security service telecommunication for other uses see security service security service is a service provided by a layer of communicating open systems which ensures adequate security of the systems or of data transfers as defined by itut x800 recommendation x800 and iso 74982 information processing systems open systems interconnection basic reference model part 2 security architecture a more general definition is in cnss instruction no 4009 dated 26 april 2010 by committee on national security systems of united states of america a capability that supports one or more of the security requirements confidentiality integrity availability examples of security services are key management access control and authentication another authoritative definition is in w3c web service glossary a processing or communication service that is provided by a system to give a specific kind of protection to resources where said resources may reside with said system or reside with other systems for example an authentication service or a pkibased document attribution and authentication service a security service is a superset of aaa services security services typically implement portions of security policies and are implemented via security mechanisms basic security terminology information security information security and computer security are disciplines that are dealing with the requirements of confidentiality integrity availability the socalled cia triad of information asset of an organization company or agency or the information managed by computers respectively there are threats that can attack the resources information or devices to manage it exploiting one or more vulnerabilities the resources can be protected by one or more countermeasures or security controls so security services implement part of the countermeasures trying to achieve the security requirements of an organization basic osi terminology osi model in order to let different devices computers routers cellular phones to communicate data in a standardized way communication protocols had been defined the itut organization published a large set of protocols the general architecture of these protocols is defined in recommendation x200 the different means air cables and ways protocols and protocol stacks to communicate are called a communication network security requirements are applicable to the information sent over the network the discipline dealing with security over a network is called network security the x800 recommendation provides a general description of security services and related mechanisms which may be provided by the reference model and defines the positions within the reference model where the services and mechanisms may be provided this recommendation extends the field of application of recommendation x200 to cover secure communications between open systems according to x200 recommendation in the socalled osi reference model there are 7 layers each one is generically called n layer the n1 entity ask for transmission services to the n entity at each level two entities nentity interact by means of the n protocol by transmitting protocol data units pdu service data unit sdu is a specific unit of data that has been passed down from an osi layer to a lower layer and has not yet been encapsulated into a pdu by the lower layer it is a set of data that is sent by a user of the services of a given layer and is transmitted semantically unchanged to a peer service user the pdu at any given layer layer n is the sdu of the layer below layer n1 in effect the sdu is the payload of a given pdu that is the process of changing a sdu to a pdu consists of an encapsulation process performed by the lower layer all the data contained in the sdu becomes encapsulated within the pdu the layer n1 adds headers or footers or both to the sdu transforming it into a pdu of layer n1 the added headers or footers are part of the process used to make it possible to get data from a source to a destination osi security services general description the following are considered to be the security services which can be provided optionally within the framework of the osi reference model the authentication services require authentication information comprising locally stored information and data that is transferred credentials to facilitate the authentication authentication these services provide for the authentication of a communicating peer entity and the source of data as described below peer entity authentication this service when provided by the nlayer provides corroboration to the n 1entity that the peer entity is the claimed n 1entity data origin authentication this service when provided by the nlayer provides corroboration to an n 1entity that the source of the data is the claimed peer n 1entity access control this service provides protection against unauthorized use of resources accessible via osi these may be osi or nonosi resources accessed via osi protocols this protection service may be applied to various types of access to a resource eg the use of a communications resource the reading the writing or the deletion of an information resource the execution of a processing resource or to all accesses to a resource data confidentiality these services provide for the protection of data from unauthorized disclosure as described below connection confidentiality this service provides for the confidentiality of all nuserdata on an nconnection connectionless confidentiality this service provides for the confidentiality of all nuserdata in a single connectionless nsdu selective field confidentiality this service provides for the confidentiality of selected fields within the nuserdata on an nconnection or in a single connectionless nsdu traffic flow confidentiality this service provides for the protection of the information which might be derived from observation of traffic flows data integrity these services counter active threats and may take one of the forms described below connection integrity with recovery this service provides for the integrity of all nuserdata on an nconnection and detects any modification insertion deletion or replay of any data within an entire sdu sequence with recovery attempted connection integrity without recovery as for the previous one but with no recovery attempted selective field connection integrity this service provides for the integrity of selected fields within the nuser data of an nsdu transferred over a connection and takes the form of determination of whether the selected fields have been modified inserted deleted or replayed connectionless integrity this service when provided by the nlayer provides integrity assurance to the requesting n 1entity this service provides for the integrity of a single connectionless sdu and may take the form of determination of whether a received sdu has been modified additionally a limited form of detection of replay may be provided selective field connectionless integrity this service provides for the integrity of selected fields within a single connectionless sdu and takes the form of determination of whether the selected fields have been modified nonrepudiation this service may take one or both of two forms nonrepudiation with proof of origin the recipient of data is provided with proof of the origin of data this will protect against any attempt by the sender to falsely deny sending the data or its contents nonrepudiation with proof of delivery the sender of data is provided with proof of delivery of data this will protect against any subsequent attempt by the recipient to falsely deny receiving the data or its contents specific security mechanisms the security services may be provided by means of security mechanism encipherment digital signature access control data integrity authentication exchange traffic padding routing control notarization the table1x800 shows the relationships between services and mechanisms illustration of relationship of security services and mechanisms service mechanism encipherment digital signature access control data integrity authentication exchange traffic padding routing control notarization peer entity authentication y y y data origin authentication y y access control service y connection confidentiality y y connectionless confidentiality y y selective field confidentiality y traffic flow confidentiality y y y connection integrity with recovery y y connection integritywithout recovery y y selective field connection integrity y y connectionless integrity y y y selective field connectionless integrity y y y nonrepudiation origin y y y nonrepudiation delivery y y y some of them can be applied to connection oriented protocols other to connectionless protocols or both the table 2x800 illustrates the relationship of security services and layers illustration of the relationship of security services and layers service layer 1 2 3 4 5 6 7 peer entity authentication y y y data origin authentication y y y access control service y y y connection confidentiality y y y y y y connectionless confidentiality y y y y y selective field confidentiality y y traffic flow confidentiality y y y connection integrity with recovery y y connection integrity without recovery y y y selective field connection integrity y connectionless integrity y y y selective field connectionless integrity y nonrepudiation origin y nonrepudiation delivery y other related meanings managed security service managed security service managed security service mss are network security services that have been outsourced to a service provider computer portal computer security portal telecommunication portal access control availability communication network communication protocol confidentiality countermeasure data integrity digital signature exploit computer security information security integrity itut managed security service network security osi model protocol computing protocol data unit protocol stack security control security requirements analysis service data unit threat computer vulnerability computing term in fismapedia list of itut security activities and publications 