Network function management needs grows with how many Service Requesting Users [SRU] are connected to the network and what the network is used for.
Complexity and the number of supported functions in the product is proportional to the risk level of the network.
While home network can tolerate loss of connectivity to various streaming services, telecom network can not stop serving critical infrastructure without large impact to the society.
Network functions management inherits the essential functions listed [4.1 Product functions](#41-product-functions) and are characterised by the following functions:
* Fault detection, reaction and recovery from fail state
* Functional resilience in terms of maintaining correct operation under abnormal network conditions, e.g., connection loss to managed elements
* Depending on the use case, functional resilience in the event of
1. loss of connectivity to managed elements
1. loss of required supporting network services such as time synchronization or backup services
1. or loss of power.
- Dynamic routing and switching control based on requests. Used extensively with Software Defined Networks.
- Device discovery, inventory building and depending on the use case topology map generation.
- Produce logs and traces for security and operational analysis
2. loss of required supporting network services such as time synchronization or backup services
3. or loss of power
* Produce and rely monitoring data for security and operational analysis
Software Defined Network [SDN] could be considered as part of network funcitons management, but it is separated to its own subgroup due to its volatile nature.
In the SDN, the topology does not need to depend on the physicality of the infrastructure.
The application workload sees a change in the networking as temporal connectivity issue, and resumes operation when the packets continue flowing.
SDN inherits the essential functions listed [4.1 Product functions](#41-product-functions), can implement functions listed in [4.1.1 Network functions management](#411-network-functions-management), but are characterised by the following functions:
* Dynamic routing and switching control
* Depending on the use case, resource provisioning based on requests
Ecosystem management combines elements of a network controller with higher level application value.
It could be considered as part of network funcitons management, but it is separated to its own subgroup due to its tight integration to the business logic.
The user end devices execute a well defined function in the deployment context and do not participate in the bulk traffic flow management like [4.1.1 Network functions management](#411-network-functions-management) does.
The devices are often deployed to networks where connectivity and the network design is provided from the outside of the product control.
Ecosystem management inherits the essential functions listed [4.1 Product functions](#41-product-functions).
The ecosystem can implement the following functions:
* Device software delivery
* Key distribution
## 4.1.4 Device management
Supporting use-cases:
* N/A
> NOTE: This section doesn't have use-cases defined in this document due to lack of industry knowledge in the development of this document.
Device management can be considered to be a specialisation of ecosystem management.
It combines the partial or full control of the connected devices to device governance function.
Device management inherits the essential functions listed [4.1 Product functions](#41-product-functions), can implement functions listed in [4.1.3 Ecosystem management](#413-ecosystem-management), but are characterised by the following functions:
* Installed software reporting or in control in the managed device
* Full or partial remote removal of data
* Device tracking and compliance control
* Remote control of device application features
<mark>Market implementations: Apple FindMy iPhone, Microsoft InTune, Android screen time for kids through parental controls (or how ever that works), and Canon FollowMe printing service. The technical definition would even allow VPN controllers such as NordVPN to be evaluated in this context.
</mark>
## 4.2 Product Architecture
@@ -364,7 +431,6 @@ More about assets in [Annex C.1 Assets](#c1-assets) and [Annex C.2 Data](#c11-da
>
>Editor's Note: Unclear and to discuss: what is distributed and where? Are elements also outside a defined operational environment? If so then further security requirements apply.
- Distributed element design
- Insignificant amount of interconnectivity within the network elements
- Lesser importance by the type of the controlled managed elements in their functionality and role in the deployment context
@@ -374,7 +440,7 @@ More about assets in [Annex C.1 Assets](#c1-assets) and [Annex C.2 Data](#c11-da
The affected Service Requesting Users base is small like in:
@@ -392,7 +458,7 @@ The device is placed in a network, that is independent and self sufficient.
The local network devices using the connectivity are not affected by outages and the product's role is more like a convinience for the user, rather than operational nessecity.
The local network does not expect to be connected to other similar remote sites.
The network user might have VPN services enabled, but expectation is to be connected only to the isolated environment of own home.
The network user might have VPN services enabled, but expectation is to be connected only to the isolated environment of own home for example.
When a single device is compromised, the exposure is limited to the devices in that small network.
The network is not fully isolated or air-gapped.
@@ -517,21 +583,28 @@ The NMS documentation shall clarify whether a security requirement is
The following cybersecurity functionalities can be handled from components outside the product:
- From external provided updates on secured channels that the product uses to update the managed managed elements and also itself.
-**Identity management systems** that provide mechanisms for identification and authentication. The system can include also the lifecycle management for identity credentials [\[i.2\]](#_ref_i.2)
-**Virtual Private Network** providing access to a physical or virtual established network of managed devices that have strictly controlled access to authorised functions of the product. [\[i.3\]](#_ref_i.3)[\[i.4\]](#_ref_i.4)
-**Provision of cryptographic keys** coming from a public key infrastructure or other key management system for services of key generation, provision, establishment, and for certificate services such as generation, signing, verification, validation or withdrawal. [\[i.6\]](#_ref_i.6)
-**Security information and event management systems** that collect data from multiple sources, analyse and correlate that data and present it as actionable information for security-related purposes unless it is considered to be integral part of the product features [\[i.7\]](#_ref_i.7)
-**Physical and virtual network interfaces** on the NMS-host and not used or accessed by users for the operation of the NMS.
-**Operating systems** Operating systems that acting as abstraction layer for the hardware system(s) that host the product and are else not involved in the internal functioning. [\[i.5\]](#_ref_i.5)
-**Managed devices** Managed devices, including those that are managed by the product, such as routers, modems and switches. [\[i.8\]](#_ref_i.8)
* From external provided updates on secured channels that the product uses to update the managed managed elements and also itself.
***Identity management systems** that provide mechanisms for identification and authentication. The system can include also the lifecycle management for identity credentials [\[i.2\]](#_ref_i.2)
***Virtual Private Network** providing access to a physical or virtual established network of managed devices that have strictly controlled access to authorised functions of the product. [\[i.3\]](#_ref_i.3)[\[i.4\]](#_ref_i.4)
***Provision of cryptographic keys** coming from a public key infrastructure or other key management system for services of key generation, provision, establishment, and for certificate services such as generation, signing, verification, validation or withdrawal. [\[i.6\]](#_ref_i.6)
***Security information and event management systems** that collect data from multiple sources, analyse and correlate that data and present it as actionable information for security-related purposes unless it is considered to be integral part of the product features [\[i.7\]](#_ref_i.7)
***Physical and virtual network interfaces** on the NMS-host and not used or accessed by users for the operation of the NMS.
***Operating systems** Operating systems that acting as abstraction layer for the hardware system(s) that host the product and are else not involved in the internal functioning. [\[i.5\]](#_ref_i.5)
***Managed devices** Managed devices, including those that are managed by the product, such as routers, modems and switches. [\[i.8\]](#_ref_i.8)
Furthermore, it is essential to detail the generation and establishment of the trust relations between the NMS and the essential external services and systems.
### 4.4.2 Security functions provided to other products
The NMS shall provide the reliable availability of the operative network, while keeping control and providing traffic meta data and metrics for the administrator for verification of the correct network operation.
Example: A listed managed element in the NMS can be enriched with traffic meta data. For example, and inconclusive, when and with what performance there was relevant traffic throughput, when/from/to there was a managed element traffic overload, received failure reporting or similar.
NSM can provide the following services to 3rd. party applications and for the connected devices:
* Access to the collected data sets; raw or enriched.
* PKI for the devices acting as Certificate Authority [CA]
* Access credentials and authorisation to the connected devices
* Proxy gateway connectivity to the connected devices
* Mechanism to interract with the connected devices directly or indirectly
> EXAMPLE: A listed managed element in the NMS can be enriched with traffic meta data. For example, and inconclusive, when and with what performance there was relevant traffic throughput, when/from/to there was a managed element traffic overload, received failure reporting or similar.
## 4.5 Users
@@ -571,24 +644,6 @@ An NMS is a product controlling at least partially connected devices with networ
NMS can be composed of several components or can implement additional functions that are outside the scope of the present standards.
One example of this type of aggregate product design would an implementation where the operating system acts as abstraction layer for the system(s) that host the NMS, or the networking interfaces.
### 4.6.1 Distributed deployment
- Distributed element design
- Insignificant amount of interconnectivity within the network elements
- Lesser importance by the type of the controlled managed elements in their functionality and role in the deployment context
