Three parties drive security requirements: customers and subscribers, who must be able to trust the network and its services, including emergency services staying available during a major catastrophe; public authorities, who require security through directives, regulations and laws for availability, fair competition and privacy; and operators and providers, protecting their own operations and business and meeting their duties to customers and the public. Telecommunications organizations should consider six kinds of environmental and operational incident: incidents in interconnected facilities (routers, switches, DNS, relay and network management systems) that spread fast across the network; weaknesses in protocols and topology, made sharper by the convergence of wired and wireless; interruptions to network services, which are expensive in customer relations, revenue and recovery and a national security matter when deliberate; intrusion into management networks to steal service through diagnostics, accounting records, provisioning databases and eavesdropping; internal compromise from wrong or unauthorised changes to management databases and configurations; and malware and DoS/DDoS aimed at end systems or infrastructure. The document serves organizations wanting an ISMS to give interested parties confidence or gain business advantage, users and suppliers of security products for the sector, advisers and trainers, and those responsible for legal and regulatory compliance in every country where they operate or through which traffic passes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.