Light Reading
Complexity is security's worst enemy, says TeliaSonera's chief security officer.

Network Security: It's Complicated

Michelle Donegan
Prime Reading
Michelle Donegan
4/28/2014
50%
50%

Increasing network complexity, more sophisticated attacks, and a general lack of security awareness among consumers are just some of the challenges that mobile operators face as they work to protect their networks and customers.

That's the view from Håkan Kvarnström, chief security officer at TeliaSonera AB (Nasdaq: TLSN), an international operator with 189 million subscribers from operations in 15 Nordic and Baltic countries, Eurasia and Spain, as well as associated companies in Russia, Turkey, and Latvia.


All the major security challenges facing mobile operators will be analyzed and discussed at the one-day Mobile Network Security Strategies event, May 21 at The Thistle Marble Arch hotel in London.


In a recent interview with Light Reading, Kvarnström shared his thoughts on the type of network attack that worries him most and how the threat landscape is changing for mobile network operators, as well as for their customers.

For Kvarnström, the most serious network attack would be one that steals customer data and compromises users' privacy, rather than one that causes a network outage.

"Of course, it's serious if the network goes down, but that's reversible -- we can do something about it," he said, adding that once the network has been restored there is no further damage to the customer. "That's not as far-reaching as losing data."

When a customer's privacy has been violated, the harm has lasting effects. An attacker can track a person's entire life by various means, such as tapping in to location data, gaining access to call records, or even listening to voice traffic and looking into SMS messages.

Don't mess with Hakan Kvarnstrom -- he's head of security...
Don't mess with Håkan Kvarnström -- he's head of security...

It's complicated...
But the biggest threat of all for mobile operators is not a certain kind of network attack, in Kvarnström's view. Rather, it is ever-increasing network complexity.

"Complexity is security's worst enemy and that is what security people are struggling with," he said.

Mobile networks are becoming more complicated as a result of having to support many different devices and technologies, such as 2G, 3G, 4G, and eventually 5G, he explained. Added to that, machine-to-machine (M2M) communications is causing a further proliferation of devices on the network. Overall, the IT environment, and the services a mobile operator provides, are becoming more complex, he said.

While TeliaSonera does what it can on its network to thwart attacks, deter the theft of data, and minimize service disruption, Kvarnström said it's more difficult to protect all customers all the time when they can inadvertently install harmful software onto their devices by downloading free applications.

"On the terminal side, it's a much bigger problem because it involves the behavior of the user," he said. "As long as it's free, they download anything. There is a lack of security awareness of what can happen. We need to help people understand the consequences of their actions."

But Kvarnström has noticed that user perceptions are starting to change. "People are becoming more aware of the risks when it comes to security," he said, adding that this was in part due to the Edward Snowden surveillance revelations.

At the same time, the legislative landscape is also changing as the European Commission is working on a proposal for new privacy rules this year.

Taken together, these changes in user perception and regional legislation add to the security challenge for mobile network operators, because they need to adapt their security strategies. "When the legislatures and users are changing the way they look [at the issue], the pressure on operators is becoming tougher to provide solutions to address the security problem," he said.

Sophisticated attacks
Meanwhile, the attacks on network operators are becoming more sophisticated.

"It's quite easy to become a hacker, but that's not limited to mobile services," said Kvarnström. "And when you can make money by hacking and selling data, that's when the threat increases."

He explained that network operators have been let off the hook somewhat when it comes to hacking, unlike banks, which have long been targets. But now, the pressure on operators is increasing because hackers are turning their attention to network operators and mobile users.

"There are a lot of nice apps and services people use that would be of interest to a hacker," he said.

When asked whether equipment vendors were doing enough to help operators meet their security goals, he said that all the solutions needed are available.

"It's about understanding your problem, having the solutions, and using them," he said simply. "There are no excuses and no big missing pieces."

Kvarnström's comments provide a glimpse into the breadth of the security challenge for mobile operators, which involves protecting not only their networks and services, but also the personal data of their customers, as well as their devices.

That means there's at least one certainty for Kvarnström and his ilk: A chief security officer's work is never done.

— Michelle Donegan, contributing editor, special to Light Reading


Want to learn more about this topic? Check out the agenda for Mobile Network Security Strategies, which will take place on May 21 at The Thistle Marble Arch hotel in London. For more on the event, including the stellar service provider speaker line-up, see the event's official site.


(8)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
5/10/2014 | 7:13:46 AM
Social Engineering
And this doesn't even begin to touch on the risks of social engineering -- which can sometimes become all the more ever-present in a highly complex environment.  (It's so much easier to just do what someone is telling or asking you to do, isn't it?)
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/30/2014 | 5:39:21 PM
Re: It's all there in this one quote
Hmmm. If that's your answer, then what's your definition of secure? All those can be "broken" easily.
briandnewby
50%
50%
briandnewby,
User Rank: Light Sabre
4/30/2014 | 2:15:42 PM
Re: It's all there in this one quote
It is fair at times to ask how things could be worse WITHOUT security.  I do think that many organizations (such as homes associations that require authentication to see a newsletter) provide bottom feeding opportunities to collect user info that can be used in bad ways on bigger sites. 

Less security in some cases might make us more secure overall.
brookseven
50%
50%
brookseven,
User Rank: Light Sabre
4/29/2014 | 1:33:17 PM
Re: It's all there in this one quote
Actually, to be completely frank...there is no possibility of perfect security.

I have posted here in the past the story of the Penetration Test done at the DoD by dropping Flash Drives in a parking lot.  People picked up and plugged in about 60% of the drives.  They were innocuous but connected back to report in.  Poof...all network security is bypassed.

So - problem 1 is stupid employees.

Next up is the problem of bribes/payoffs.  If somebody really wants some information, do you think one of your IT technicians might not take $1M for access?  This is why the electronic CALEA standard came about.  The mob was threatening and bribing CO Technicians when wiretaps were enabled.  

So - problem 2 is dishonest employees.

The thing is that you need to think about security, risk and inconvenience all at the same time.  We had custom ASIC files stolen.  Our initial solution was to take all the machines in the ASIC design team off-line.  We had people go through our garbage.  Shred everything...and I do mean everything.

We have been working on physical security for 1,000s of years.  And yet people still rob banks.  Your job in network security is to increase the cost and risk of a breach - knowning that they are impossible to completely stop.

So, write any buzzwords you want...it only means something if the information is not worth as much as the cost to extract it.

seven

 
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/29/2014 | 3:26:05 AM
Re: It's all there in this one quote
TDM. ATM. SMS. GPRS. WAP.
pcharles09
50%
50%
pcharles09,
User Rank: Light Beer
4/28/2014 | 9:57:26 PM
Re: It's all there in this one quote
That sounds like something written by a security analyst. What's both secure & simple?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Light Sabre
4/28/2014 | 6:20:39 PM
Irony
The irony is that the worst enemy of simplicity and accessibility is security.

What's that saying about "the enemy of my enemy"...?  :p
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
4/28/2014 | 1:19:09 PM
It's all there in this one quote
It's all there in this one quote: "Complexity is security's worst enemy and that is what security people are struggling with."
Flash Poll
From The Founder
It's clear to me that the communications industry is divided into two types of people, and only one is living in the real world.
LRTV Custom TV
Advantech Accelerates 100G Traffic Handling

10|17|14   |   7:56   |   (0) comments


Paul Stevens from Advantech explains why handling 100GbE needs a whole new platform design approach and how Advantech is addressing the needs of equipment providers and carriers to give them the flexibility and performance they will need for SDN and NFV deployment.
LRTV Huawei Video Resource Center
Holland's Imtech Traffic & Infra Discusses Huawei's ICT Solution and Services

10|16|14   |   4:49   |   (0) comments


Dimitry Theebe is from the business unit at Imtech Traffic & Infra which delivers communications solutions for transportations. His partnershp with Huawei began about a years ago. In this video, Theebe speaks more about this partnership and what he hopes to accomplish with Huawei.
LRTV Huawei Video Resource Center
Huawei's Comprehensive Storage Solutions Vital for SVR

10|16|14   |   6:16   |   (0) comments


SVR Information Technology provides cloud services for academic and special sectors. With Huawei's support, SVR and Yildiz Technical University has established Turkey's largest and most advanced High Performance Computing system. CSO Ismail Cem Aslan talks about what he hopes Huawei's OceanStor storage system will bring for him.
LRTV Huawei Video Resource Center
Mexico's Servitron's Impression of Huawei at CCW 2014

10|16|14   |   6:35   |   (0) comments


Servitron is a network operator in Mexico that has been in the trunking industry for the past 20 years. Its COO, Ing. Ragnar Trillo O., explains at Critical Communications World 2014 that his company has been interested in the long-term evolution of LTE technology and its adoption for TETRA.
LRTV Huawei Video Resource Center
Building a Better Dubai

10|16|14   |   2:06   |   (0) comments


Abdulla Ahmed Al Falasi is the director of commercial affairs, a telecommunications coordinator for the government of Dubai. Their areas of service span across multiple industries, including police, safety, shopping malls and more. In this video, Abdulla talks about his department's work with Huawei.
LRTV Huawei Video Resource Center
Huawei Lights Up Malaysia Partner Maju Nusa

10|16|14   |   1:59   |   (0) comments


Malaysia's Maju Nusa is an enterprise partner to Huawei in networking, route switches and telco equipment. At this year's Critical Communications World in Singapore, CTO Pushpender Singh talks about what Huawei's eLTE solutions mean to his company and for Malaysia.
LRTV Custom TV
Evolving From HFC to FTTH Networks

10|15|14   |   2:19   |   (0) comments


Cisco's Todd McCrum delves into the future of cable's HFC plant, examining how DOCSIS 3.1 and advanced video compression will extend its life and how the IP video transition will usher in GPON and EPON over FTTH.
LRTV Custom TV
Exploring the Future of Cable Access

10|15|14   |   6:23   |   (0) comments


Cisco's Brett Wingo looks at where cable access architectures are heading, discussing the impact of DOCSIS 3.1, CCAP, Remote PHY, SDN, virtualization of cable networks and related technologies.
LRTV Custom TV
Optimizing & Monetizing WiFi

10|15|14   |   5:53   |   (0) comments


Cisco's Vince Pandolfi outlines the reasons for cable WiFi's rapid growth, lays out the issues with the technology and explains the new Cisco tools that can help operators monitor and improve their WiFi delivery.
LRTV Huawei Video Resource Center
Emulex & Huawei Collaboration Mutually Beneficial

10|14|14   |   4:17   |   (0) comments


US company Emulex collaborates with Huawei in areas such as blade servers and workload documentation. Mike Heumann of Emulex believes that Huawei has done incredibly well moving from a telecom company into servers and networks, working closely with customers to realize their needs.
LRTV Huawei Video Resource Center
Chile's VZION Looks Forward to Seeing More of Huawei

10|14|14   |   4:43   |   (0) comments


VZION is a systems integrator company in Chile with a focus on virtulization technology. In this video, Cesar Alcacibar talks about the challenges in virtualization and how Huawei helps his company to achieve the best results possible. Alcacibar is expecting more adoption and integration of Huawei technologies in Chile.
LRTV Huawei Video Resource Center
Pro-Datech & Huawei for a High-Tech Singapore

10|14|14   |   2:59   |   (0) comments


Pro-Datech Systems is a specialty IT solution provider based in Singapore. For an added value to its customers, the company uses Huawei's hardware and trusted performance and features for a total solution. It's looking forward to the creation of a lab, to be based in Singapore, for the two companies' coorporation on total storage solution.
Upcoming Live Events
October 29, 2014, New York City
November 6, 2014, Santa Clara
November 11, 2014, Atlanta, GA
December 2, 2014, New York City
December 3, 2014, New York City
December 9-10, 2014, Reykjavik, Iceland
June 9-10, 2015, Chicago, IL
Infographics
WhoIsHostingThis.com presents six of the world's most extreme WiFi hotspots, enabling the most epic selfies you can imagine.
Hot Topics
Forget the Internet, Brace for Skynet
Stephen Saunders, 10/15/2014
HBO Will Go OTT in 2015
Mari Silbey, Independent Technology Editor, 10/15/2014
Google: Carriers & Cloud Providers Need to Cooperate
Mitch Wagner, West Coast Bureau Chief, Light Reading, 10/16/2014
CBS Takes OTT Plunge
Mari Silbey, Independent Technology Editor, 10/16/2014
Could Data Be the New 'Currency'?
Ray Le Maistre, Editor-in-chief, 10/16/2014
Like Us on Facebook
Twitter Feed