|
Work item:
|
X.SecaaS
|
|
Subject/title:
|
Security threats to be identified in the domain of security as a service
|
|
Status:
|
Under study
|
|
Approval process:
|
AAP
|
|
Type of work item:
|
Recommendation
|
|
Version:
|
New
|
|
Equivalent number:
|
-
|
|
Timing:
|
2025-03 (Medium priority)
|
|
Liaison:
|
ITU-T SG13, CSA, ISO
|
|
Supporting members:
|
China Telecom, China Unicom, ZTE
|
|
Summary:
|
Security as a service (SecaaS) is a cloud service category in which the capabilities provided to the cloud service customer are the integration of a suite of security services with the existing operating environment. During the development, delivery, use and support of SecaaS, there will be security challenges such as data eavesdropped, modified, tampered during transfer, unauthorized access to CSC’s data stored at CSP, unwanted connections between different CSC’s networks, uncontrolled service agents, API related attacks etc.
To ensure the security of security as a service, the security threats need to be specified. This Recommendation will follow the structure of security requirements for virtualized services defined in Technical Report ITU-T xSTR-XAASL. Security threats in the domain of SecaaS will be identified at least in the following areas: architecture, identity and access management, software isolation and API related issues, isolation of instances, data protection, availability, incident response, management, orchestration and deployment.
Therefore, this Recommendation provides the overview of security as a service and security threats in the domain of security as a service.
|
|
Comment:
|
-
|
|
Reference(s):
|
|
|
Historic references:
|
|
Contact(s):
|
|
| ITU-T A.5 justification(s): |
|
|
|
|
First registration in the WP:
2023-03-06 08:59:00
|
|
Last update:
2023-09-20 23:19:18
|
|
