& cplSiteName &

Network Security: It's Complicated

Michelle Donegan
Prime Reading
Michelle Donegan

Increasing network complexity, more sophisticated attacks, and a general lack of security awareness among consumers are just some of the challenges that mobile operators face as they work to protect their networks and customers.

That's the view from Håkan Kvarnström, chief security officer at Telia Company , an international operator with 189 million subscribers from operations in 15 Nordic and Baltic countries, Eurasia and Spain, as well as associated companies in Russia, Turkey, and Latvia.

All the major security challenges facing mobile operators will be analyzed and discussed at the one-day Mobile Network Security Strategies event, May 21 at The Thistle Marble Arch hotel in London.

In a recent interview with Light Reading, Kvarnström shared his thoughts on the type of network attack that worries him most and how the threat landscape is changing for mobile network operators, as well as for their customers.

For Kvarnström, the most serious network attack would be one that steals customer data and compromises users' privacy, rather than one that causes a network outage.

"Of course, it's serious if the network goes down, but that's reversible -- we can do something about it," he said, adding that once the network has been restored there is no further damage to the customer. "That's not as far-reaching as losing data."

When a customer's privacy has been violated, the harm has lasting effects. An attacker can track a person's entire life by various means, such as tapping in to location data, gaining access to call records, or even listening to voice traffic and looking into SMS messages.

Don't mess with Hakan Kvarnstrom -- he's head of security...
Don't mess with Håkan Kvarnström -- he's head of security...

It's complicated...
But the biggest threat of all for mobile operators is not a certain kind of network attack, in Kvarnström's view. Rather, it is ever-increasing network complexity.

"Complexity is security's worst enemy and that is what security people are struggling with," he said.

Mobile networks are becoming more complicated as a result of having to support many different devices and technologies, such as 2G, 3G, 4G, and eventually 5G, he explained. Added to that, machine-to-machine (M2M) communications is causing a further proliferation of devices on the network. Overall, the IT environment, and the services a mobile operator provides, are becoming more complex, he said.

While TeliaSonera does what it can on its network to thwart attacks, deter the theft of data, and minimize service disruption, Kvarnström said it's more difficult to protect all customers all the time when they can inadvertently install harmful software onto their devices by downloading free applications.

"On the terminal side, it's a much bigger problem because it involves the behavior of the user," he said. "As long as it's free, they download anything. There is a lack of security awareness of what can happen. We need to help people understand the consequences of their actions."

But Kvarnström has noticed that user perceptions are starting to change. "People are becoming more aware of the risks when it comes to security," he said, adding that this was in part due to the Edward Snowden surveillance revelations.

At the same time, the legislative landscape is also changing as the European Commission is working on a proposal for new privacy rules this year.

Taken together, these changes in user perception and regional legislation add to the security challenge for mobile network operators, because they need to adapt their security strategies. "When the legislatures and users are changing the way they look [at the issue], the pressure on operators is becoming tougher to provide solutions to address the security problem," he said.

Sophisticated attacks
Meanwhile, the attacks on network operators are becoming more sophisticated.

"It's quite easy to become a hacker, but that's not limited to mobile services," said Kvarnström. "And when you can make money by hacking and selling data, that's when the threat increases."

He explained that network operators have been let off the hook somewhat when it comes to hacking, unlike banks, which have long been targets. But now, the pressure on operators is increasing because hackers are turning their attention to network operators and mobile users.

"There are a lot of nice apps and services people use that would be of interest to a hacker," he said.

When asked whether equipment vendors were doing enough to help operators meet their security goals, he said that all the solutions needed are available.

"It's about understanding your problem, having the solutions, and using them," he said simply. "There are no excuses and no big missing pieces."

Kvarnström's comments provide a glimpse into the breadth of the security challenge for mobile operators, which involves protecting not only their networks and services, but also the personal data of their customers, as well as their devices.

That means there's at least one certainty for Kvarnström and his ilk: A chief security officer's work is never done.

— Michelle Donegan, contributing editor, special to Light Reading

Want to learn more about this topic? Check out the agenda for Mobile Network Security Strategies, which will take place on May 21 at The Thistle Marble Arch hotel in London. For more on the event, including the stellar service provider speaker line-up, see the event's official site.

(8)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Joe Stanganelli
Joe Stanganelli,
User Rank: Light Sabre
5/10/2014 | 7:13:46 AM
Social Engineering
And this doesn't even begin to touch on the risks of social engineering -- which can sometimes become all the more ever-present in a highly complex environment.  (It's so much easier to just do what someone is telling or asking you to do, isn't it?)
User Rank: Light Beer
4/30/2014 | 5:39:21 PM
Re: It's all there in this one quote
Hmmm. If that's your answer, then what's your definition of secure? All those can be "broken" easily.
User Rank: Light Sabre
4/30/2014 | 2:15:42 PM
Re: It's all there in this one quote
It is fair at times to ask how things could be worse WITHOUT security.  I do think that many organizations (such as homes associations that require authentication to see a newsletter) provide bottom feeding opportunities to collect user info that can be used in bad ways on bigger sites. 

Less security in some cases might make us more secure overall.
User Rank: Light Sabre
4/29/2014 | 1:33:17 PM
Re: It's all there in this one quote
Actually, to be completely frank...there is no possibility of perfect security.

I have posted here in the past the story of the Penetration Test done at the DoD by dropping Flash Drives in a parking lot.  People picked up and plugged in about 60% of the drives.  They were innocuous but connected back to report in.  Poof...all network security is bypassed.

So - problem 1 is stupid employees.

Next up is the problem of bribes/payoffs.  If somebody really wants some information, do you think one of your IT technicians might not take $1M for access?  This is why the electronic CALEA standard came about.  The mob was threatening and bribing CO Technicians when wiretaps were enabled.  

So - problem 2 is dishonest employees.

The thing is that you need to think about security, risk and inconvenience all at the same time.  We had custom ASIC files stolen.  Our initial solution was to take all the machines in the ASIC design team off-line.  We had people go through our garbage.  Shred everything...and I do mean everything.

We have been working on physical security for 1,000s of years.  And yet people still rob banks.  Your job in network security is to increase the cost and risk of a breach - knowning that they are impossible to completely stop.

So, write any buzzwords you want...it only means something if the information is not worth as much as the cost to extract it.


User Rank: Light Sabre
4/29/2014 | 3:26:05 AM
Re: It's all there in this one quote
User Rank: Light Beer
4/28/2014 | 9:57:26 PM
Re: It's all there in this one quote
That sounds like something written by a security analyst. What's both secure & simple?
Joe Stanganelli
Joe Stanganelli,
User Rank: Light Sabre
4/28/2014 | 6:20:39 PM
The irony is that the worst enemy of simplicity and accessibility is security.

What's that saying about "the enemy of my enemy"...?  :p
User Rank: Light Sabre
4/28/2014 | 1:19:09 PM
It's all there in this one quote
It's all there in this one quote: "Complexity is security's worst enemy and that is what security people are struggling with."
Educational Resources
sponsor supplied content
Educational Resources Archive
Light Reading’s Upskill U is a FREE, interactive, online educational resource that delivers must-have education on themes that relate to the overall business transformation taking place in the communications industry.
Friday, October 28, 1:00PM EDT
Security: The Plusses and Minuses of Open Source Software
Nick Feamster, Acting Director, Center for Information Technology Policy, Princeton University
Wednesday, November 9, 1:00PM EST
MANO 101
Friday, November 11, 1:00PM EST
Open Source for NFV MANO
Wednesday, November 16, 1:00PM EST
SDN 101
John Isch, Practice Director, Network & Voice, Orange Business Services
in association with:
From The Founder
Light Reading today starts a new voyage as part of a larger Enterprise.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Custom TV
OneAccess NFV Solutions

10|26|16   |   5:30   |   (0) comments

Antoine Clerget, CTO of OneAccess, discusses how his company has expanded its product line from enterprise-class routers to include a universal virtualized CPE as well as a suite of VNFs to help telco customers evolve to an NFV future.
LRTV Custom TV
The Journey Toward Carrier-Grade WiFi

10|26|16   |   3:39   |   (0) comments

In this Light Reading interview, Dave Sperling, CTO at Smith Micro Software and active participant of the WBA's policy working group, discusses the need for carrier-grade WiFi. Technical and business challenges slowing the fulfillment of this goal are addressed, as well as management strategies that will enable communication service providers to optimize end user ...
LRTV Custom TV
ZTE BBWF Highlights

10|26|16   |     |   (0) comments

At BBWF 2016, ZTE showed a broad range of innovative technologies that are kick-starting an ultrafast broadband journey.
LRTV Custom TV
Next-Generation Technology Beyond DOCSIS 3.1

10|20|16   |     |   (0) comments

At SCTE 2016, Huawei's Liu Jianhua speaks with Alan Breznick for an exclusive interview.
LRTV Custom TV
Hybrid Video Solutions to Change TV, Change Future

10|20|16   |     |   (0) comments

At SCTE 2016, Huawei's Ian Locke speaks with Alan Breznick for an exclusive interview.
LRTV Custom TV
Huawei Future-Oriented Giga Coax Network

10|20|16   |     |   (0) comments

At SCTE 2016, Huawei's Allen Wang speaks with Alan Breznick for an exclusive interview.
LRTV Custom TV
Huawei at SCTE 2016

10|20|16   |     |   (0) comments

Join Alan Breznick of Light Reading and take a sneak peek at the Huawei booth at SCTE 2016.
LRTV Custom TV
Assuring Network Quality in a Rapidly Changing Environment

10|20|16   |     |   (0) comments

As the rate of change and complexity increases in agile networks, the importance of introducing DevOps methodologies for integrating active test and assurance solutions throughout the full service lifecycle becomes critical to ensure that customers are experiencing the service quality they demand. The industry landscape is changing, and software-based test and ...
Telecom Innovators Video Showcase
A10 Networks on Service Providers' Industry Needs

10|20|16   |     |   (0) comments

Light Reading's Steve Saunders hears how A10 enables service providers to accelerate, secure and optimize their application delivery to drive down costs, enhance service availability, and better respond to customer requirements, so they can improve customer satisfaction, monetize their network, and grow revenues.
LRTV Custom TV
New NFV Use Cases for Cable TV

10|19|16   |     |   (0) comments

A large number of NFV use cases are focused on the enterprise domain, looking at virtualization of customer-premises equipment (CPE). To date, there has been little focus on the use cases and business case for virtualization of the video content delivery networks required to deliver unicast and streaming video to consumers. Amdocs commissioned Analysys Mason to ...
Women in Comms Introduction Videos
Meet the Future Workforce: New Faces, Expectations & Motivations

10|19|16   |   5:33   |   (1) comment

Millennials and their younger peers, Gen Z, expect more out of their network and more out of their work. Intel's Lynn Comp shares how the industry can prepare for this new generation of workers.
LRTV Custom TV
ZTE Global Services User Congress 2016 Highlights

10|19|16   |     |   (0) comments

ZTE held its 2nd Global Service User Conference in Dusseldorf on October 13-14. Representatives from network operators, leading industry analysts and ZTE senior expertsattended the event, exploring the best practice in managed services and the vision to transform network operations into the operations center of the future (OpCF) in the software-defined networking ...
Upcoming Live Events
November 3, 2016, The Montcalm Marble Arch, London
November 30, 2016, The Westin Times Square, New York City
December 1, 2016, The Westin Times Square, New York, NY
December 6-8, 2016, The Westin Excelsior, Rome
May 16-17, 2017, Austin Convention Center, Austin, TX
All Upcoming Live Events
Hot Topics
Attacks Have Major Internet Sites on the Ropes
Brian Santo, Senior editor, Test & Measurement / Components, Light Reading, 10/21/2016
Trump: Dump AT&T/TW & Comcast/NBC
Alan Breznick, Cable/Video Practice Leader, Light Reading, 10/24/2016
Google Fiber Hits Pause Button, Scales Back
Alan Breznick, Cable/Video Practice Leader, Light Reading, 10/26/2016
T-Mobile: AT&T & TW Means Ma Bell Not Focused on Mobile
Dan Jones, Mobile Editor, 10/24/2016
Layer3 TV Comes to Town, Hints at Future
Mari Silbey, Senior Editor, Cable/Video, 10/21/2016
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
Join us for an in-depth interview between Steve Saunders of Light Reading and Alexis Black Bjorlin of Intel as they discuss the release of the company's Silicon Photonics platform, its performance, long-term prospects, customer expectations and much more.
There's no question that, come 2020, 5G technology will turn the world's conception of what mobile networking is on its head. Within the world of 5G development, Dr. ...
Animals with Phones
'Oh, Were You Looking for This?' Click Here
'I was just playing some games...'
Live Digital Audio

A vital part of increasing the number of women in comms is transforming the ways companies can support and empower women. While progressive company policies that support both men and women in achieving work-life balance are a step in the right direction, creating a company culture that supports those policies can at times be more challenging.

During this show, we'll talk to Lynn Comp, Senior Director of Industry and Sales Enabling (ISE) in the Network Platforms Group at Intel, about why those challenges exist and how companies can overcome them. She'll provide insight into how Intel has worked to create a culture that supports work-life balance, and provide steps and guidance for other companies wishing to do the same. We will also leave plenty of time to get your questions answered live on the air.