& cplSiteName &
Comments
You must login to participate in this chat. Please login.

Patrick is going to be joined by service provider and vendor specialists December 5 at the MOBILE NETWORK SECURITY STRATEGIES one-day conference in New York City

http://events.lightreading.com/mnss/

Blogger

Thanks, Patrick! And thanks everyone for joining. Hope to see some of you in NYC for our Mobile Security conference. Going to be a good one!

Blogger

And thanks everyone for joining in and asking some great questions and making excellent points -- this is a MASSIVE topic with a great many strands.

Blogger

I think we all know there are several layers in the network and I would expcet carriers to encrypt each layer to take the liability off of them.  Then, as someone pointed out, an app on the device and then additional encryption in the handset.  Security on LTE has been questioned for years and probably one of the reasons for the hesitacny in delivering services like VoLTE.

Light Sabre

Thanks Patrick! Great insights.

Blogger

ALL; Thanks all, have a good day.

Light Sabre

Taraseals: Carrier responsibility. Starting point here is that the carrier has responsbility to its employees and shareholders. Consistent with that, carriers allow competitors to lead on security at their peril. It follows from that they need to take a role, although fast moving technology (and regulation) make that a permanently moving set of goal posts.

Light Sabre

all too often, rather-- sorry for typos...

Light Sabre

Hello all.  I am wondering if some of the video optimization solutions carriers are placing into their networks have a filter to weed out spam.

Light Sabre

Ray: I think we've been hearing "Google will solvee the problem" all to aften actually....mostly from Google itself!! ;-)

Light Sabre

Great question, Sarah, about personal information protection, privacy and so on. Thorny, difficult waters there but it seems that should be a big issue in 4G as more people do full computing and move around all kinds of information via mobile broadband. What responsibility does the carrier have in all of that? If any? 

Light Sabre

I know.  Scary right?

Light Sabre
pzernick - not often you hear anyone saying that Google will solve the problem...
 

 

Blogger

People will need to run an app on their phone to block this kind of spam as they do email spam.  Google will solve the problem, not operators

Light Sabre

Ray:Hysteria. Not all and not all.

Light Sabre

RAY, VOLTE. Sure like I said Video messaging. The price of messgaing in going through the floor. Capacity and speed of LTE. You could use the equivlanet of Next Gen SIM boxes to generate hundreds/thousands of video spam messages.

Light Sabre

And certainly before we get to the end of the chat today I want to get to Patrick's opening remark - "Too much box-mongering hysteria on the part of some vendors on the one hand. Too much complacency on the part of some operators on the other."

Are the operators still too complacent and are all the vendors engaging in 'box-mongering hysteria'?

Blogger

Ray: VOLTE. Tendency sometime to think of that as "voice" whereas attacks tend to be associated with "data". Except VoLTE is data....

Light Sabre

Ray: yes! I'm coughing right now. Patrick: That sounds awful. I've heard about SPIT or voice spam...are the possibilities there even greater in VoLTE?

Light Sabre

I thought we would have more questions around VoLTE -- will the introduction of VoLTE services on multiple networks, expected in 2014-15, be the opening of the security threat floodgates?

Blogger

I think people chose that too because of the heightened awareness around the NSA and snooping...

Blogger

On our LR poll, we asked what people are most concerned with and the most votes went to criminals stealing sensitive information. That's often a handset-level issue, but is it a real network threat too? 

Blogger

Taraseals: Robocalls. Not just hijacking for own use but using robocalls as another typoe of DDoS attack. U.S govt issued notice to public govt agencioes recently of this attack. Bombard the Dept of Whatevcer with thousands of calls. Phone them up and demand $5000 for them to stop the attack or else it continues. In RCS land (when we get there...) think of video messaging.  Think of SMS spamming - what about video messaging spamming? Impact on congestion way, way greater.

Light Sabre

Tara - a threat to everyone's health, the Robocalls.... that's an interesting point on service hijacking - I have heard of that being an issue for fixed line ISPs.

Blogger

Robocalls! The bane of the political season! Are there other threats though besides "nuisance" type issues? You're talking about hackers essentially hijacking a VoIP service for their own uses?

Light Sabre

mark12 - welcome! good question, Patrick just completed a report on that called 

Mobile Network Outages & Service Degradations: A Heavy Reading Survey Analysis
Blogger

Mark12. NO doubt there are "vulnerabilities" in Diameter. Issue pertaining to early LTE networks was that it wasn't designed to deal and respond in a telco-like way to flooding incidents. That's being addressed now. Diameter Routing Agents (DRAs) helping too. Wouldn't call that a secuirty vulnerability per se. Sure there are some though. And more in future no doubt.

Light Sabre

Ah yes, security is one reason operators site on why it takes soooo long to work with them on APIs. Exposing network access is a non-trivial issue though. Makes sense, but still. :)

Blogger

pzernick - Yeah, I think that might be a request too far for this medium.... big BIG question! But a good one all the same

 

Blogger

These are potential risk areas but I am intersted in any reported exploits against real vulnerabilties in say Diameter as you mentioned...

Light Beer

Send a link to a good white paper Patrick!

Light Sabre

pzernick: List of threats and costs - not post, resrach and present over 4-6 pages maybe !

Light Sabre

SarahReedy: small cells. Yes a gratuitous snipe on my part.

Light Sabre

TaraSeals Web-facing APIs. The operators are used to exposing their APIs to their subscriebr sim cards, which are highlky, highly secure. Internet's a different animal. SIP very open, very vulnerable. Multiple risk vectors including Robocalls

Light Sabre

Patrick, why aren't public access small cells not an issue? Because they don't have scale yet?

Blogger

Can you talk a little about the possible exploits stemming from those vulnerabilities that you mentioned, like oWeb-facing VoLTE APIs and unencrypted backhaul? What are the looming potential threats involved for carriers and their customers?

Light Sabre

Sarah,

Mpayments has more than just a security issue. Other issue is that other forms of payment in this country are very efficient (believe it or not) compared to the rest of the world. That's why paper checks have stubbornly hung on, even when their end was forecast decades ago.

Light Sabre

TaraSeals. Femtocell issues are known. VZW had an isue on their CDMA femto line earlier this year so goal posts are always moving. public access small cells aren't an issue. In theory they are, in practice there aren't gonna be any for a while anyway....

Light Sabre

Can you post a list of threats (i,e, DOS) by prioritized by most likely and prioritzed the same list again by most costly to operators?

Light Sabre
Identify and block malicious traffic. Big market opportunity for vendors. Operators dont have very granular insight at all into their traffic. Lots of malcious traffic going under the radar. solutions out there to identify and block.
Light Sabre

Mark12; Real 4G threats? All the 3G threats plus some new ones: unencrypted backhaul; volumes of diameter signalling, opening APIs the Internet for VOLTE and RCS. You name it

Light Sabre

That's one big reason mHealth has had a hard time taking off...same with mobile payments.

Blogger

Are $G security threats that different from 3G sewcurity threats?

 

Blogger

TaraSeals: a malware-initiated data breach at a healthcare facility. It all depends. If the malware breach occured on a piece of equipment provide as part of an mHealth service by a care provider to a patient then the care provider would almost certainly be liable for resulting damages, not the service provider.

Light Sabre

Good point re: Femto security. That seems a different ball of wax from 4G networks themselves though...

Light Sabre

And to follow on from the DPI question, what can carriers do to identify and block malicious traffic traversing their networks? Typically terrestrial ISPs don't bother and leave that job up to browser seecurity and the like from what I understand.

Light Sabre

So what are the real 4G/LTE threats and not just speculation (e.g., there were real exploits reported with 3G femto cells)... 

Light Beer

What are the uniquely 4G security measures operators are or should be taking?

Blogger

Hi everyone-- I'm excited about this topic! I have a question: most of the reports focus on Android security and the growth in mobile malware on that platform. It seems that the onus is on end users to adopt better mobile security practices, especially when it comes to BYOD. And, corporate IT departments have the other part of the responsibility to protect their organizations with good policies, defenses and enforcement. What role, if any, do carriers play in taking responsibility for, say, a malware-initiated data breach at a healthcare facility? Or do carriers mainly have an opportunity to offer help to IT folks in the way of offering managed security services?

 

Light Sabre

What do you see as the biggest threat facing operators today?

 

Light Sabre

@pdonegan67 do you know of any reputable vendors who are in business with any Tier 1 carrier?

Light Sabre

pzernik: Not necessarily all that deep so sort of.

Light Sabre

To Ray: IPsec from the base station to the backhaul is uniquely relevant to 4G. A lot of techn ologies are common to 3G and 4G.

 

Light Sabre

Good point, pzernik. I wonder how much of the malware affecting phones happens to rooted phones.

Blogger

By filtering do you mean "deep packet inspection?"

 

Light Sabre

Are there any particular network security technologies that are more suitable for 4G service providers to deploy? And where in the network should they put up their defenses?

Blogger

To Phil Britt: There's a limit to how much an operator can do. But by investing in network-side security filtering you can at least prevent most incoming email or sms borne malware from getting to the user's device.

Light Sabre

Carriers should be able to identify users who ROOT their phones as they can then install applications that are not from an "app store" and also can remove security software that the service provider had pre-loaded on the devices.

Light Sabre

To Ray:

To your question Ray, yes on the whole we do see integrated incumbents generally being stronger in security than pure-play mobile operators but there are still quite a few exceptions to that. More often than not, the reason the integrated incumbents are stronger in security is that because of the association with the fixed line parent, their mobile arms have done disproportionately well in the corporate and government subscriber market. That's been the main driver of their leadership rather than because of graceful interchange of security smarts from the fixed to the mobile side of the house which does sometimes happen but more typically doesn't.

Light Sabre

Hi, all. Looking forward to the chat.

Blogger

Another early question: How does a provider protect against users not practicing "safe mobile security?"

Light Sabre

Nicely set up Patrick! Looking forward to it. I mean, where else can you find an appraisal of "box-mongering hysteria"?

Blogger

Looking forward to today's chat with the Light Reading crew. Good idea to do this - sort out the wheat from the chaffe of this subject matter. Too much box-mongering hysteria on the part of some vendors on the one hand. Too much complacency on the part of some operators on the other. Bring the conversation on.

Light Sabre

This is a test message

Light Sabre

I'm thrpowing out an early question for Patrick -- do  carriers with both fixed and mobile operations teams have an advantage in tackling the network security challenges that come with a 4G rollout because they already have experience of dealing with some of the issues in their fixed networks?

Blogger

Hi everyone! We will be holding our next live chat on Thursday, November 14, at 11 a.m. EST/8 a.m. PST with Heavy Reading senior analyst Patrick Donegan. We'll be discussing the many mobile network security challenges that face wireless operators as they roll out 4G. And there are plenty. Join in right here on Thursday, November 14, at 11 a.m. EST/8 a.m. PST.

Blogger


From The Founder
Light Reading sits down at CES with the head of Cisco's service provider video business, Conrad Clemson, to discuss how NFV and cloud security relate to video, the challenge of managing 4K/8K traffic, the global expansion of Netflix and virtual reality.
Flash Poll
Live Streaming Video
CLOUD / MANAGED SERVICES: Prepping Ethernet for the Cloud
Moderator: Ray LeMaistre Panelists: Jeremy Bye, Leonard Sheahan
LRTV Huawei Video Resource Center
TeliaSonera: Striving for Independence

2|12|16   |     |   (0) comments


Peter Lagergren discusses the importance of decoupling the network from services.
LRTV Huawei Video Resource Center
Ken Wang on U-vMOS

2|12|16   |     |   (0) comments


Ken Wang discusses how video will take of the traffic on carrier networks and become a basic service to provide to end users.
LRTV Documentaries
All Change in Video

2|11|16   |   33:12   |   (1) comment


At this moderated panel at 2020 Vision in Dublin, Alan Breznick, Cable/Video Practice Leader of Light Reading, sits down with Jeff Finkelstein, director of network architecture at Cox Communications, to discuss the rapidly changing video market.
LRTV Custom TV
Hosting in Ireland, Past & Present

2|10|16   |   16:07   |   (0) comments


Garry Connolly, president of Host in Ireland, presents the keynote at Light Reading's 2020 Vision Executive Summit in Dublin.
Women in Comms Introduction Videos
What's Hot in Mobile Commerce?

2|10|16   |   12:18   |   (1) comment


Claire Maslen, financial services relationship manager at the GSMA, talks about the development of the digital commerce sector and the types of relationships that mobile operators are developing to further their m-commerce strategies.
LRTV Documentaries
EANTC Tests Nokia IP Routing & Mobile Gateway VNFs for Real World Deployment

2|9|16   |   5:08   |   (1) comment


Nokia obtained validation of its virtualized router and virtualized mobile gateway capabilities through rigorous testing performed by EANTC. The results set a new industry benchmark for outstanding performance, scalability, resiliency and manageability. Nokia VNFs are ready for telco cloud deployment, so that service providers can accelerate mobile, business and ...
Between the CEOs
CEO Chat With Level 3's Jack Waters

2|8|16   |   26:15   |   (1) comment


Light Reading CEO and founder Steve Saunders sits down with Level 3 Communications' CTO Jack Waters to discuss hot topics like virtualization, 4K and the future of telecom...
LRTV Custom TV
The Composable Telco

2|8|16   |   24:46   |   (0) comments


Heavy Reading's Principal Analyst Caroline Chappell presents the keynote at Light Reading's 2020 Vision Executive Summit in Dublin.
LRTV Custom TV
Join Us at the Digital Operations Transformation Summit

2|4|16   |   03:52   |   (0) comments


The Digital Operations Transformation Summit on February 21, 2016 at the Crowne Plaza Barcelona Fira Centre will bring together 50 senior executives to engage in a unique debate on the opportunities and challenges presented by the transformative evolving digital landscape. RSVP now at events@lightreading.com.
LRTV Custom TV
Making the Test: ADVA Ensemble Connector vs. Open vSwitch

2|4|16   |   01:28   |   (0) comments


Light Reading, in partnership with EANTC, recently tested ADVA's Ensemble Connector, which replaces open vSwitch and offers carrier-grade capability and interoperability. The test results strengthen ADVA's credibility as a provider in the virtualization space.
LRTV Custom TV
Bridging the Gap Between PoCs & Deployment in NFV

2|4|16   |   31:50   |   (0) comments


Charlie Ashton of Wind River presents the keynote at Light Reading's 2020 Vision executive summit in Dublin.
Between the CEOs
CEO Chat With Mike Aquino

2|3|16   |   17:34   |   (0) comments


The former CEO of Overture Networks, Mike Aquino, discusses why truly open virtualization solutions provide service providers with the greatest choice.
Upcoming Live Events
March 10, 2016, The Cable Center, Denver, CO
April 5, 2016, The Ritz Carlton, Charlotte, NC
May 23, 2016, Austin, TX
May 24-25, 2016, Austin Convention Center, Austin, TX
All Upcoming Live Events
Hot Topics
Yahoo & Verizon Sitting in a Tree...
Brian Santo, Senior editor, Test & Measurement / Components, Light Reading, 2/8/2016
AT&T Lights Fire Under 5G, Plans 2016 Trials
Iain Morris, News Editor, 2/12/2016
Vodafone: Flexible Work Policies Boost Profits
Sarah Thomas, Editorial Operations Director, 2/8/2016
It's Time to Integrate OTT Video
Alan Breznick, Cable/Video Practice Leader, 2/8/2016
Andreessen Facepalms on Facebook Free Basics
Mitch Wagner, West Coast Bureau Chief, Light Reading, 2/10/2016
Like Us on Facebook
Twitter Feed
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
Light Reading CEO and founder Steve Saunders sits down with Level 3 Communications' CTO Jack Waters to discuss hot topics like virtualization, 4K and the future of telecom...
The former CEO of Overture Networks, Mike Aquino, discusses why truly open virtualization solutions provide service providers with the greatest choice.
Live Digital Audio

Broadband speeds are ramping up across Europe as the continent, at its own pace, follows North America towards a gigabit society. But there are many steps to take on the road to gigabit broadband availability and a number of technology options that can meet the various requirements of Europe’s high-speed fixed broadband network operators. During this radio show we will look at some of the catalysts for broadband network investments and examine the menu of technology options on offer, including vectoring and G.fast for copper plant evolution and the various deployment possibilities for FTTH/B.