Difference between revisions of "IoTSec:Security and Privacy Functionality"

From its-wiki.no

Jump to: navigation, search
(Security, Privacy and Dependability Functionality)
 
(16 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
= Security, Privacy and Dependability Functionality =
 
= Security, Privacy and Dependability Functionality =
This page has the keywords: [[has Keywords:: Security, Privacy, Dependability, Security functionality]]
+
{{hasKeywords
 +
|Keywords=Security, Privacy, Dependability, Security Functionality}}
 +
The starting point for the security listing is the representation of [[System of Systems]] through the [[Multi-Metrics analysis]]. Applications running on the systems typically have functional and non-functional requirements, which also addresses security and privacy requirements. 
  
The page is exported from see [[File:SPD_Functionality.doc]]  
+
The security functionality is available:
 +
* as [https://webprotege.stanford.edu/#projects/f3ce3328-fe4a-406b-a3ea-7908666c7642 ontology through WebProtege (login required)] in
 +
*  [[Media:IoT_SecPrivFunc_LifeMap_v2.pdf|IoT Security and Privacy Functionality Life Map (.pdf)]]
 +
[[File:IoT_Security_and_Privacy_Functionality.png|600px|Security, privacy and dependability functionality (Orig:Owncloud)]]<br/>
 +
Link: owncloud = IoTSec-IKTPluss =  IoT_SecPrivFunc_LifeMap_v2.xmind
  
[[File:Security-Privacy-Dependability_Functionality.png|900px|Security, privacy and dependability functionality (Orig:Owncloud)]]
+
[[File:Operations_Security.png|800px]]
  
1. security management
+
[[File:Dev_Maint_Audit_Security.png|800px]]
:1.1. Intrusion detection system
+
::1.1.1. Intrusion prevention
+
::1.1.2. Monitoring, Log handling
+
:: 1.1.3. Auditing
+
  
:1.2. Policy
+
[[File:Decommissioning_Security.png|600px]]
:: 1.2.1. Time-out
+
:: 1.2.2. Data-rate
+
::1.2.3. Backup
+
::1.2.4. Update
+
::1.2.5. Encryption
+
:1.3. user data protection
+
  
:1.4. physical security
+
[[File:Security_Mechanisms.png|800px]]
::1.4.1. Physical authentication
+
::1.4.2. Physical DoS protection
+
  
:1.5. certificate handling
+
[[File:Human_Resource_Security.png|800px]]
:: 1.5.1. digital signature
+
  
:1.6. accountability
+
[[File:Physical_Environmental_Security.png|800px]]
::1.6.1. non-repudiation
+
  
2. hardening
+
[[File:Privacy_Protection.png|800px]]
:2.1. PC hardening
+
:: 2.1.1. Patch Windows/Mac automatically
+
::2.1.2. Strong passwords/ pass phrases
+
:::disable unused
+
:::user accounts
+
::2.1.3. Anti virus/Anit spyware
+
::2.1.4. Firewall
+
::2.1.5. Do not open
+
:::suspicious email
+
:::free software (handle with care)
+
::2.1.6. Disable file/ printer sharing
+
::2.1.7. Lock PC when away
+
:2.2. IoT hardening
+
  
:2.3. Protection against
 
::2.3.1. Electromagnetic interference (EMI)
 
::2.3.2. Electromagnetic Pulse (EMP)
 
  
3. access control
+
== Security and Privacy Functionality paragraphs ==
:3.1. remote access
+
*  [[Media:IoT_SecPrivFunc_LifeMap_v2.pdf|IoT Security and Privacy Functionality Life Map (.pdf)]]
:3.2. Service access control (Firewall)
+
:3.3. identification
+
:3.4. authentication
+
::3.4.1. Password-based  authentication
+
:: 3.4.2. Biometric authentication
+
::3.4.3. Card or Device
+
authentication
+
3.4.4. Digital signature
+
authentication
+
3.5. authorization
+
4. secured communication
+
  
4.1. trusted path (tunnel, VPN)
+
== Related Standards ==
4.2. session encryption
+
4.3. mutual authentication
+
5. resource managgement
+
  
5.1. upgradability
+
* ISO 27000: Overview and Vocabulary (2014)
 +
* ''Seraj'' ISO 27001: ISMS Requirements (2013)
 +
* ''Toktam'' ISO 27002: Code of Practice (2013)
 +
* ''Elahe'' ISO 27003: ISMS Implementation Guidance (2010)
  
5.1.1. security updates
+
5.2. resource utilization
+
* ''Seraj'' ISO 27004: ISM Measurement (2009)
 +
* ''Toktam'' ISO 27005: InfoSec Risk Management (2011)
 +
* ''Elahe'' ISO 27006: Requirements for Bodies Providing Audit and Certification of ISMS (2011)
  
5.2.1. least privilege
+
* ''Seraj'' ISO 27007 – 27008: Guidelines for Auditing InfoSec Controls (2011)
5.3. sec/priv configurability
+
* ''Toktam'' ISO 27014: Governance of InfoSec (2013)
 +
* ''Elahe'' ISO 27015: ISM Guidelines for Financial Services (2012) ‐ http://www.iso.org
  
5.3.1. transparency
+
* ISO 31000 - Risk management
5.4. redundancy
+
 
+
5.4.1. continuity
+
5.5. Secure boot
+
5.6. Protection
+
 
+
5.6.1. Memory
+
5.6.2. Integrity
+
5.7. Root of trust
+
5.8. Protection against
+
 
+
5.8.1. Denial of Service (DoS)
+
5.8.2. Anti-reply
+
5.8.3. Traffic analysis
+

Latest revision as of 00:39, 6 February 2020

Security in IoT for Smart Grids
Home Research Security Centre Publications Student corner About
English-Language-icon.png

Security, Privacy and Dependability Functionality

Keywords: Security, Privacy, Dependability, Security Functionality

The starting point for the security listing is the representation of System of Systems through the Multi-Metrics analysis. Applications running on the systems typically have functional and non-functional requirements, which also addresses security and privacy requirements.

The security functionality is available:

Security, privacy and dependability functionality (Orig:Owncloud)
Link: owncloud = IoTSec-IKTPluss = IoT_SecPrivFunc_LifeMap_v2.xmind

Operations Security.png

Dev Maint Audit Security.png

Decommissioning Security.png

Security Mechanisms.png

Human Resource Security.png

Physical Environmental Security.png

Privacy Protection.png


Security and Privacy Functionality paragraphs

Related Standards

  • ISO 27000: Overview and Vocabulary (2014)
  • Seraj ISO 27001: ISMS Requirements (2013)
  • Toktam ISO 27002: Code of Practice (2013)
  • Elahe ISO 27003: ISMS Implementation Guidance (2010)


  • Seraj ISO 27004: ISM Measurement (2009)
  • Toktam ISO 27005: InfoSec Risk Management (2011)
  • Elahe ISO 27006: Requirements for Bodies Providing Audit and Certification of ISMS (2011)
  • Seraj ISO 27007 – 27008: Guidelines for Auditing InfoSec Controls (2011)
  • Toktam ISO 27014: Governance of InfoSec (2013)
  • Elahe ISO 27015: ISM Guidelines for Financial Services (2012) ‐ http://www.iso.org
  • ISO 31000 - Risk management