ISO/IEC JTC1 SC 27 (INFORMATION TECHOLOGY SECURITY TECHNIQUES) STANDARDIZATION MEETING; 10-14th 0ctober 2011

1.0  INTRODUCTION

Joint Technical Committee 1 of ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) which is commonly known as JTC 1 is the standards development environment where experts come together to develop worldwide Information and Communication Technologies (ICT) standards for business and consumer applications.

JTC1 SC27 is the subcommittee under JTC1 which develops standards for the protection of information and ICT including generic methods, techniques and guidelines to address both security and privacy aspects, such as

• Security requirements capture methodology;
• Management of information and ICT security; in particular information security management systems (ISMS), security processes, security controls and services;
• Cryptographic and other security mechanisms, including but not limited to mechanisms for protecting the accountability, availability, integrity and confidentiality of information;
• Security management support documentation including terminology, guidelines as well as procedures for the registration of security components;
• Security aspects of identity management, biometrics and privacy;
• Conformance assessment, accreditation and auditing requirements in the area of information security;
• Security evaluation criteria and methodology.

ISO/IEC JTC 1 SC 27 - IT SECURITY TECHNIQUES

ISO (the International Organization for Standardization) and IEC (International Electrotechnical Commission) form the specialized system for worldwide standardization. National Bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, government and non-governmental, in liaison with ISO and IEC, also take part in the work.
In the field of information technology, ISO and IEC have established a Joint Technical Committee 1: ISO/IEC JTC 1. Draft International Standards adopted by the joint technical committees are circulated to the national bodies for voting. Publication as an International Standard requires approval by at least 75% of the national bodies casting a vote.

Area of Work
ISO/IEC JTC 1 SC 27 is a subcommittee of this joint technical committee. Its title is "Security techniques". Its area of work is standardization of generic methods and techniques for IT Security. This includes:

• identification of generic requirements (including requirements methodology)for IT system security services,
• development of security techniques and mechanisms (including registration procedures and relationships of security components),
• development of security guidelines (e.g., interpretative documents ,risk analysis), and
• development of management support documentation and standards(e.g., terminology and security evaluation criteria).

Excluded is:

• the embedding of mechanisms in applications.

Note: The SC 27 Scope and Area of Work includes the standardization of cryptographic algorithms for integrity, authentication and non-repudiation services. Furthermore it includes the standardization of cryptographic algorithms for confidentiality services for use in accordance with internationally accepted policies.

Structure

Current activities of SC 27 are divided into five working groups: 

• Working Group 1:Information security management systems
• Working Group 2: Cryptography and security mechanisms
• Working Group 3: Security evaluation criteria
• Working Group 4: Security controls and services
• Working Group 5: Identity management and privacy technologies

Kenya has what is referred to as the mirror committee of ISO/IEC JTC 1/SC 27 (KEBS TC93) with its Secretariat at the Kenya Bureau of Standards (KEBS). This mirror committee is composed of professionals from different sectors of the economy and work within the scope of SC27 including its five working groups and directly participates in the work of SC27.
To obtain the International Standards adopted by KEBS TC93 or participate in its work, please contact Mr. Amos Wambua (wambua@kebs.org) who is its Secretary.

ISO/IEC JTC1 SC 27 WG 1

Information security management systems 

The Terms of Reference of this working group are:
The scope of WG1 covers the development of ISMS (Information Security Management System) standards and guidelines. This includes:

1. Development and maintenance of the ISO/IEC 27000 ISMS standards family
2. Identification of requirements for future ISMS standards and guidelines
3. On-going maintenance of WG1 standing document SD WG1/1 (WG1 Roadmap)
4. Collaboration with other Working Groups in SC 27, in particular with WG4 on standards addressing the implementation of control objectives and controls as defined in ISO/IEC 27001.

Liaison and collaboration with those organizations and committees dealing with specific requirements and guidelines for ISMS, for example:

• ITU-T Telecoms
• ISO/TC 215 Healthcare
• ISO/TC 68 Banking
• ISO/TC 204 Intelligent transport systems
• ISO/TC 223 Civil defense
• ISSEA
• Aerospace
• Automotive industry
• Standards bodies, such as IETF, IEEE
• International institutions, e.g. OECD, APEC, EU
• IAF and CASCO, and other relevant groups regarding the development of accreditation and certification standards and guidelines

ISO/IEC JTC1 SC 27 WG 2

Cryptography and security mechanisms 

The terms of reference of this working group are:
WG 2 provides a center of expertise for the standardization of IT Security techniques and mechanisms within JTC 1.

Terms of Reference:

• identify the need and requirements for these techniques and mechanisms in IT systems and applications;
• develop terminology, general models and standards for these techniques and mechanisms for use in security services.

The scope covers both cryptographic and non-cryptographic techniques and mechanisms including:

• confidentiality;
• entity authentication;
• non-repudation;
• key management;
• data integrity such as
• message authentication;
• hash-functions;
• digital signatures.

The mechanisms in general include several options with respect to the techniques used including symmetric cryptographic, asymmetric cryptographic and non-cryptographic.

ISO/IEC JTC 1/SC 27 WG 3
Security evaluation criteria

The terms of reference of this working group are:
Standards for IT Security evaluation and certification of IT systems, components, and products. This will include consideration of computer networks, distributed systems, associated application services, etc.
Three aspects may be distinguished: 

• evaluation criteria;
• methodology for application of the criteria;
• administrative procedures for evaluation, certification, and accreditation schemes.

This work will reflect the needs of relevant sectors in society, as represented through ISO/IEC national Bodies and other organisations in liaison, expressed in standards for security functionality and assurance.
Account will be taken of related ISO/IEC and ISO standards for quality management and testing so as not duplicate these efforts.

ISO/IEC JTC 1/SC 27 WG 4
Security controls and services

The terms of reference of this working group are:
The scope of WG4 covers the development and maintenance of standards and guidelines addressing services and applications supporting the implementation of control objectives and controls as defined in ISO/IEC 27001.

This includes:

• Current SC 27 projects:
• IT Network security (ISO/IEC 18028)
• Information security incident management (ISO/IEC TR 18044)
• Guidelines for information and communications technology disaster recovery services (ISO/IEC 24762)
• Selection, deployment and operation of Intrusion Detection Systems (IDS) (ISO/IEC 18043)
• Guidelines on use and management of Trusted Third Party services (ITU-T X.842 I  ISO/IEC TR 14516)
• Specification of TTP services to support the application of digital signatures (ITU-T X.843 I ISO/IEC 15945)
• Security information objects for access control (ITU-T X.841 I ISO/IEC 15816)
• Identification of requirements for and development of future service and applications standards and guidelines, for example in the areas of
  • Business Continuity
  • Cyber Security
  • Outsourcing
• On-going maintenance of WG4 standing document SD WG4/1 (WG4 Road Map)
• Collaboration with other Working Groups in SC 27, in particular with WG1 on ISMS standards and guidelines
• Liaison and collaboration with those organizations and committees dealing with specific requirements and guidelines for services and applications, for example:
  • ITU-T Telecoms
  • ISO/TC 215 Health informatics
  • ISO/TC 68 Banking
  • ISSEA
  • Aerospace
  • Automotive industry
  • Standards bodies, such as IETF, IEEE
  • International institutions, e.g. OECD, APEC, EU
  • IAF and CASCO, and other relevant groups regarding the development of accreditation and certification standards and guidelines

ISO/IEC JTC 1/SC 27 WG 5
Identity management and privacy technologies

The terms of reference of this working group are:
The scope of SC27/WG 5 covers the development and maintenance of standards and guidelines addressing security aspects of identity management, biometrics and the protection of personal data.

This includes:

• Current SC 27 projects:
  • Framework for Identity Management (ISO/IEC 24760)
  • Biometric template protection (ISO/IEC 24745)
  • Authentication context for biometrics (ISO/IEC 24761)
• Identification of requirements for and development of future standards and guidelines in these areas.  For example in the area of Identity Management, topics such as
  • Role based access control
  • Provisioning
  • Identifiers
  • Single sign-on

In the area of Privacy, topics such as

• A Privacy Framework
• A Privacy Reference Architecture
• Privacy infrastructures
• Anonymity and credentials
• Specific Privacy Enhancing Technologies (PETs)
• Privacy Engineering

In the area of Biometrics, topics such as

• Protection of biometric data 
• Authentication technique
  
  
• Collaboration with other Working Groups in SC 27, e.g., WG1 on management aspects, WG 2 on specific cryptographic techniques and WG 3 on evaluation aspects.
• Liaison and collaboration with those organizations and committees dealing with specific requirements and guidelines for services and applications in this area, for example:
• ISO/IEC SC 37 Biometrics
• ECRYPT
• ISO TC68/SC2 Financial Services Security
• ISO TC68/SC6/WG10 Financial Services-Retail Financial Services-Privacy
• ITU-T SG17 (Security, languages and telecommunication software)
• FIDIS (Future of Identity in the Information Society)
• The International Conference of Data Protection and Privacy Commissioners
• The Open Group (IdM Forum and Jericho Forum)