The past few weeks have provided a couple of poignant reminders of the security threats faced by communications service providers (CSPs) and how prominent security is becoming in the thinking of players through the communications services ecosystem.

Both of the high-profile recent examples originated in the UK, a market that is generally considered among the world's leaders in ICT security.

First, no lesser a brand name than Vodafone admitted that the account details of 1,827 UK customers had been remotely accessed in an attack using email addresses and passwords that may also have seen customer bank account details exposed. Vodafone admitted that the attack had left those customers "open to fraud" and had to block these customers' accounts.

On a far larger scale, Talk Talk, an ISP, is reeling from the impact of a massive polymorphic attack combining DDoS and data exposure. The attack resulted in the data of 156,959 of Talk Talk's UK customers being hacked, including 15,656 whose bank account numbers and sort codes were partially exposed. Talk Talk estimates its losses at £35 million (US$55 million). The company saw no less than a third of the value of its share price wiped out between October 9 and November 9. (See TalkTalk Plummets on Security Woes.)

We at Light Reading and Heavy Reading will be focusing on the ratcheting up of security threats in the CSP environment at our unique Carrier Network Security Strategies conference in New York on December 2. With the recent attacks on Vodafone and Talk Talk providing a backdrop from Europe, the North American and global perspectives at the conference will be provided by speakers from Verizon, Level 3, Telefonica and no less an industry thought leader than AT&T's Chief Security Officer Ed Amoroso.

To find out more about the upcoming conference, check out the Carrier Network Security Strategies event website.

It's noticeable just how many major vendors are re-aligning their security strategies to better position themselves for the CSP market. Security certainly weighed heavily in Ericsson's decision to partner Cisco Systems Inc. (Nasdaq: CSCO) on the remarkable scale that the two companies announced last week. Cisco's security story wasn't all that powerful three years ago, but it has invested tremendously in this area during the past three years, both in dedicated security products and in the security features across its product and services portfolio. Before last week, Ericsson AB (Nasdaq: ERIC) didn't have much of a network security story -- now it does. (See Cisco + Ericsson: Analyst Reactions.)

Juniper Networks Inc. (NYSE: JNPR), which stands to lose the most from the Cisco-Ericsson alliance, appointed a new Security CTO, Kevin Walker, just last week. Juniper will be speaking at our event. So too will Microsoft Corp. (Nasdaq: MSFT) and Symantec, both of which are fresh from major new re-orgs with respective to their security focus. Microsoft has made three security-related acquisitions in the last year, created a new managed services arm, Microsoft Enterprise Cybersecurity Group (ECG), and unveiled a state-of-the-art Cyber Defence Operations Center (CDOC) that will bring all its previously disparate security resources under one roof. The company's focus at our conference will nevertheless be squarely on the CSP segment, to the point where the company will be sharing case studies of recent security solution deployments with leading CSPs in Europe.

Last month Symantec Corp. (Nasdaq: SYMC) rolled out its Advanced Threat Protection (ATP) platform. Bringing together its previously separate enterprise security solutions, Symantec's CEO, Michael Brown, heralded the announcement as marking the beginning of a new Symantec. The strategy focuses on the company's position on enterprise security but that of course entails leveraging CSP partners as channels to market.

Arbor Networks, still operating as a separate brand following its acquisition by NetScout Systems Inc. (Nasdaq: NTCT), is participating in our event too. Like so many other sponsors, Arbor has recently undergone a product portfolio refresh. This is aimed in part at tailoring and packaging its DDoS protection portfolio for smaller CSPs with smaller security budgets than the Tier 1 and Tier 2 players that Arbor has traditionally served.

Among the other security vendors represented as both sponsors and regular attendees at the event, it will be interesting to see which, if any, are reeling from the "Ciscosson" deal. Which among them, for example, may have been waiting on OEM deals to go through with Ericsson which may now have been put on ice, if not frozen over for good?

Microsoft won't be the only company representing what us telecom folks choose to call the Over the Top (OTT) players at the conference -- Facebook 's Chris Bream is going to be giving the afternoon keynote in New York. Chris will make Facebook's case for better sharing of threat intelligence across the ICT ecosystem. A self-evidently good idea perhaps, but how exactly is that going to go down with other security ecosystem partners, some of whom count on their threat intelligence feeds for part of their competitive differentiation? And how many companies are keen on opening up on their bad experiences, especially when they've managed thus far to keep them out of the public domain?

Expect issues relating to traffic encryption to come up during the day. More and more attacks themselves are being encrypted by ever-smarter criminal hackers. How can CSPs or their customers deal with that? And with so much legitimate OTT traffic now being encrypted by the likes of Facebook and Microsoft, how is this going to impact each CSP's ability to efficiently and legally carry out malware detection and mitigation without negatively affecting the user experience?

Expect the CSPs' own security IP (intellectual property) to feature as well. How are some CSPs driving their own IP into the products of their security vendors these days? To what end? And how much of a competitive shortfall is going to be faced by those CSPs that can't or won't go down this road?

There are quite a few uncertainties that we'll be addressing on December 2. Among the greatest is... what will the morning keynote speaker, AT&T's Ed Amoroso, share with us this time? In past years, Amoroso has told us that perimeter security alone no longer works and that security strategy needs to focus on mobility and the cloud. Last year, he pointed to how encryption, containerization, proxy and run-time virtualization technologies will be key enablers.

There are 101 IT security events around the world but there's only one that's focused on the requirements of the CSP community that Light Reading and Heavy Reading serve. Join us in New York on December 2 and find out all about it.

— Patrick Donegan, Chief Analyst, Heavy Reading