Network Security: It's Complicated
Increasing network complexity, more sophisticated attacks, and a general lack of security awareness among consumers are just some of the challenges that mobile operators face as they work to protect their networks and customers.
That's the view from Håkan Kvarnström, chief security officer at Telia Company , an international operator with 189 million subscribers from operations in 15 Nordic and Baltic countries, Eurasia and Spain, as well as associated companies in Russia, Turkey, and Latvia.
In a recent interview with Light Reading, Kvarnström shared his thoughts on the type of network attack that worries him most and how the threat landscape is changing for mobile network operators, as well as for their customers.
For Kvarnström, the most serious network attack would be one that steals customer data and compromises users' privacy, rather than one that causes a network outage.
"Of course, it's serious if the network goes down, but that's reversible -- we can do something about it," he said, adding that once the network has been restored there is no further damage to the customer. "That's not as far-reaching as losing data."
When a customer's privacy has been violated, the harm has lasting effects. An attacker can track a person's entire life by various means, such as tapping in to location data, gaining access to call records, or even listening to voice traffic and looking into SMS messages.
But the biggest threat of all for mobile operators is not a certain kind of network attack, in Kvarnström's view. Rather, it is ever-increasing network complexity.
"Complexity is security's worst enemy and that is what security people are struggling with," he said.
Mobile networks are becoming more complicated as a result of having to support many different devices and technologies, such as 2G, 3G, 4G, and eventually 5G, he explained. Added to that, machine-to-machine (M2M) communications is causing a further proliferation of devices on the network. Overall, the IT environment, and the services a mobile operator provides, are becoming more complex, he said.
While TeliaSonera does what it can on its network to thwart attacks, deter the theft of data, and minimize service disruption, Kvarnström said it's more difficult to protect all customers all the time when they can inadvertently install harmful software onto their devices by downloading free applications.
"On the terminal side, it's a much bigger problem because it involves the behavior of the user," he said. "As long as it's free, they download anything. There is a lack of security awareness of what can happen. We need to help people understand the consequences of their actions."
But Kvarnström has noticed that user perceptions are starting to change. "People are becoming more aware of the risks when it comes to security," he said, adding that this was in part due to the Edward Snowden surveillance revelations.
At the same time, the legislative landscape is also changing as the European Commission is working on a proposal for new privacy rules this year.
Taken together, these changes in user perception and regional legislation add to the security challenge for mobile network operators, because they need to adapt their security strategies. "When the legislatures and users are changing the way they look [at the issue], the pressure on operators is becoming tougher to provide solutions to address the security problem," he said.
Meanwhile, the attacks on network operators are becoming more sophisticated.
"It's quite easy to become a hacker, but that's not limited to mobile services," said Kvarnström. "And when you can make money by hacking and selling data, that's when the threat increases."
He explained that network operators have been let off the hook somewhat when it comes to hacking, unlike banks, which have long been targets. But now, the pressure on operators is increasing because hackers are turning their attention to network operators and mobile users.
"There are a lot of nice apps and services people use that would be of interest to a hacker," he said.
When asked whether equipment vendors were doing enough to help operators meet their security goals, he said that all the solutions needed are available.
"It's about understanding your problem, having the solutions, and using them," he said simply. "There are no excuses and no big missing pieces."
Kvarnström's comments provide a glimpse into the breadth of the security challenge for mobile operators, which involves protecting not only their networks and services, but also the personal data of their customers, as well as their devices.
That means there's at least one certainty for Kvarnström and his ilk: A chief security officer's work is never done.
— Michelle Donegan, contributing editor, special to Light Reading
Want to learn more about this topic? Check out the agenda for Mobile Network Security Strategies, which will take place on May 21 at The Thistle Marble Arch hotel in London. For more on the event, including the stellar service provider speaker line-up, see the event's official site.