Thursday, 5 December 2013
Its Just a LAN That Needs Securing
Imagine if you would the following conversation between the Captain and Co-Pilot of a commercial airliner as they prepare the plane for take off
Captain: “Fuel”? Co-Pilot: “Check”
Captain: “Flaps set”? Co-Pilot: “Check”
Captain: “Doors secured”? Co-Pilot: “err no”
Clearly no airline crew would progress the check any further, the doors would be secured before the check was run again to ensure the plane was in the right condition to fly.
Now imagine the same style of conversation between the CTO and Head of Networks of a Mobile Network Operator ahead of an LTE network launch
CTO: “Internet Secured”? Head of Networks: “Check”
CTO: “Roaming Network Secured”? Head of Networks: “Check”
CTO: “LTE Access Network secured”? Head of Networks: “err no”
Why is it then, according to the (Heavy Reading white paper The security Vulnerabilities of LTE: Opportunity and Risks for Operators) that given the above read out, some 50% of LTE cell sites will remain unsecured by 2016?
Are Mobile Network Operators really still prepared to go ahead and launch their LTE service, in full knowledge that a major part of the network remains unsecured?
No CTO or Head of Networks would dream of launching a network service that delivers Internet access without fully securing the Internet link.
Isn’t it time that the industry woke up to the fact that the LTE access network presents a clear and present security risk and should be treated in the same way an Internet connection would be?
Maybe it’s a confusion of ownership and trust? “I don’t own what’s beyond the link to the Internet or to my roaming partners so I had better place a security barrier between us and treat the other side of that barrier as un-trusted. I DO own the LTE access network out to the cell tower and therefore I trust it”.
Clearly if this is the case, it’s a misguided assumption.
Think of an LTE Network as essentially 4 separate Ethernet LAN’s connected by an Ethernet switch. You have the Internet LAN (SGi), the Roaming LAN (S8), the Evolved Packet Core LAN (S1) and the LTE Access LAN (S1).
Historically, an Enterprise looking at that kind of configuration would have determined which of the networks were trusted and which were un-trusted and put the un-trusted networks behind a firewall.
Then, they would either prohibit ALL originating inbound traffic from that interface or open up an Application Level Gateway or ALG for specific originating traffic only to be allowed through.
The reality of today is and has been the case for some time, is that the trusted network is dead.
Not only would each of the above ports be secured by a fully featured firewall but devices attaching to the ‘owned’ LAN’s would typically be protected by techniques such as UAC so that each device is not only checked for validity but also security threats from viruses / Trojans etc.
The key thing here is NONE of the networks would be left unprotected.
Looking conceptually at the LTE Access (S1) ‘LAN’ for a moment, the primary reason for securing it is maintaining network uptime. The threat vector is predominantly one of rogue denial of service attacks that threatens the gold standard of 99.999% uptime.
It’s a LAN that potentially consists of a large number of ‘bridges’ (eNodeB’s) beyond which millions of devices (handsets and tablets) sit. The devices themselves are authenticated via the SIM process which is fine but there are two other major threat vectors to be wary of
Rogue devices connecting to the downstream side of an authentic ‘bridge’ and initiating DDOS type attacksRogue un-authenticated ‘bridges’ connecting to the network from which DDOS type attacks could be launched.With that type of threat vector, the most appropriate solution would be to ensure that all ‘bridge’ ports were secured so no rogue device could access them and to put in place security to prevent rogue bridges entering the network in the first place.
Given the potential locations these ‘bridges’ may be found in THE most appropriate way to provide security for both of the above is via a centralised, high capacity, high functionality SecGW firewall device capable of encrypting, rate limiting and firewalling access as necessary for this most crucial of ‘LAN’ ports.
From a Juniper Networks perspective, The SRX5800 provides an ideal and common solution to ALL of the security needs outlined above, covering the SGi, S8 and S1 interface requirements at a level of functionality and scale unmatched in the industry. There is a 20 minute talking head video here that outlines some of the key points raised in this blog. Please feel free to pass comments back on this blog or the video.
At the end of the day it’s just a LAN that needs securing.
Building a new mobile backhaul network for tomorrow's needs
In the past, every mobile generation wave was defining all the elements, from radio, to RAN, backhaul and core of the network. The technology cycles where longer and dictated by the industry.
Nowadays, we find mobile operators in certain countries still awarding their 3G licenses, while in some other countries they are deploying LTE, in some other testing LTE-A and in some places discussing 5G. If you are the guy in charge of defining the Mobile Backhaul (MBH) strategy, you better look at requirements for the next few technologies to not fall short. The different MBH requirements aren't just about capacity, but also about more accurate timing and synchronization, lower latency, more flexibility in defining routes, security...
In the attached video-presentation, I explain at high level what is our vision for Mobile Backhaul and some recommendations on how to evolve it. Designing a seamless network from the begin, will simplify it's evolution towards service abstraction and service enrichment.
Technologies such as seamless-MPLS, SDN and NFV will be key!
Link to presentation
Tuesday, 18 June 2013
In the Google age, approach to education needs a rethink
Would a person with good handwriting, spelling and grammar and instant recall of multiplication tables be considered a better candidate for a job than, say, one who knows how to configure a peer-to-peer network of devices, set up an organisation-wide Google calendar and find out where the most reliable sources of venture capital are, I wonder? The former set of skills is taught in schools, the latter is not.
In school examinations, learners must reproduce facts from memory, solve problems using their minds and paper alone. They must not talk to anyone or look at anyone else’s work. They must not use any educational resources, certainly not the Internet.
When they complete their schooling and start a job, they are told to solve problems in groups, through meetings, using every resource they can think of. They are rewarded for solving problems this way — for not using the methods they were taught in school.
The curriculum lists things that children must learn. There is no list stating why these things are important. A child being taught the history of Vikings in England says to me: “We could have found out all that in five minutes if we ever needed to.”
One of the teachers who works with me said to her class of nine-year-olds: “There is something called electromagnetic radiation that we can’t see, can you figure out what it is?”
The children huddle around a few computers, talking, running around and looking for clues. In about 40 minutes, they figure out the basics of electromagnetism and start relating it to mobile signals.
One of them says: “Aren’t we going to do any work?”
“What do you think you were doing?” asks the teacher.
If examinations challenge learners to solve problems the way they are solved in real life today, the educational system will change forever. It is a small policy change that is required. Allow the use of the Internet and collaboration during an examination.
If we did that to exams, the curriculum would have to be different. We would not need to emphasise facts or figures or dates. The curriculum would have to become questions that have strange and interesting answers. “Where did language come from?”, “Why were the pyramids built?”, “Is life on Earth sustainable?”, “What is the purpose of theatre?”. Questions that engage learners in a world of unknowns. Questions that will occupy their minds through their waking hours and sometimes their dreams.
Teaching in an environment where the Internet and discussion are allowed in exams would be different. The ability to find things out quickly and accurately would become the predominant skill. The ability to discriminate between alternatives, then put facts together to solve problems would be critical. That is a skill that future employers would admire immensely.
In this kind of self-organised learning, we do not need the same teachers all the time. Any teacher can cause any kind of learning to emerge. A teacher does not need to be physically present, she could be a projected, life-sized image on the wall.
A Granny Cloud of such volunteer teachers have been operating out of the United Kingdom and a few other countries into schools in India and South America for more than five years.
We do not need to improve schools. We need to reinvent them for our times, our requirements and our future. We do not need efficient clerks to fuel an administrative machine that is no longer needed. Machines will do that for us.
We need people who can think divergently, across outdated disciplines, connecting ideas across the entire mass of humanity. We need people who can think like children. THE GUARDIAN
Dr Sugata Mitra is professor of educational technology at Newcastle University and the winner of the TED Prize this year. He devised the Hole in the Wall experiment, where a computer was embedded in a wall in a slum in New Delhi for children to use freely. He aimed to prove young people could be taught to use computers easily without formal training.
(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) {return;} js = d.createElement(s); js.id = id; js.src = "http://connect.facebook.net/en_US/all.js#xfbml=1"; fjs.parentNode.insertBefore(js, fjs); }(document, "script", "facebook-jssdk"));