In recent years innovation has become a hallmark for the mobile industry, fueled by the proliferation of smartphone devices, developer communities and cloud service environments. As the pace of innovation continues, mobile networks are exposed to a variety of security threats when the ‘black hat’ and ‘white hat’ folks and other freelance hackers flex their devious might.
While there are numerous security attack vectors that can be targeted toward mobile networks, several important areas are emerging, particularly as networks migrate to LTE and all-IP environments. Notable examples include the following:
- End-point device security protection. Particularly protection against viruses, malware, ransomware and other malicious software that might attack individual subscribers, enterprises or possibly orchestrated storm attacks against mobile networks.
- Protection of network interfaces with authentication and encryption, such as IPsec. In the past many network interfaces have been deployed without security protection and opened opportunities for potentially catastrophic attacks.
- Hardening of open source software, recognizing the growing reliance on open source software in mobile network infrastructure platforms. The recent security problems with the Secure Sockets Layer (SSL) standard is an illustration of the perils of using open source software without ensuring it is sufficiently hardened.
- Situations where IP and legacy telephony coexist in the same device, such as in handsets, small-cells and network gateways create potential threats. Most of the security solutions do not contemplate both IP and telephony environments being collocated within the same device. In these devices security attacks might be launched against a telephony networks from the IP-side and vice versa.
- Recognize the potential security threats for small-cells. Small-cells shift network perimeters and commonly connect over untrusted IP networks that must be secured with authentication and encryption solutions like IP Sec. In addition, since small-cells are commonly deployed in insecure locations they are prone to potential tampering.
- Proposed network function virtualization (NEV) and software defined network (SDN) architectures introduce fundamentally new platforms and virtualized environments, open source software and proprietary security solutions. Extensive testing must be conducted to ensure that SDN and NFV solutions are secure for the use cases in which they are implemented.
- The drive toward cloud based services and open-API environments creates a variety of new security considerations by opening interfaces and insertion points to environments that have ordinarily been closed in the past. Examples include RESTful APIs that are convenient to use but lack many of the security features associated with other protocols like SOAP, and self-service portals which commonly interface with critical business support system platforms.
As the mobile industry continues to evolve with broadband services, security challenges are inevitable. Service providers and their technology vendors must arm themselves with the capabilities to minimize security threats and to respond promptly to incidences when they occur. In many cases this requires service providers and technology vendors to bolster their competencies to cope with IP-centric network environments and network security.
Phil Marshall is chief research officer at Tolaga Research
MORE COVERAGE OF COMMUNICASIA2014