Nokia is maintaining its strategic emphasis on network security and may have some plausible claims to be ahead of its major vendor rivals – but it still has a lot of questions to answer.

Patrick Donegan, Founder and Principal Analyst, HardenStance

February 2, 2017

7 Min Read
Nokia's Efforts to Lead in Security

You get a sense of the challenge facing traditional telecom vendors in network security when you look at the financial results of some of the leading names in this space. Juniper, once a trail-blazer in security, just rounded off a terrible year for its security business, reporting fourth-quarter 2016 security revenues down 30% compared with a year earlier.

Meanwhile Check Point Software Technologies Ltd. (Nasdaq: CHKP), one of the market's strongest performers, has been widely lauded for growing revenues by 7% in 2016 compared with 2015.

There may be a consensus that cybersecurity is the number one issue for businesses in 2017 but converting fear of cyber threats into orders for security hardware and software is still hard work, even for the best of vendors.

Against this commercial background, Nokia Corp. (NYSE: NOK) has distinguished itself from its peers in being willing to make a strategic push around mobile network security. And last Friday, the company invited some industry analysts to Helsinki to update them on the company's strategy.

The big takeaway for me was that there is no let-up in Nokia's strategic emphasis on security. At the same time there's also no sign of any specific turbo-boost in the pipeline. The roadmap is being worked on to ensure that the leadership it has established relative to Ericsson AB (Nasdaq: ERIC) and Huawei Technologies Co. Ltd. is maintained. It seems to me that the gap is still significant. But it's still not so great that either of its main rivals couldn't close it with a year or two of investment and supporting organizational realignment.

Let's start with LTE security. Nokia was early to ship eNode Bs with PKI certificates pre-installed and early with its own PKI certification authority. It was also quick to resell Juniper Networks Inc. (NYSE: JNPR)'s SRX platform for a Security Gateway (SeG) that could do the basic decryption of S1 traffic at the hand off to the core as well as support firewalling and other security features at that interface.

The update here is that post-Alcatel-Lucent acquisition, the positioning of the former Alcatel-Lucent 7750 Service Router as Nokia's new LTE SEG (security gateway) platform is well underway. Nokia claims to be number one in LTE security: Given the high concentration of LTE security deployments Europe, and given that Nokia was first to market with an end to end solution, the claim is certainly plausible.

Just as interesting, though in a different way, is the company's claim to be number one in Gi Firewall deployments. Nokia claims more than 70 deployments here, including some where it has been contracted to implement the Gi Firewall in front of the mobile packet core or EPC of other vendors.

Let's consider Nokia's "70" number for a moment. There are more than 700 mobile operators worldwide, which means Nokia is claiming market leadership having deployed at less than 10% of the total addressable market. Forget for a minute whether Ericsson, Cisco Systems Inc. (Nasdaq: CSCO) or Huawei have deployed more or less Gi Firewalls than Nokia: The striking thing about Nokia's number to me is what is says about the number of mobile operators worldwide that are still running their mobile packet core or EPC without any Gi Firewall at all.

That there are some doesn't come as a surprise -- I've heard it before and Nokia reaffirmed it on Friday. But that it could be a lot more than just "a few" -- i.e. by implication, it could easily be as many as one in three -- came as a surprise to me. What are these operator folks thinking, exactly? Let me guess: "It won't happen to me"?

Sales of Nokia's NetGuard network-based mobile malware detection solution sound as though they remain sluggish rather than spectacular, with a couple of Tier 1 operators in each major region reportedly using it now. Being focused on helping mobile operators detect and remediate malware once it's already made it onto a smartphone, Nokia doesn't generate the same headlines as security vendors that compete to be first to discover new malware.

But the fact that Nokia's tracking of mobile malware infection rates -- based on seeing hundreds of thousands of mobile malware samples -- is showing an upward trend worldwide aligned with what CTIA reports seeing in the US is something with which few other vendors can compete. Additionally, NetGuard customers benefited from its warning of a big increase in brute force auditing against Telnet servers during the early part of the fall of last year. According to Nokia, it was only subsequently that the Mirai botnet that carried out the attacks on Dyn was identified as the probable cause of that surge.

Consistent with Nokia's targeting of the IoT market, NetGuard is being evolved as the security module for its IMPACT platform for IoT. (See Nokia Aims for Big IMPACT in Enterprise IoT.)

I suspect "slow-ish" rather than "spectacular" also accurately describes sales of Nokia's SS7 security solution, if only because this is still a very nascent market. Operators are initially interested in monitoring what type of traffic is coming into their networks via their STPs (signal transfer points) before they decide exactly what -- if anything -- to do about it. My sense is that Nokia's play here is a flag in the ground targeting the legacy SS7 protocol but that this may serve as a platform from which a more ambitious security solution could evolve over time, potentially targeting newer protocols such as Diameter.

The analyst event was held in conjunction with the Nokia Hackathon. This year, around 150 hackers participated in taking a crack at breaking into Nokia's own network infrastructure as well as that of its operator customer, Elisa Corp. . This was around twice as many as last year's event. The goal is to serve up products with fewer vulnerabilities as well as shorten product development cycles.

Another Nokia Hackathon will be held in the US later this year. The company is also working on resourcing an ongoing bug bounty program for rewarding those that identify vulnerabilities in its products. This is increasingly common in the B2C worlds: I suspect Nokia will be among the first telecom network infrastructure vendors to introduce one in the B2B context.

There were a number of other indicators of strategic intent during the day in the areas of DDoS protection, vulnerability management and IoT security that I'll be watching out for in future.

When the bar is set so low by its peers, it's difficult to avoid being moved by the positives of Nokia's approach to network security. But there are criticisms to be made. For example, except for leveraging it for the new SEG platform, the new router side of the Nokia house doesn't feature prominently enough in the company's security vision for my taste.

There's potential for mainstream network routers to take on a greater role in security policy enforcement in more software programmable telecom networks. Juniper already has a reasonably well developed story here. Nokia could potentially do with one too (or at least an explanation of why this isn't a roadmap the company buys into).

Moreover, many of those same mobile operators that take delivery of an SEG based on the 77XX will already have other physical and virtualized iterations of the same platform deployed throughout their network, including as a cell site gateway. There are opportunities to leverage the 77XX series for security, such as by dropping malicious traffic at the cell site as well as having it apply decryption and other security policies as an SEG deeper in the network.

I've no doubt some of Nokia's folks are thinking about these kinds of things. And yes, perhaps it was too early to talk about them on Friday. All the same I can't help thinking that even some small mention of some kind would help bring all of the company's potential security assets together in a more rounded way. Watch this space -- I will.

— Patrick Donegan, Founder & Principal Analyst, HardenStance

Read more about:

Europe

About the Author(s)

Patrick Donegan

Founder and Principal Analyst, HardenStance

Patrick is the Founder and Principal Analyst of HardenStance Ltd, a leading analyst firm providing best in class research, analysis and insight in telecom and IT security. A lot of Patrick's research is focused on best practise for telecom operators in securing their own networks and providing security services to end customers. In recent years his research has focused increasingly on the security opportunities and threats presented by the telecom sector's efforts to evolve to more software controlled networking including the evolution in network security requirements from 4G to 5G. Patrick has worked in the telecom sector for over 25 years, including in strategic planning roles for Motorola as well as for Nortel's mobile infrastructure business. Prior to forming HardenStance Ltd in January 2017, he worked for eleven years at Heavy Reading, the last three as Heavy Reading's Chief Analyst.

Subscribe and receive the latest news from the industry.
Join 62,000+ members. Yes it's completely free.

You May Also Like