4 MnF-specific security requirements and related test cases

33.5263GPPRelease 18Security Assurance Specification for Management Function (MnF)TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

4.1 Introduction

4.2 MnF-specific security functional adaptations of requirements and related test cases

4.2.1 Introduction

The present clause contains MnF-specific security functional adaptations of requirements and related test cases.

4.2.2 Security functional requirements on the MnF deriving from 3GPP specifications and related test cases

The requirement and test case in TS 33.117 [3] clause 4.2.2.2.2 apply to the MnF network product class.

The test case can also address the MnF-specific threat "Unprotected Management data during transmission".

Editor’s Note: The exact reference for the threat is tbc and this may depend on the work of SA5 on MSAC in relation to TLS.

4.2.3 Technical Baseline

4.2.3.1 Introduction

The present clause provides baseline technical requirements.

4.2.3.2 Protecting data and information

4.2.3.2.1 Protecting data and information – general

There are no MnF-specific additions to clause 4.2.3.2.1 of TS 33.117 [3].

4.2.3.2.2 Protecting data and information – unauthorized viewing

There are no MnF-specific additions to clause 4.2.3.2.2 of TS 33.117 [3].

4.2.3.2.3 Protecting data and information in storage

There are no MnF-specific additions to clause 4.2.3.2.3 of TS 33.117 [3].

4.2.3.2.4 Protecting data and information in transfer

There are no MnF-specific additions to clause 4.2.3.2.4 of TS 33.117 [3].

4.2.3.2.5 Logging access to personal data

There are no MnF-specific additions to clause 4.2.3.2.5 of TS 33.117 [3].

4.2.3.3 Protecting availability and integrity

4.2.3.3.1 System handling during overload situations

There are no MnF-specific additions to clause 4.2.3.3.1 of TS 33.117 [3].

4.2.3.3.2 Boot from intended memory devices only

There are no MnF-specific additions to clause 4.2.3.3.2 of TS 33.117 [3].

4.2.3.3.3 System handling during excessive overload situations

There are no MnF-specific additions to clause 4.2.3.3.3 of TS 33.117 [3].

4.2.3.3.4 System robustness against unexpected input.

There are no MnF-specific additions to clause 4.2.3.3.4 of TS 33.117 [3].

4.2.3.3.5 Network Product software package integrity

There are no MnF-specific additions to clause 4.2.3.3.5 of TS 33.117 [3].

4.2.3.4 Authentication and authorization

4.2.3.4.1 Authentication policy

4.2.3.4.1.1 System functions shall not be used without successful authentication and authorization.

There are no MnF-specific additions to clause 4.2.3.4.1.1 of TS 33.117 [3].

4.2.3.4.1.2 Accounts shall allow unambiguous identification of the user.

There are no MnF-specific additions to clause 4.2.3.4.1.2 of TS 33.117 [3].

4.2.3.4.2 Authentication attributes

4.2.3.4.2.1 Account protection by at least one authentication attribute.

There are no MnF-specific additions to clause 4.2.3.4.2.1 of TS 33.117 [3].

4.2.3.4.2.2 Predefined accounts shall be deleted or disabled.

There are no MnF-specific additions to clause 4.2.3.4.2.2 of TS 33.117 [3].

4.2.3.4.2.3 Predefined or default authentication attributes shall be deleted or disabled.

There are no MnF-specific additions to clause 4.2.3.4.2.3 of TS 33.117 [3].

4.2.3.4.3 Password policy

4.2.3.4.3.1 Password Structure

There are no MnF-specific additions to clause 4.2.3.4.3.1 of TS 33.117 [3]..

4.2.3.4.3.2 Password changes

There are no MnF-specific additions to clause 4.2.3.4.3.2 of TS 33.117 [3].

4.2.3.4.3.3 Protection against brute force and dictionary attacks

There are no MnF-specific additions to clause 4.2.3.4.3.3 of TS 33.117 [3].

4.2.3.4.3.4 Hiding password display

There are no MnF-specific additions to clause 4.2.3.4.3.4 of TS 33.117 [3].

4.2.3.4.4 Specific Authentication use cases

4.2.3.4.4.1 Network Product Management and Maintenance interfaces

There are no MnF-specific additions to clause 4.2.4.4.1 of TS 33.117 [3].

4.2.3.4.5 Policy regarding consecutive failed login attempts

There are no MnF-specific additions to clause 4.2.3.4.5 of TS 33.117 [3].

4.2.3.4.6 Authorization and access control

4.2.3.4.6.1 Authorization policy

There are no MnF-specific additions to clause 4.2.3.4.6.1 of TS 33.117 [3].

The test case can also address the MnF-specific threat "Over-privileged data process".

4.2.3.4.6.2 Role-based access control

There are no MnF-specific additions to clause 4.2.3.4.6.2 of TS 33.117 [3].

Editor’s Note: This may depend on SA5 work on MSAC.

4.2.3.5 Protecting sessions

4.2.3.5.1 Protecting sessions – logout function

There are no MnF-specific additions to clause 4.2.3.5.1 of TS 33.117 [3].

4.2.3.5.2 Protecting sessions – Inactivity timeout

There are no MnF-specific additions to clause 4.2.3.5.2 of TS 33.117 [3].

4.2.3.6 Logging

4.2.3.6.1 Security event logging

There are no MnF-specific additions to clause 4.2.3.6.1 of TS 33.117 [3].

4.2.3.6.2 Log transfer to centralized storage

There are no MnF-specific additions to clause 4.2.3.6.2 of TS 33.117 [3].

4.2.3.6.3 Protection of security event log files

There are no MnF-specific additions to clause 4.2.3.6.3 of TS 33.117 [3].

4.2.4 Operating systems

There are no MnF-specific additions to clause 4.2.4 of TS 33.117 [3].

4.2.5 Web servers

4.2.5.1 HTTPS

There are no MnF-specific additions to clause 4.2.5.1 of TS 33.117 [3].

4.2.5.2 Logging

There are no MnF-specific additions to clause 4.2.5.2 of TS 33.117 [3].

4.2.5.3 HTTP User sessions

For the requirement defined in clause 4.2.5.3 of TS 33.117[3]:

– The requirement "In addition to the Session Idle Timeout (see clause 4.2.3.5.2 of TS 33.117 [3]), the Network Product shall automatically terminate sessions after a configurable maximum lifetime. This maximum lifetime defines the maximum session span. When the maximum lifetime expires, the session shall be closed, the session ID shall be deleted and the user shall be forced to (re)authenticate in the web application and to establish a new session. The default value for this maximum lifetime shall be set to 8 hours." may not be applicable to the MnF product.

4.2.5.4 HTTP input validation

There are no MnF-specific additions to clause 4.2.5.4 of TS 33.117 [3].

4.2.6 Network devices

4.2.6.1 Protection of data and information

There are no MnF-specific additions to clause 4.2.6.2.1 of TS 33.117 [3].

4.2.6.2 Protecting availability and integrity

4.2.6.2.1 Packet filtering

There are no MnF-specific additions to clause 4.2.6.2.1 of TS 33.117 [3].

4.2.6.2.2 Interface robustness requirements

There are no MnF-specific additions to clause 4.2.6.2.2 of TS 33.117 [3].

4.2.6.2.3 GTP-C Filtering

The requirement and test case in clause 4.2.6.2.3 of TS 33.117 [3] is not applicable to MnF.

4.2.6.2.4 GTP-U Filtering

The requirement and test case in clause 4.2.6.2.4 of TS 33.117 [3] is not applicable to MnF.

4.3 MnF-specific adaptations of hardening requirements and related test cases.

4.3.1 Introduction

The present clause contains MnF-specific adaptations of hardening requirements and related test cases.

4.3.2 Technical Baseline

There are no MnF-specific additions to clause 4.3.2 of TS 33.117 [3].

4.3.3 Operating Systems

4.3.3.1 General operating system requirements and test cases

4.3.3.1.1 IP-Source address spoofing mitigation

There are no MnF-specific additions to clause 4.3.3.1.1 of TS 33.117 [3].

4.3.3.1.2 Minimized kernel network functions

There are no MnF-specific additions to clause 4.3.3.1.2 of TS 33.117 [3].

4.3.3.1.3 No automatic launch of removable media

There are no MnF-specific additions to clause 4.3.3.1.3 of TS 33.117 [3].

4.3.3.1.4 SYN Flood Prevention

There are no MnF-specific additions to clause 4.3.3.1.4 of TS 33.117 [3].

4.3.3.1.5 Protection from buffer overflows

There are no MnF-specific additions to clause 4.3.3.1.5 of TS 33.117 [3].

4.3.3.1.6 External file system mount restrictions

There are no MnF-specific additions to clause 4.3.3.1.6 of TS 33.117 [3].

4.3.4 Web Servers

4.3.4.1 General

There are no MnF-specific additions to clause 4.3.4.1 of TS 33.117 [3].

4.3.4.2 No system privileges for web server

There are no MnF-specific additions to clause 4.3.4.2 of TS 33.117 [3].

4.3.4.3 No unused HTTP methods

TBD

4.3.4.4 No unused add-ons

There are no MnF-specific additions to clause 4.3.4.4 of TS 33.117 [3].

4.3.4.5 No compiler, interpreter, or shell via CGI or other server-side scripting

There are no MnF-specific additions to clause 4.3.4.5 of TS 33.117 [3].

4.3.4.6 No CGI or other scripting for uploads

There are no MnF-specific additions to clause 4.3.4.6 of TS 33.117 [3].

4.3.4.7 No execution of system commands with SSI

There are no MnF-specific additions to clause 4.3.4.7 of TS 33.117 [3].

4.3.4.8 Access rights for web server configuration

There are no MnF-specific additions to clause 4.3.4.8 of TS 33.117 [3].

4.3.4.9 No default content

There are no MnF-specific additions to clause 4.3.4.9 of TS 33.117 [3].

4.3.4.10 No directory listings

TBD

4.3.4.11 Web server information in HTTP headers

TBD

4.3.4.12 Web server information in error pages

There are no MnF-specific additions to clause 4.3.4.12 of TS 33.117 [3].

4.3.4.13 Minimized file type mappings

There are no MnF-specific additions to clause 4.3.4.13 of TS 33.117 [3].

4.3.4.14 Restricted file access

There are no MnF-specific additions to clause 4.3.4.14 of TS 33.117 [3].

4.3.4.15 Execute rights exclusive for CGI/Scripting directory

There are no MnF-specific additions to clause 4.3.4.15 of TS 33.117 [3].

4.3.5 Network Devices

4.3.5.1 Traffic Separation

TBD

4.3.6 Network Functions in service-based architecture

4.3.6.1 Introduction

There are no MnF-specific additions to clause 4.3.6.1 of TS 33.117 [3].

4.3.6.2 No code execution or inclusion of external resources by JSON parsers

TBD

4.3.6.3 Unique key values in IEs

TBD

4.3.6.4 The valid format and range of values for IEs

TBD

4.4 MnF-specific adaptations of basic vulnerability testing requirements and related test cases

There are no MnF-specific additions to clause 4.4 of TS 33.117 [3].