,— Medium, such as a network with a known community of users and within a closed business community (ofmore than one organization),— High, such as a network with a known community of users solely within the organization.Secondly, the relevant trust environment(s) (from Low, Medium and High) should be related to the applicablenetwork characteristic (public or private) and the type(s) of network connection involved (from 'A' to 'G'), toestablish the trust relationships. This can be accomplished using a matrix similar to that shown in Table 2below.20 © ISO/IEC 2006 - All rights reserved