Chapter 7 Outline

I.    PKIX/PKCS
A.  There are two main standards that help implement PKI on a practical level on the Internet. Both are based on the X.509 certificate standard and establish complimentary standards for implementing PKI. Public Key Infrastructure X.509 (PKIX) and Public Key Cryptography Standards (PKCS) intertwine to define the most commonly used set of standards.
1.      PKIX was produced by the Internet Engineering Task Force (IETF). It defines standards for interactions and operations for the four component types - the user (end-entity), certificate authority (CA), registration authority (RA), and the repository for certificates and certificate revocation lists (CRLs).
2.      PKCS, a product of RSA Security, defines many of the lower-level standards for message syntax and cryptographic algorithms.
B.  The PKIX working group was formed in 1995 to develop the standards necessary to support PKIs. At the time, the X.509 Public Key Certificate (PKC) format was proposed as the basis for a PKI.
1.      X.509 includes information regarding data formats and procedures used for CA-signed PKCs, but it does not specify values or formats for many of the fields within the PKC.
2.      PKIX provides standards for extending and using X.509 v3 certificates and for managing them, enabling interoperability between PKIs following the standards.
3.      PKIX uses the model shown in Figure 7-2 for representing the components and users of a PKI.

Figure 7-2: The PKIX model
a)    The user, called an end-entity, is not part of the PKI, but they are either users of the PKI certificates, the subject of a certificate (an entity identified by it), or both.
b)    The certificate authority (CA) is responsible for issuing, storing, and revoking certificates—both Public Key Certificates (PKCs) and Attribute Certificates.
c)    The registration authority (RA) is responsible for management activities designated by the CA. The RA may, in fact, be a component of the CA rather than a separate component.
d)    The final component of the PKIX model is a repository, system, or group of distributed systems that provide certificates and CRLs to the end-entities.
C.  PKIX standards.
1.      Using X.509 v3, there are five major areas that the PKIX working group addresses:
a)         PKIX outlines certificate extensions and content not covered by X.509 v3 and the format of version 2 CRLs thus providing compatibility standards for sharing certificates and CRLs between CAs and end-entities in different PKIs.
(1)        The PKIX profile of the X.509 v3 PKC describes the contents, required extensions, optional extensions, and extensions that need not be implemented.
(2)        The PKIX profile suggests a range of values for many extensions. In addition, it provides a profile for version 2 CRLs, allowing different PKIs to share revocation information.
b)         PKIX provides certificate management message formats and protocols, defining the data structures, management messages, and management functions for PKIs.
(1)        This standard identifies the protocols necessary to support online interactions between entities in the PKIX model.
(2)        The management protocols support functions for entity registration, initialization of the certificate (possibly key pair generation), issuance of the certificate, key pair update, certificate revocation, cross-certification (between CAs), and key pair recovery if available.
c)         PKIX outlines certificate policies and certification practices statements (CPSs), establishing the relationship between policies and CPSs.
(1)        A policy is a set of rules that determines the applicability of a certificate to an end-entity.
(2)        A CPS explains the practices used by a CA to issue certificates. In other words, the CPS is the method used to get the certificate, while the policy defines some characteristics of the certificate and how it will be handled and used.
d)         PKIX specifies operational protocols, defining the protocols for certificate handling. In particular, there are protocol definitions for using Lightweight Directory Access Protocol version 2 (LDAP v2), File Transfer Protocol (FTP), and Hypertext Transfer Protocol (HTTP) to retrieve certificates from repositories. These are the most common protocols used by applications when retrieving certificates.
e)         PKIX includes time-stamping, data certification, and validation services.
(1)        A time stamp authority (TSA) certifies that a particular entity existed at a particular time.
(2)        A Data Validation and Certification Server certifies the validity of signed documents, PKCs, and the possession or existence of data.
(3)        These capabilities support nonrepudiation requirements and are considered building blocks for a nonrepudiation service.
2.      PKCs are the most commonly used certificates, but the PKIX working group has also been working on Attribute Certificates (AC) and Qualified Certificates (QC).
a)         An AC is used to grant permissions using rule-based, role-based, and rank-based access controls.
(1)        ACs are used to implement a privilege management infrastructure (PMI). In a PMI, an entity (user, program, or system) is typically identified as a client to a server using a PKC.
(2)        The identified client pushes an AC to the server, or the server can query a trusted repository to retrieve the attributes of the client.
(3)        The client push of the AC results in improved performance, but there is no independent verification by the server of the client's permissions.
(4)        An alternative is to have the server pull the information from an AC issuer or a repository. This method is preferable from a security standpoint, because the server or server's domain determines the client's access rights.
(5)        The benefit of the pull method is that it does not require any changes to the client software.
b)         The QC is based on the term used within the European Commission to identify certificates with specific legislative uses. This concept is generalized in the PKIX QC profile to indicate a certificate used to identify a specific individual (a single human rather than the entity of the PKC) with a high level of assurance in a nonrepudiation service.
D.  PKCS.
1.      PKCS is currently composed of a set of 13 active standards along with 2 other inactive standards.
2.      The standards are referred to as PKCS #1 through PKCS #15.
3.      The standards combine to establish a common base for services required in a PKI.
E.   Why you need to know.
1.      When an organization plans to implement a private PKI to support secure services, it is important to identify the standards that are already in use. It is also important to identify how the decision to use a particular PKI implementation (domestic or commercial) may lead to incompatibilities with other certificate-issuing entities.
2.      Business-to-business requirements must be taken into account when deciding how to implement a PKI within an organization.
II.  X.509
A.  X.509 is the portion of the X.500 standard that addresses the structure of certificates used for authentication.
B.  X.500 OSI Directory Standard was developed for implementing a network directory system, and part of this directory standard was the concept of authentication of entities within the directory.
C.  There have been several versions of the certificates and each version has extended the contents of the certificates to include additional information necessary to use certificates in a PKI.
1.      The 1988 certificate format, version 1, was revised in 1993 as the ITU-T X.509 definition. In this definition, two more fields were added to support directory access control.
2.      The 1993 version 2 specification was revised following lessons learned from implementing Internet Privacy Enhanced Mail (PEM).
3.      Version 3 added optional extensions for more subject identification information, key attribute information, policy information, and certification path constraints. It also allowed additional extensions to be defined in standards or to be defined and registered by organizations or communities.
D.  Certificates are used to encapsulate the information needed to authenticate an entity.
1.      The X.509 specification defines a hierarchical certification structure, which relies on a root certification authority that is self-certifying (meaning it issues its own certificate).
2.      All other certificates can be traced back to such a root through a path.
3.      A certificate authority issues a certificate to a uniquely identifiable entity (person, corporation, or computer).
III. SSL/TLS
A.  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) provide the most common means of interacting with a PKI and certificates.
B.  The older SSL protocol was introduced by Netscape as a means of providing secure connections for Web transfers using encryption.
C.  These two protocols provide secure connections between the client and the server for exchanging information. They also provide server authentication (and optionally, client authentication) and confidentiality of information transfers.
D.  TLS is a protocol that ensures privacy between communicating applications and their users on the Internet.
1.      When a server and a client communicate, TLS ensures that no third party may eavesdrop or tamper with any message.
2.      TLS is composed of the TLS Record Protocol and the TLS Handshake Protocol.
a)         The TLS Record Protocol provides connection security by using supported encryption methods, such as the Data Encryption Standard (DES). The TLS Record Protocol can also be used without encryption.
b)         The TLS Handshake Protocol allows the server and the client to authenticate each other and to negotiate a session encryption algorithm and cryptographic keys before data is exchanged.
3.      Though TLS is based on SSL and is sometimes referred to as SSL, they are not interoperable. However, the TLS protocol contains a mechanism that allows a TLS implementation to back down to SSL 3.0. The difference between the two is in the way they perform key expansion and message authentication computations.
a)         TLS uses the MD5 and SHA1 hashing algorithms XORed together to determine the session key.
b)         Though SSL also uses both hashing algorithms, SSL is considered less secure because the way it uses them forces a reliance on MD5 rather than SHA1.
4.      The TLS Record Protocol is a layered protocol.
a)         At each layer, messages may include fields for length, description, and content.
b)         The Record Protocol takes messages to be transmitted, fragments the data into manageable blocks, optionally compresses the data, applies a message authentication code (MAC) to the data, encrypts it, and transmits the result.
c)         Received data is decrypted, verified, decompressed, and reassembled, and then delivered to higher-level clients.
5.      The TLS Handshake Protocol involves the following steps:
a)         Exchange hello messages to agree on algorithms, exchange random values, and check for session resumption.
b)         Exchange the necessary cryptographic parameters to allow the client and the server to agree on a pre-master secret.
c)         Exchange certificates and cryptographic information to allow the client and the server to authenticate them.
d)         Generate a master secret from the pre-master secret and exchanged random values.
e)         Provide security parameters to the record layer.
f)         Allow the client and the server to verify that their peer has calculated the same security parameters and that the handshake occurred without tampering by an attacker.
6.      Though it has been designed to minimize this risk, TLS still has potential vulnerabilities to a man-in-the-middle attack. A highly skilled and well-placed attacker can force TLS to operate at lower security levels.
7.      Once established, a TLS session remains active as long as data is being exchanged. If sufficient inactive time has elapsed for the secure connection to time out, it can be reinitiated.
IV. ISAKMP
A.  The Internet Security Association and Key Management Protocol (ISAKMP) provides a method for implementing a key exchange protocol and for negotiating a security policy.
1.      It defines procedures and packet formats to negotiate, establish, modify, and delete security associates.
2.      Being a framework, it does not define implementation-specific protocols, such as the key exchange protocol or hash functions.
B.  A security association (SA) is a relationship where two or more entities define how they will communicate securely.
1.      ISAKMP supports security associations at all layers of the network stack. It can be implemented on the transport level using TCP or UDP, or it can be implemented on IP directly.
2.      Negotiation of a security association between servers occurs in two stages.
a)         First, the entities agree on how to secure negotiation messages (the ISAKMP SA).
b)         Once the entities have secured their negotiation traffic, they determine the security associations for the protocols used for the remainder of their communications.
c)         Figure 7-5 shows the structure of the ISAKMP header, which is used during both parts of the ISAKMP negotiation.

Figure 7-5: ISAKMP header format
(1)        The initiator cookie is set by the entity requesting the SA, and the responder sets the responder cookie.
(2)        The payload byte indicates the type of the first payload.
(3)        Payload types include security associations, proposals, key transforms, key exchanges, and vendor identities.
(4)        The major and minor revision fields refer to the major version number and minor version number for the ISAKMP protocol.
(5)        The exchange type helps determine the order of messages and payloads.
(6)        The flag bits indicate options for the ISAKMP exchange, including whether the payload is encrypted, whether the initiator and responder have “committed” to the SA, and whether the packet is to be authenticated only (and is not encrypted).
(7)        The final fields of the ISAKMP header indicate the message identifier and a message length.
d)         Payloads encapsulated within ISAKMP use a generic header, and each payload has its own header format.
C.  Once the ISAKMP SA is established, multiple protocol SAs can be established using the single ISAKMP SA.
D.  SAs are valid for specific periods of time, and once the time expires, the SA must be renegotiated.
V.  CMP
A.  The PKIX Certificate Management Protocol (CMP) defines the messages and operations required to provide certificate management services within the PKIX model.
B.  Though part of the IETF PKIX effort, CMP provides a framework that works with other standards, such as PKCS #7 and PKCS #10. CMP provides for the following certificate operations:
1.      CA establishment, including creation of the initial CRL and export of the public key for the CA.
2.      Certification of an end-entity, including the following:
a)         Initial registration and certification of the end-entity (registration, certificate issuance, and placement of the certificate in a repository).
b)         Updates to the key pair for end-entities, required periodically and when a key pair is compromised or keys cannot be recovered.
c)         End-entity certificate updates, required when a certificate expires.
d)         Periodic CA key pair update, similar to end-entity key pair updates.
e)         Cross-certification requests, placed by other CAs.
f)         Certificate and CRL publication, performed under the appropriate conditions of certificate issuance and certificate revocation.
g)         Key pair recovery, a service to restore key pair information for an end-entity. For example, if a certificate password is lost or the certificate file is lost.
h)         Revocation requests, supporting requests by authorized entities to revoke a certificate.
3.      CMP also defines mechanisms for performing these operations, either online or offline using files, e-mail, tokens, or Web operations.
VI. XKMS
A.  The XML Key Management Specification (XKMS) defines services to manage PKI operations within the Extensible Markup Language (XML) environment.
1.      These services are provided for handling PKI keys and certificates automatically.
2.      XKMS responds to problems of authentication and verification of electronic signatures and allows certificates to be managed, registered, or revoked.
B.  XKMS services reside on a separate server that interacts with an established PKI.
1.      The services are accessible via a simple XML protocol.
2.      The services provide for retrieving key information (owner, key value, any key issuer) and key registration and management (such as key registration and revocation).
C.  Retrieval operations rely on the XML signature for the necessary information.
1.      There are three tiers of services based on the client requests and the application requirements.
a)         Tier 0 provides a means of retrieving key information by embedding references to the key within the XML signature.
(1)        The signature contains an element called a RetrievalMethod that indicates ways to resolve the key.
(2)        In this case, the client sends a request, using the retrieval method, to obtain the desired key information.
(3)        The server indicated in the retrieval method responds directly to the request for the key, possibly bypassing the XKMS server.
b)         With tier 1 operations, the client forwards the key information portions of the XML signature to the XKMS server, relying on the server to perform the retrieval of the desired key information.
(1)        The desired information may be local to the XKMS sever or it may reside on an external PKI system.
(2)        The XKMS server provides no additional validation of the key information, such as checking to see if the certificate has been revoked and is still valid.
(3)        Tier 1 is called the locate service because it locates the appropriate key information for the client.
c)         Tier 2 is called the validate service.
(1)        In this case, just as in tier 1, the client relies on the XKMS server to retrieve the relevant key information from the external PKI.
(2)        The XKMS server also performs a data validation on a portion of the key information provided by the client for this purpose.
(3)        This validation verifies the binding of the key information with the data indicated by the key information contained in the XML signature.
d)         The primary difference between tier 1 and tier 2 is the level of involvement of the XKMS server.
(1)        In tier 1, it may serve only as a relay or gateway between the client and the PKI.
(2)        In tier 2, the XKMS server is actively involved in verifying the relation between the PKI information and the document containing the XML signature.
D.  XKMS relies on the client or underlying communications mechanism to provide for secure communications with the XKMS server.
1.      The specification suggests using one of the three methods for ensuring server authentication, response integrity, and relevance of the response to the request.
2.      The three methods are digitally signed correspondence, a transport layer security protocol (such as SSL, TLS, or WTLS), or a packet layer security protocol (such as IPSec).
E.   It is possible to define other tiers of services. Tiers 3 and 4, an assertion service and an assertion status service, respectively, are mentioned in the defining XKMS specification, but are not defined.
F.   XKMS also provides services for key registration, key revocation, and key recovery. Authentication for these actions is based on a password or passphrase, which is provided when the keys are registered and when they must be recovered.
VII.     S/MIME
A.  The Secure/Multipurpose Internet Mail Extensions (S/MIME) message specification is an extension to the MIME standard that provides a way to send and receive signed and encrypted MIME data.
B.  The standard relies on more one standard. The key amongst these is the format of a public key certificate as expressed in the X.509 standard.
C.  For different implementations of the S/MIME v3 set of specifications to be interoperable, a minimum set of cryptographic algorithms were mandated.
1.      This minimum set must be implemented in an application for it to be considered S/MIME-compliant.
2.      Applications can implement additional cryptographic algorithms to meet customer needs, but the minimum set must also be present in the application for interoperability with other S/MIME applications. Therefore, users are not forced to use S/MIME specified algorithms, they can choose their own, but if the application is to be considered S/MIME-compliant, the standard algorithms must also be present.
D.  IETF S/MIME v3 Specifications
1.      The current IETF S/MIME v3 set of specifications includes:
a)         Cryptographic Message Syntax (CMS)
b)         S/MIME version 3 message specification
c)         S/MIME version 3 certificate-handling specification
d)         Enhanced security services (ESS) for S/MIME
2.      CMS defines a standard syntax for transmitting cryptographic information about contents of a protected message.
3.      Integrity, authentication, and nonrepudiation security features are provided using digital signatures utilizing the SignedData syntax described by the CMS.
4.      CMS also describes the EnvelopedData syntax to provide confidentiality of the message's content through the use of encryption.
a)         The PKCS #7 specification supports key encryption algorithms, such as RSA. Algorithm independence is promoted through the addition of several fields to the EnvelopedData syntax in CMS, which is the major difference between the PKCS #7 and CMS specifications. The goal was to support specific algorithms such as Diffie-Hellman and the Key Exchange Algorithm (KEA) which is implemented on the Fortezza Crypto Card developed for the DoD.
b)         One final significant change to the original specifications is the capability to include X.509 ACs in the SignedData and EnvelopedData syntaxes for CMS.
5.      CMS Triple Encapsulated Message
a)         An interesting feature of CMS is the ability to nest security envelopes to provide a combination of security features.
(1)        A CMS triple-encapsulated message can be created in which the original content and the associated attributes are signed and encapsulated within the inner SignedData object.
(2)        The inner SignedData is in turn encrypted and encapsulated within an EnvelopedData object.
(3)        The resulting EnvelopedData object is then also signed and finally encapsulated within a second SignedData object, the outer SignedData object.
(4)        Usually, the inner SignedData object is signed by the original user and the outer SignedData is signed by another entity such as a firewall or a mail list agent providing an additional level of security.
b)         Triple-encapsulation is not required of every CMS object. All that is required is a single SignedData object created by the user to sign a message or an EnvelopedData object if the user desired to encrypt a message.
VIII.   PGP
A.  Pretty Good Privacy (PGP) provides the ability to sign a message digitally so the receiver can be certain of the sender's identity. Taken together, encrypting and signing a message, the receiver can be positive of who sent it and can be assured that it was not modified during transmission.
B.  How it works.
1.      PGP uses a variation of the standard public key encryption process.
a)         In public key encryption, the user (utilizing the encryption program) creates a pair of keys.
b)         One key is known as the public key and is designed to be given freely to others.
c)         The other key is called the private key and is designed to be known only to the creator.
d)         Individuals wishing to send a private message to the user will encrypt the message using the user's public key.
e)         The algorithm is designed such that only the private key can decrypt the message. Therefore, only the user will be able to decrypt it.
f)         The method, known as public key or asymmetric encryption, is time consuming. Symmetric encryption which uses only a single key is generally faster.
2.      PGP uses a symmetric encryption algorithm to encrypt the message to be sent.
a)         It then encrypts the symmetric key used to encrypt this message with the public key of the intended recipient.
b)         Both the encrypted key and the message are then sent.
c)         The receiver's version of PGP first decrypts the symmetric key with the private key supplied by the recipient and then uses the resulting decrypted key to decrypt the rest of the message.
3.      PGP can utilize two different public key algorithms—Rivest-Shamir-Adleman (RSA) or Diffie-Hellman.
a)         The RSA version uses the IDEA algorithm to generate a short symmetric key to be used to encrypt the message and RSA to encrypt the short IDEA key.
b)         The Diffie-Hellman version uses the CAST algorithm to encrypt the message and the Diffie-Hellman algorithm to encrypt the CAST key.
4.      To generate a digital signature, PGP takes advantage of another property of public key encryption schemes.
a)         Normally, the sender encrypts using the receiver's public key and the message is decrypted at the other end using the receiver's private key.
b)         The process can be reversed such that the sender encrypts with his own private key.
c)         The receiver then decrypts the message with the sender's public key.
d)         Since the sender is the only individual who has a key that will correctly be decrypted with the sender's public key, the receiver knows that the message was created by the sender who claims to have sent it.
e)         PGP accomplishes this task by generating a hash value from the user's name and other signature information.
(1)        This hash value is then encrypted with the sender's private key known only by the sender.
(2)        The receiver uses the sender's public key, which is available to everyone, to decrypt the hash value.
(3)        If the decrypted hash value matches the hash value sent as the digital signature for the message, the receiver is assured that the message was sent by the sender who claims to have sent it.
5.      To receive encrypted messages, users should register their public key that was generated by the PGP program with a PGP public-key server. Alternatively, users need to send their public key to all those who want to send them an encrypted message or post the key to some location they can download it from, such as the user’s Web page.
C.  Where can you use PGP?
1.      PGP encrypted e-mail can be exchanged with most users outside the United States.
2.      Many versions of PGP are available from numerous sites overseas.
IX. HTTPS
A.  HTTPS uses the Secure Sockets Layer (SSL) to transfer information.
B.  It uses the open standard SSL to encrypt data at the application layer.
C.  In addition, HTTPS uses the standard port 443 for TCP/IP communications rather than the standard port 80 used for HTTP.
D.  HTTPS uses the 40-bit RC4 encryption algorithm in most cases. 128-bit version is also implemented.
X.  IPSec
A.  Internet Protocol Security (IPSec) is a collection of IP security features designed to introduce security at the network or packet-processing layer in network communication.
B.  It is designed to provide secure virtual private network capability over the Internet.
1.      IPSec provides a secure version of the Internet Protocol by introducing authentication and encryption at the packet level.
2.      IPSec is optional for the current version of the IP protocol (IPv4) but is required for the next release (IPv6).
3.      Both ends of the communication need to use IPSec for the encryption/decryption process to occur.
C.  IPSec provides two types of security service to ensure authentication and confidentiality for either the data alone (referred to as IPSec transport mode) or for both the data and the header (referred to as tunnel mode).
1.      IPSec introduces several new protocols including the Authentication Header (AH), which provides authentication of the sender, and the Encapsulating Security Payload (ESP), which adds encryption of the data to ensure confidentiality.
2.      IPSec also provides for payload compression before encryption using IPcomp.
XI. CEP
A.  Certificate Enrollment Protocol (CEP) was designed to support certificate issuance, distribution, and revocation using existing technologies. The operations supported include CA and RA public key distribution, certificate enrollment, certificate revocation, certificate query, and CRL query.
B.  It uses both PKCS #7 (Cryptographic Message Syntax Standard) and PKCS #10 (Certification Request Syntax Standard) to define a common message syntax. It supports access to certificates and CRLs using LDAP or the CEP-defined certificate query.
XII.     FIPS
A.  The Federal Information Processing Standards Publications (FIPS PUBS or simply FIPS) describe various standards for data communication issues.
B.  There are three categories of FIPS PUBS currently maintained by NIST:
1.      Hardware and Software Standards/Guidelines
2.      Data standards/guidelines
3.      Computer security standards/guidelines
XIII.   Common Criteria (CC)
A.  The Common Criteria (CC) are the result of an effort to develop a joint set of security processes and standards that could be used by the international community.
1.      The major contributors to the CC are the governments of the United States, Canada, France, Germany, the Netherlands, and the United Kingdom.
2.      The CC also provides a listing of laboratories that apply the criteria in the testing of security products.
3.      Products that are evaluated by one of the approved laboratories receive an Evaluation Assurance Level of EAL1 through EAL7 (EAL7 being the highest level).
4.      The CC also provides a listing of products by functions that have performed at a specific Evaluation Assurance Level.
XIV.   WTLS
A.  The Wireless Transport Layer Security (WTLS) protocol is based on the Transport Layer Security (TLS) protocol.
1.      It provides reliability and security for wireless communications using the Wireless Application Protocol (WAP).
2.      It is necessary due to the limited memory and processing capabilities of WAP-enabled phones.
B.  WTLS can be implemented in one of the three classes:
1.      Class 1 is called anonymous authentication but is not designed for practical use.
2.      Class 2 is called server authentication and is the most common model. The clients and the server may authenticate using different means.
3.      Class 3 is server and client authentication.
a)         In Class 3 authentication, the client and server's WTLS certificates are authenticated.
b)         It is the strongest form of authentication and encryption.
XV.     WEP
A.  The Wired Equivalent Privacy (WEP) algorithm is part of the 802.11 standard and is used to protect wireless communications from interception.
B.  A secondary function is to prevent access to a wireless network from unauthorized access.
C.  WEP relies on a secret key that is shared between a mobile station and an access point. In most installations, a single key is used by all of the mobile stations and access points.
D.  WEP security issues.
1.      WEP is an optional security protocol specified in the 802.11 standard designed to address the security needs in this wireless environment.
2.      It uses a 24-bit initialization vector as a seed value to begin the security association.
a)         This is a potential security problem as there are only just over 16 million possible vectors with 24 bits.
b)         The secret key is only 40 to 64 bits in length, another problem since it does not take too long to brute-force break encryption schemes utilizing key lengths this short.
c)         In addition, the WEP keys are static.
d)         One final problem with WEP is that many wireless network implementations are not WEP-enabled.
XVI.   ISO 17799
A.  ISO 17799 is based on Version 2 of the British Standard 7799 (BS7799) published in May 1999.
B.  The standard is divided into ten sections, each containing more detailed statements describing what is involved for that topic. The ten major sections, as originally detailed in BS7799, are:
1.      Business continuity planning.
2.      System access control.
3.      System development and maintenance.
4.      Physical and environmental security.
5.      Compliance.
6.      Personnel security.
7.      Security organization.
8.      Computer and network management.
9.      Asset classification and control.
10.    Security policy.