& cplSiteName &

Network Security: It's Complicated

Michelle Donegan
Prime Reading
Michelle Donegan
4/28/2014
50%
50%

Increasing network complexity, more sophisticated attacks, and a general lack of security awareness among consumers are just some of the challenges that mobile operators face as they work to protect their networks and customers.

That's the view from Håkan Kvarnström, chief security officer at Telia Company , an international operator with 189 million subscribers from operations in 15 Nordic and Baltic countries, Eurasia and Spain, as well as associated companies in Russia, Turkey, and Latvia.


All the major security challenges facing mobile operators will be analyzed and discussed at the one-day Mobile Network Security Strategies event, May 21 at The Thistle Marble Arch hotel in London.


In a recent interview with Light Reading, Kvarnström shared his thoughts on the type of network attack that worries him most and how the threat landscape is changing for mobile network operators, as well as for their customers.

For Kvarnström, the most serious network attack would be one that steals customer data and compromises users' privacy, rather than one that causes a network outage.

"Of course, it's serious if the network goes down, but that's reversible -- we can do something about it," he said, adding that once the network has been restored there is no further damage to the customer. "That's not as far-reaching as losing data."

When a customer's privacy has been violated, the harm has lasting effects. An attacker can track a person's entire life by various means, such as tapping in to location data, gaining access to call records, or even listening to voice traffic and looking into SMS messages.

Don't mess with Hakan Kvarnstrom -- he's head of security...
Don't mess with Håkan Kvarnström -- he's head of security...

It's complicated...
But the biggest threat of all for mobile operators is not a certain kind of network attack, in Kvarnström's view. Rather, it is ever-increasing network complexity.

"Complexity is security's worst enemy and that is what security people are struggling with," he said.

Mobile networks are becoming more complicated as a result of having to support many different devices and technologies, such as 2G, 3G, 4G, and eventually 5G, he explained. Added to that, machine-to-machine (M2M) communications is causing a further proliferation of devices on the network. Overall, the IT environment, and the services a mobile operator provides, are becoming more complex, he said.

While TeliaSonera does what it can on its network to thwart attacks, deter the theft of data, and minimize service disruption, Kvarnström said it's more difficult to protect all customers all the time when they can inadvertently install harmful software onto their devices by downloading free applications.

"On the terminal side, it's a much bigger problem because it involves the behavior of the user," he said. "As long as it's free, they download anything. There is a lack of security awareness of what can happen. We need to help people understand the consequences of their actions."

But Kvarnström has noticed that user perceptions are starting to change. "People are becoming more aware of the risks when it comes to security," he said, adding that this was in part due to the Edward Snowden surveillance revelations.

At the same time, the legislative landscape is also changing as the European Commission is working on a proposal for new privacy rules this year.

Taken together, these changes in user perception and regional legislation add to the security challenge for mobile network operators, because they need to adapt their security strategies. "When the legislatures and users are changing the way they look [at the issue], the pressure on operators is becoming tougher to provide solutions to address the security problem," he said.

Sophisticated attacks
Meanwhile, the attacks on network operators are becoming more sophisticated.

"It's quite easy to become a hacker, but that's not limited to mobile services," said Kvarnström. "And when you can make money by hacking and selling data, that's when the threat increases."

He explained that network operators have been let off the hook somewhat when it comes to hacking, unlike banks, which have long been targets. But now, the pressure on operators is increasing because hackers are turning their attention to network operators and mobile users.

"There are a lot of nice apps and services people use that would be of interest to a hacker," he said.

When asked whether equipment vendors were doing enough to help operators meet their security goals, he said that all the solutions needed are available.

"It's about understanding your problem, having the solutions, and using them," he said simply. "There are no excuses and no big missing pieces."

Kvarnström's comments provide a glimpse into the breadth of the security challenge for mobile operators, which involves protecting not only their networks and services, but also the personal data of their customers, as well as their devices.

That means there's at least one certainty for Kvarnström and his ilk: A chief security officer's work is never done.

— Michelle Donegan, contributing editor, special to Light Reading


Want to learn more about this topic? Check out the agenda for Mobile Network Security Strategies, which will take place on May 21 at The Thistle Marble Arch hotel in London. For more on the event, including the stellar service provider speaker line-up, see the event's official site.


(8)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
5/10/2014 | 7:13:46 AM
Social Engineering
And this doesn't even begin to touch on the risks of social engineering -- which can sometimes become all the more ever-present in a highly complex environment.  (It's so much easier to just do what someone is telling or asking you to do, isn't it?)
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/30/2014 | 5:39:21 PM
Re: It's all there in this one quote
Hmmm. If that's your answer, then what's your definition of secure? All those can be "broken" easily.
briandnewby
50%
50%
briandnewby,
User Rank: Light Sabre
4/30/2014 | 2:15:42 PM
Re: It's all there in this one quote
It is fair at times to ask how things could be worse WITHOUT security.  I do think that many organizations (such as homes associations that require authentication to see a newsletter) provide bottom feeding opportunities to collect user info that can be used in bad ways on bigger sites. 

Less security in some cases might make us more secure overall.
brookseven
50%
50%
brookseven,
User Rank: Light Sabre
4/29/2014 | 1:33:17 PM
Re: It's all there in this one quote
Actually, to be completely frank...there is no possibility of perfect security.

I have posted here in the past the story of the Penetration Test done at the DoD by dropping Flash Drives in a parking lot.  People picked up and plugged in about 60% of the drives.  They were innocuous but connected back to report in.  Poof...all network security is bypassed.

So - problem 1 is stupid employees.

Next up is the problem of bribes/payoffs.  If somebody really wants some information, do you think one of your IT technicians might not take $1M for access?  This is why the electronic CALEA standard came about.  The mob was threatening and bribing CO Technicians when wiretaps were enabled.  

So - problem 2 is dishonest employees.

The thing is that you need to think about security, risk and inconvenience all at the same time.  We had custom ASIC files stolen.  Our initial solution was to take all the machines in the ASIC design team off-line.  We had people go through our garbage.  Shred everything...and I do mean everything.

We have been working on physical security for 1,000s of years.  And yet people still rob banks.  Your job in network security is to increase the cost and risk of a breach - knowning that they are impossible to completely stop.

So, write any buzzwords you want...it only means something if the information is not worth as much as the cost to extract it.

seven

 
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/29/2014 | 3:26:05 AM
Re: It's all there in this one quote
TDM. ATM. SMS. GPRS. WAP.
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/28/2014 | 9:57:26 PM
Re: It's all there in this one quote
That sounds like something written by a security analyst. What's both secure & simple?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
4/28/2014 | 6:20:39 PM
Irony
The irony is that the worst enemy of simplicity and accessibility is security.

What's that saying about "the enemy of my enemy"...?  :p
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/28/2014 | 1:19:09 PM
It's all there in this one quote
It's all there in this one quote: "Complexity is security's worst enemy and that is what security people are struggling with."
Light Reading’s Upskill U is a FREE, interactive, online educational resource that delivers must-have education on themes that relate to the overall business transformation taking place in the communications industry.
NEXT COURSE
Wednesday, July 27, 1:00PM EDT
The Changing Face of the Data Center World
Rodney M. Elder, Senior Solutions Architect, Equinix
UPCOMING COURSE SCHEDULE
Wednesday, August 3, 1:00PM EDT
The Central Office Re-Architected as a Data Center
Guru Parulkar, Executive Director, Open Networking Research Center, Open Networking Lab
Wednesday, August 10, 1:00PM EDT
Telcos & Open Source 101
Phil Robb, Senior Technical Director, OpenDaylight
Friday, August 12, 1:00PM EDT
The Role of Open Source in NFV
Jim Fagan, Director, Cloud Practice, Telstra
in association with:
From The Founder
The more things change, the more they stay the same for Juniper's next-gen comms solutions, and that's a good thing.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Custom TV
NetScout: Maximizing Enterprise Cloud for Digital Transformation

7|20|16   |   04:53   |   (0) comments


Light Reading Editor Mitch Wagner talks to NetScout CMO Jim McNiel about maximizing the benefits of enterprise cloud and digital transformation while minimizing potential pitfalls with a proper monitoring and instrumentation strategy.
Women in Comms Introduction Videos
Ciena's VP Offers a Career Crash Course

7|20|16   |   4:14   |   (0) comments


How did Ciena's Vice President of Sales, Angela Finn, carve out her career path? Simple, she tells WiC. She stayed true to her company, customers and principles. She shares her advice for women on how to be authentic and credible, as well as for companies that want to make a real change to their culture and practices.
LRTV Custom TV
NFV in 2016: Part 2 – Climbing the Virtualization Maturity Curve

7|19|16   |   06:56   |   (0) comments


Many of the initial use case implementations are single-vendor and self-contained. The industry is still climbing the virtualization maturity curve, needing further clarity and stability in the NFV infrastructure (NFVi) and greater availability and choice of virtualized network functions (VNFs). Interoperability between NFVis and VNFs from different vendors ...
Telecom Innovators Video Showcase
Versa Networks' Kumar Mehta on SD-WAN Managed Services

7|19|16   |     |   (0) comments


In Silicon Valley, Steve Saunders sits down with Versa's Kumar Mehta for an interview focused on why service providers are building SD-WAN managed services, and how Versa's telco customers are innovating.
LRTV Custom TV
Juniper Networks & The Evolution of NFV

7|19|16   |   06:01   |   (0) comments


Senior Juniper Networks executives talk to Light Reading Founder & CEO Steve Saunders about NFV developments and the recent independent evaluation by test lab EANTC of Juniper's Cloud CPE solution.
LRTV Interviews
CenturyLink Goes Beyond Managed WiFi

7|19|16   |     |   (0) comments


CenturyLink's managed WiFi allows enterprises, such as retailers and resorts, to track guest WiFi usage in order to help them better communicate with customers.
LRTV Interviews
AT&T Launches Network Functions on Demand

7|17|16   |   05:26   |   (0) comments


Roman Pacewicz, Senior Vice President, Offer Management & Service Integration, AT&T Business Solutions, discusses the operator's launch of its Network Functions on Demand service.
LRTV Interviews
Enterprise Pitch for Ciscosson

7|14|16   |   04:43   |   (0) comments


After seven months of near silence, Cisco and Ericsson executives publicly discussed details on their extensive partnership. Among the tidbits shared by Martin Zander, VP, group strategy programs, Ericsson, and Doug Webster, VP service provider marketing, Cisco: The partnership was initially launched to serve the service provider market, but is already gaining ...
Wagner’s Ring
Cisco Faces Up to Hypercloud Threat

7|13|16   |   02:42   |   (0) comments


Facebook, Amazon and Google mostly don't buy branded technology for their networks – they build their own. That's a threat to Cisco – and its competitors too – which face potentially dwindling demand for their product. Is Cisco up to the challenge? Light Reading went to the annual Cisco Live conference to find out.
LRTV Huawei Video Resource Center
Building a Better Connected Russia

7|13|16   |     |   (0) comments


At UBBS World Tour 2016, Alla Shabelnikova of Ovum shares the findings of a white paper outlining the challenges and opportunities of broadband rollout in Russia.
LRTV Huawei Video Resource Center
The Global Video Business

7|13|16   |     |   (0) comments


At UBBS World Tour 2016, Roger Feng of Huawei shares insights on the future of video business.
LRTV Huawei Video Resource Center
UBBS World Tour Moscow Highlights

7|13|16   |     |   (0) comments


At UBBS World Tour 2016 at Moscow, Huawei showcases its outstanding progress in video technology.
Upcoming Live Events
September 13-14, 2016, The Curtis Hotel, Denver, CO
September 27, 2016, Philadelphia, PA
November 3, 2016, The Montcalm Marble Arch, London
November 30, 2016, The Westin Times Square, New York City
December 6-8, 2016,
May 16-17, 2017, Austin Convention Center, Austin, TX
All Upcoming Live Events
Infographics
Five of the Top 10 most targeted countries in Check Point Software Technologies' global Malware & Threat Index for Q1 2016 are in Africa.
Hot Topics
SoftBank Muscles In on ARM in $32B Deal
Iain Morris, News Editor, 7/18/2016
Ericsson 'Doubles' Savings Goal as Sales Slump
Iain Morris, News Editor, 7/19/2016
Kevin Lo's Move to Facebook: Sign of Things to Come?
Patrick Donegan, Chief Analyst, Heavy Reading, 7/20/2016
Verizon's Next With VNFs
Carol Wilson, Editor-at-large, 7/21/2016
Facebook Gets Its Drone On
Ray Le Maistre, Editor-in-chief, 7/22/2016
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
There's no question that, come 2020, 5G technology will turn the world's conception of what mobile networking is on its head. Within the world of 5G development, Dr. ...
I've enjoyed interviewing many interesting people since I rejoined Light Reading, but William A. "Bill" Owens certainly takes the biscuit, as we say where I come from.
Live Digital Audio

Our world has evolved through innovation from the Industrial Revolution of the 1740s to the information age, and it is now entering the Fourth Industrial Revolution, driven by technology. Technology is driving a paradigm shift in the way digital solutions deliver a connected world, changing the way we live, communicate and provide solutions. It can have a powerful impact on how we tackle some of the world’s most pressing problems. In this radio show, Caroline Dowling, President of Communications Infrastructure & Enterprise Computing at Flex, will join Women in Comms Director Sarah Thomas to discuss the impact technology has on society and how it can be a game-changer across the globe; improving lives and creating a smarter world. Dowling, a Cork, Ireland, native and graduate of Harvard Business School's Advanced Management Program, will also discuss her experience managing an international team focused on innovation in an age of high-speed change.