PP Resolution 181
PP RESOLUTION 181 (Guadalajara, 2010)
Definitions and terminology relating to building confidence and security in the use of information and communication technologies
The Plenipotentiary Conference of the International Telecommunication Union (Guadalajara, 2010),
- recalling
- a) Resolution 45 (Rev. Hyderabad, 2010) of the World Telecommunication Development Conference (WTDC);
- b) Resolution 130 (Antalya, 2006) of the Plenipotentiary Conference, which resolves to give high priority to the role of ITU in building confidence and security in the use of telecommunications/information and communication technologies (ICTs);
- c) provisions of the Tunis Commitment and the Tunis Agenda for the Information Society related to building confidence and security in the use of ICT;
- d) the outcomes of both phases of the World Summit on the Information Society (WSIS) regarding this issue,
- e) that, in accordance with WSIS Action Line C5, Resolution 149 (Antalya, 2006) of the Plenipotentiary Conference instructed the ITU Council to establish a working group, open to all Member States and Sector Members, to study terminology related to building confidence and security in the use of ICTs, and to develop definitions and descriptions in this regard;
- f) Programme 2 (Cybersecurity, ICT applications and IP-based network-related issues) of the Hyderabad Action Plan adopted by WTDC-10,
- aware
- a) that one of the purposes of the Union is to maintain and extend international cooperation among all its Member States for the improvement and rational use of telecommunications of all kinds;
- b) that another of the purposes of the Union is to promote the development of technical facilities and their most efficient operation with a view to improving the efficiency of telecommunication services, increasing their usefulness,
- considering
- a) the need to build confidence and security in the use of telecommunications/ICTs by strengthening the trust framework (§ 39 of the Tunis Agenda) and the need for governments, in cooperation with other stakeholders, within their respective roles, to develop necessary legislation for the investigation and prosecution of cybercrime, at national, regional and international level;
- b) that United Nations General Assembly Resolution 64/211 invites Member States to use, if and when they deem appropriate, the voluntary self-assessment tool that is annexed to that resolution for national efforts;
- c) the reasons behind the adoption of Resolution 37 (Rev. Hyderabad, 2010) of WTDC, on bridging the digital divide, having regard to the importance of multistakeholder implementation at the international level and to the action lines referenced in § 108 of the Tunis Agenda, including “Building confidence and security in the use of ICTs”,
- noting
- a) the importance of building confidence and security in the use of ICTs as highlighted in WSIS;
- b) that there is a need to maintain common terminology pertaining to building confidence and security in the use of ICTs;
- c) the ongoing work carried out by organizations such as the International Organization for Standardization (ISO) and the Internet Engineering Task Force (IETF) in relation to building confidence and security in the use of ICTs;
- d) that Resolution 50 (Rev. Johannesburg, 2008) of the World Telecommunication Standardization Assembly (WTSA), on cybersecurity, and Resolution 52 (Rev. Johannesburg, 2008) of WTSA, on countering and combating spam, include the study of technical aspects for reducing the impact of these phenomena,
- considering further
- a) that in the area of security, Study Group 17 of the ITU Telecommunication Standardization Sector (ITU-T) is responsible for developing the core recommendations on telecommunication and ICT security, such as security architecture and frameworks; the fundamentals of protection, including threats, vulnerabilities and risks; authentication and identity management, incident handling and forensics; and security aspects of communication applications;
- b) that Recommendation ITU-T X.1205 (2008), on overview of cybersecurity, provides a terminology definition of cybersecurity;
- c) that the Council Working Group on the study of definitions and terminology relating to building confidence and security in the use of ICTs (WG-Def), which was established by Resolution 149 (Antalya, 2006), examined several proposals and reached consensus on the definition of “cybersecurity” in Recommendation ITU-T X.1205 (2008);
- d) that the above-mentioned Council group, in its final report to the 2009 session of the Council, proposed two options relating to the definition for cybersecurity, as reproduced below:
- Option 1
- 1a. introduce the word “cybersecurity”, in Article 1 of the Constitution and define this item in the Annex to the Constitution, based on the agreed definition, or
- 1b. introduce the word “cybersecurity” in a relevant article in the Convention and define this item in the Annex to the Convention;
- Option 2
- 2. adopt a resolution by the Plenipotentiary Conference regarding this definition,
- recognizing
- a) the ongoing work by ITU-T and by the ITU Telecommunication Development Sector (ITU-D) on matters related to building confidence and security in the use of ICTs;
- b) the importance of studying the issue of terminology related to building confidence and security in the use of ICTs, and of examining and developing definitions and descriptions in this regard, as appropriate;
- c) that this base set needs to include other important issues in addition to cybersecurity,
- recognizing further
- a) that, due to the evolving technological environment and the potential emergence of new and unforeseeable risks and vulnerabilities in relation to confidence and security in the use of ICTs, and for other reasons, it may become necessary for ITU-T Study Group 17 to update the definition of cybersecurity that is presented in Recommendation ITU-T X.1205;
- b) that the definition of cybersecurity may need to be modified from time to time to reflect changes in policy;
- c) the work of ITU-T Study Group 17 (Security) on public key infrastructures, identity management, digital signatures, the security manual, the security standards roadmap and the cybersecurity information exchange framework;
- d) that the above-mentioned work is continuing in ITU-T Study Group 17 in order to further develop the above-mentioned set of definitions taking into account the continuous development in ICT technology;
- e) that the inclusion of any definition relating to ICT, which is an evolving issue, such as the definition of cybersecurity, in the stable Constitution is not consistent with the principles based on which the stable Constitution would be established,
- resolves
- 1 to take into account the definition of “cybersecurity” approved in Recommendation ITU-T X.12051 for use in activities related to building confidence and security in the use of ICTs;
- 2 that the above footnote is an integral part of this resolution,
- instructs the Secretary-General
- to bring this resolution to the attention of the international organizations and other relevant entities dealing with the security of telecommunications/ICTs for consideration and any required action, as appropriate,
- instructs the Secretary-General and the Directors of the Telecommunication Standardization Bureau and the Telecommunication Development Bureau
- to take into account the definition of “cybersecurity” that is adopted in Recommendation ITU-T X.1205 for use in ITU activities related to building confidence and security in the use of ICTs,
- instructs the Director of the Telecommunication Standardization Bureau
- to report to the Council on any new or revised recommendations adopted by ITU-T related to or affecting cybersecurity-related terminology and definitions or other relevant definitions concerning confidence and security in the use of ICTs,
- invites Member States and Sector Members
- to participate actively in the relevant ITU study groups dealing with issues relating to confidence and security in the use of ICTs.
