& cplSiteName &

Network Security: It's Complicated

Michelle Donegan
Prime Reading
Michelle Donegan
4/28/2014
50%
50%

Increasing network complexity, more sophisticated attacks, and a general lack of security awareness among consumers are just some of the challenges that mobile operators face as they work to protect their networks and customers.

That's the view from Håkan Kvarnström, chief security officer at Telia Company , an international operator with 189 million subscribers from operations in 15 Nordic and Baltic countries, Eurasia and Spain, as well as associated companies in Russia, Turkey, and Latvia.


All the major security challenges facing mobile operators will be analyzed and discussed at the one-day Mobile Network Security Strategies event, May 21 at The Thistle Marble Arch hotel in London.


In a recent interview with Light Reading, Kvarnström shared his thoughts on the type of network attack that worries him most and how the threat landscape is changing for mobile network operators, as well as for their customers.

For Kvarnström, the most serious network attack would be one that steals customer data and compromises users' privacy, rather than one that causes a network outage.

"Of course, it's serious if the network goes down, but that's reversible -- we can do something about it," he said, adding that once the network has been restored there is no further damage to the customer. "That's not as far-reaching as losing data."

When a customer's privacy has been violated, the harm has lasting effects. An attacker can track a person's entire life by various means, such as tapping in to location data, gaining access to call records, or even listening to voice traffic and looking into SMS messages.

Don't mess with Hakan Kvarnstrom -- he's head of security...
Don't mess with Håkan Kvarnström -- he's head of security...

It's complicated...
But the biggest threat of all for mobile operators is not a certain kind of network attack, in Kvarnström's view. Rather, it is ever-increasing network complexity.

"Complexity is security's worst enemy and that is what security people are struggling with," he said.

Mobile networks are becoming more complicated as a result of having to support many different devices and technologies, such as 2G, 3G, 4G, and eventually 5G, he explained. Added to that, machine-to-machine (M2M) communications is causing a further proliferation of devices on the network. Overall, the IT environment, and the services a mobile operator provides, are becoming more complex, he said.

While TeliaSonera does what it can on its network to thwart attacks, deter the theft of data, and minimize service disruption, Kvarnström said it's more difficult to protect all customers all the time when they can inadvertently install harmful software onto their devices by downloading free applications.

"On the terminal side, it's a much bigger problem because it involves the behavior of the user," he said. "As long as it's free, they download anything. There is a lack of security awareness of what can happen. We need to help people understand the consequences of their actions."

But Kvarnström has noticed that user perceptions are starting to change. "People are becoming more aware of the risks when it comes to security," he said, adding that this was in part due to the Edward Snowden surveillance revelations.

At the same time, the legislative landscape is also changing as the European Commission is working on a proposal for new privacy rules this year.

Taken together, these changes in user perception and regional legislation add to the security challenge for mobile network operators, because they need to adapt their security strategies. "When the legislatures and users are changing the way they look [at the issue], the pressure on operators is becoming tougher to provide solutions to address the security problem," he said.

Sophisticated attacks
Meanwhile, the attacks on network operators are becoming more sophisticated.

"It's quite easy to become a hacker, but that's not limited to mobile services," said Kvarnström. "And when you can make money by hacking and selling data, that's when the threat increases."

He explained that network operators have been let off the hook somewhat when it comes to hacking, unlike banks, which have long been targets. But now, the pressure on operators is increasing because hackers are turning their attention to network operators and mobile users.

"There are a lot of nice apps and services people use that would be of interest to a hacker," he said.

When asked whether equipment vendors were doing enough to help operators meet their security goals, he said that all the solutions needed are available.

"It's about understanding your problem, having the solutions, and using them," he said simply. "There are no excuses and no big missing pieces."

Kvarnström's comments provide a glimpse into the breadth of the security challenge for mobile operators, which involves protecting not only their networks and services, but also the personal data of their customers, as well as their devices.

That means there's at least one certainty for Kvarnström and his ilk: A chief security officer's work is never done.

— Michelle Donegan, contributing editor, special to Light Reading


Want to learn more about this topic? Check out the agenda for Mobile Network Security Strategies, which will take place on May 21 at The Thistle Marble Arch hotel in London. For more on the event, including the stellar service provider speaker line-up, see the event's official site.


(8)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
5/10/2014 | 7:13:46 AM
Social Engineering
And this doesn't even begin to touch on the risks of social engineering -- which can sometimes become all the more ever-present in a highly complex environment.  (It's so much easier to just do what someone is telling or asking you to do, isn't it?)
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/30/2014 | 5:39:21 PM
Re: It's all there in this one quote
Hmmm. If that's your answer, then what's your definition of secure? All those can be "broken" easily.
briandnewby
50%
50%
briandnewby,
User Rank: Light Sabre
4/30/2014 | 2:15:42 PM
Re: It's all there in this one quote
It is fair at times to ask how things could be worse WITHOUT security.  I do think that many organizations (such as homes associations that require authentication to see a newsletter) provide bottom feeding opportunities to collect user info that can be used in bad ways on bigger sites. 

Less security in some cases might make us more secure overall.
brookseven
50%
50%
brookseven,
User Rank: Light Sabre
4/29/2014 | 1:33:17 PM
Re: It's all there in this one quote
Actually, to be completely frank...there is no possibility of perfect security.

I have posted here in the past the story of the Penetration Test done at the DoD by dropping Flash Drives in a parking lot.  People picked up and plugged in about 60% of the drives.  They were innocuous but connected back to report in.  Poof...all network security is bypassed.

So - problem 1 is stupid employees.

Next up is the problem of bribes/payoffs.  If somebody really wants some information, do you think one of your IT technicians might not take $1M for access?  This is why the electronic CALEA standard came about.  The mob was threatening and bribing CO Technicians when wiretaps were enabled.  

So - problem 2 is dishonest employees.

The thing is that you need to think about security, risk and inconvenience all at the same time.  We had custom ASIC files stolen.  Our initial solution was to take all the machines in the ASIC design team off-line.  We had people go through our garbage.  Shred everything...and I do mean everything.

We have been working on physical security for 1,000s of years.  And yet people still rob banks.  Your job in network security is to increase the cost and risk of a breach - knowning that they are impossible to completely stop.

So, write any buzzwords you want...it only means something if the information is not worth as much as the cost to extract it.

seven

 
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/29/2014 | 3:26:05 AM
Re: It's all there in this one quote
TDM. ATM. SMS. GPRS. WAP.
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/28/2014 | 9:57:26 PM
Re: It's all there in this one quote
That sounds like something written by a security analyst. What's both secure & simple?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
4/28/2014 | 6:20:39 PM
Irony
The irony is that the worst enemy of simplicity and accessibility is security.

What's that saying about "the enemy of my enemy"...?  :p
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/28/2014 | 1:19:09 PM
It's all there in this one quote
It's all there in this one quote: "Complexity is security's worst enemy and that is what security people are struggling with."
From The Founder
Download our complete guide to de-risking NFV deployment in 2016, including:
  • An eight-step strategy to deploying NFV safely, based on input from the companies that have already started virtualizing their production networks.
  • Interviews with leading executives at Colt, AT&T, Deutsche Telekom, Cisco, Nokia, ZTE, Ericsson and Heavy Reading.
  • Flash Poll
    Live Streaming Video
    Prepping for the Future: Upskill U Explained
    During this short kick-off video, Doug Webster, Vice President of Service Provider Marketing, Cisco, and Light Reading’s CEO & Founder Steve Saunders give an overview of Upskill U.
    LRTV Custom TV
    ZTE TV Connect Highlights

    5|3|16   |     |   (0) comments


    ZTE gives us a tour of its booth and new products at TV Connect in London.
    LRTV Custom TV
    Deluxe's Unified Delivery Solution

    5|3|16   |     |   (0) comments


    Join Alan Breznick of Light Reading and visit the Deluxe booth at NAB! Here you'll find Deluxe's Unified Delivery Solution, OTT video, virtual reality, HDR, 4K and much more!
    LRTV Interviews
    Verizon Puts Gray Boxes in the Shade

    5|2|16   |   04:33   |   (1) comment


    When it comes to the white box trend, "gray" boxes, which have a slight proprietary twist, don't give service providers and end users the advantages they're seeking, according to Verizon's Vice President of Product and New Business Innovation Shawn Hakl.
    LRTV Custom TV
    Dealing With a Disrupted Video Market

    5|2|16   |     |   (0) comments


    Ericsson's Simon Frost discusses how traditional pay-TV providers can cope with the big changes wrought by the rise of OTT video and IP technology.
    LRTV Custom TV
    The VNF Responsibility of Red Hat

    5|2|16   |     |   (0) comments


    At MWC, Caroline Chappell of Heavy Reading visits the Red Hat booth and sits down with Chris Wright to talk about the responsibility the VNF needs to take on in order to ensure the operators get the carrier-grade performance they expect for their network.
    LRTV Interviews
    AT&T Expert on the Key Pillars of UC

    4|29|16   |   03:58   |   (0) comments


    Vishy Gopalakrishnan, AVP of product marketing at AT&T, talks about the three developments that are making unified communications and collaboration secure and reliable for enterprise users.
    LRTV Documentaries
    LRTV Report: Mobile Core Innovation

    4|28|16   |   25:32   |   (0) comments


    Hear from multiple industry experts from Deutsche Telekom, SK Telecom, Heavy Reading, Huawei, Cisco, Ericsson, Nokia, NEC and many more about developments in the mobile core as operators virtualize their IMS and evolved packet core systems and prepare for a 5G world.
    LRTV Huawei Video Resource Center
    NFV World Congress Highlight

    4|26|16   |     |   (0) comments


    The highlight of the NFV World Congress contains exciting telecom news. Join us for an inside look at Huawei's ICT 2020 plan and its latest collaboration with industry leaders.
    LRTV Interviews
    Unified Comms Finds Its Voice

    4|25|16   |   03:44   |   (0) comments


    Peter Quinlan, VP of UCC Product Management at Tata Communications, talks about the evolution of the unified communications and collaboration services sector and how voice is now a big part of current developments.
    LRTV Documentaries
    So... What Do We Do Now?

    4|25|16   |   03:24   |   (0) comments


    After a long hiatus, Max Dingman, the CEO of a GeeGhiz, returns for a motivational board room pep talk.
    LRTV Documentaries
    NAB 2016 Highlights

    4|21|16   |     |   (0) comments


    Light Reading's Cable/Video Practice Leader Alan Breznick climbs down from the slots to tell us about the latest news in broadcast technology at NAB 2016 in Las Vegas.
    Between the CEOs
    CEO Chat: Deepfield's Craig Labovitz

    4|21|16   |     |   (0) comments


    In this latest installment of the CEO Chat series, Craig Labovitz, co-founder and CEO of Deepfield, sits down with Light Reading's Steve Saunders in Light Reading's New York City office to discuss how Deepfield fits in with the big data trend and more.
    Upcoming Live Events
    May 23, 2016, Austin, TX
    May 23, 2016, Austin Convention Center
    May 24-25, 2016, Austin Convention Center, Austin, TX
    September 13-14, 2016, The Curtis Hotel, Denver, CO
    December 6-8, 2016,
    June 16-18, 2017, Austin Convention Center, Austin, TX
    All Upcoming Live Events
    Infographics
    A new survey conducted by Heavy Reading and TM Forum shows that CSPs around the world see the move to digital operations as a necessary part of their overall virtualization strategies.
    Hot Topics
    Ultra-Broadband Summit, Hong Kong
    Iain Morris, News Editor, 4/27/2016
    WiCipedia: Woman Cards & Bitch Switches
    Sarah Thomas, Director, Women in Comms, 4/29/2016
    Amazon AWS Reports $2.6B Quarterly Revenue, Up a Colossal 64%
    Mitch Wagner, West Coast Bureau Chief, Light Reading, 4/28/2016
    FCC Poised to Re-Regulate Wholesale Access
    Carol Wilson, Editor-at-large, 4/28/2016
    LoRa Alliance Defends Tech Against Sigfox Slur
    Iain Morris, News Editor, 4/28/2016
    Like Us on Facebook
    Twitter Feed
    BETWEEN THE CEOs - Executive Interviews
    In this latest installment of the CEO Chat series, Craig Labovitz, co-founder and CEO of Deepfield, sits down with Light Reading's Steve Saunders in Light Reading's New York City office to discuss how Deepfield fits in with the big data trend and more.
    Grant van Rooyen, president and CEO of Cologix, sits down with Steve Saunders, founder and CEO of Light Reading, in the vendor's New Jersey facility to offer an inside look at the company's success story and discuss the importance of security in the telecom industry.
    Animals with Phones
    Sloth Mail Click Here
    Sloth mail -- somehow even slower than snail mail.
    Live Digital Audio

    Of all the tech companies in the Valley, Intel has made the most aggressive commitment to building a diverse and inclusive workplace culture. It's doing so by taking concrete, measurable steps, making a large financial investment and through a commitment to complete transparency about its progress. In this radio show, WiC Director Sarah Thomas will be joined by Shlomit Weiss, Intel's Vice President, Data Center Group, and General Manager of Networking Engineering, who will share with us why Intel is tackling this huge challenge, how and to what effect. She will also discuss her unique experiences leading development of Client SOC development in the past and today leading development of all of the chipmaker's silicon hardware for networking IPs and discrete devices and managing a team of 600 engineers across Israel, Europe and the US.