INTERNATIONAL ISO/IEC STANDARD 18028-1

ISO/IEC18028-1:2006(E)independent of the network's technology or location in the protocol stack. It addresses security concernsrelated to the management, control, and use of network infrastructure, services, and applications, andprovides a comprehensive, top down, end-to-end perspective of network security. The "Reference" securityarchitecture has three architectural components:— Security Dimensions (may also be known as 'Security Control Groups'),— Security Layers (may also be known as 'Network Security Elements'),— Security Planes may also be known as 'Security Domains').Security Dimensions are sets of security controls designed to address a particular aspect of network security.There are eight such sets identified in the "Reference" security architecture, and which extend to applicationsand end user information, for example:— Non-Repudiation,— Data Confidentiality,— Data Integrity,— Availability.In order to provide an end-to-end security solution, the Security Dimensions need to be applied to a hierarchyof network equipment and facility groupings, which are referred to as Security Layers:— Infrastructure Security Layer,— Services Security Layer,— Applications Security Layer.The Security Layers build on one another to provide network based solutions, i.e. the Infrastructure Layerenables the Services Security Layer and the Services Security Layer enables the Applications Security Layer,and identify where security should be addressed in products and solutions by providing a sequentialperspective of network security.The Infrastructure Security Layer consists of the network transmission facilities as well as individual networkparts protected by the mechanisms that are implemented for the Security Dimensions. Examples ofcomponents that belong to the Infrastructure Security Layer are individual routers, switches and servers aswell as the communication links between individual routers, switches and servers.The Services Security Layer addresses the security of services that Service Providers provide to theircustomers. These services range from basic transport and connectivity to service enablers like those that arenecessary for providing Internet access (e.g. authentication, authorization, and accountability services,dynamic host configuration services, domain name services, etc.) to value-added services such as free phoneservice, QoS, VPN, etc.The Applications Security Layer focuses on the security of the network-based applications accessed byService Provider customers. These applications are enabled by network services and include basic filetransport (e.g. FTP) and web browsing applications, fundamental applications such as directory assistance,network-based voice messaging, and e-mail, as well as high-end applications such as customer relationshipmanagement, electronic/mobile commerce, network-based training, video collaboration, etc.The Security Planes are certain types of network activity protected by the mechanisms that are implementedfor the Security Dimensions. The "Reference" security architecture defines three Security Planes to representthe types of protected activities that take place on a network. The Security Planes are the:— Management Plane,— Control Plane,— End-User Plane.28 © ISO/IEC 2006 - All rights reserved