The Emerging Network Landscape: More Open, Less Secure? Why is Inventory Management a Critical Part of your Security Policies?

The network landscape in the communications industry is rapidly evolving. And the changes resulting from network evolution are putting the issue of security under the microscope. 

How and why is this the case? Why, presently, are issues of security increasingly of concern?

There are a variety of reasons, among them:

• Next generation, network-centric services that will require greater openness at the business and partnerships levels. The new maxim is becoming “if it can be offered as a service, it will be offered as a service and that means operators will likely open their networks to be used as platforms for third parties to build on via open APIs. In this context, it’s clear that security breaches could become increasingly common and there is growing potential for security attacks from opportunists. 
• In the proposed new “network of networks” domain open standards will enable collaboration across vertical industries (not just telecoms). Here, standardization, compatibility, and interworking at a global scale will be challenging and the security implications are immediately obvious.
• One aspect of new levels of service complexity is that (multiple) partnerships and stakeholders can be involved in a single service chain. This requires control at different levels of abstraction than before. For example, entities placed in different layers may sometimes need to be shared across customers or even partners with information frequently transmitted across them dynamically. Again, the security concern should be instantly apparent.

With these and other examples in mind, it’s not surprising that concerns raised over the issue of network security have gathered pace. Enterprises, governments, individuals, and core agencies (for instance, healthcare) all rely on services and facilities which are delivered by network providers.  Security issues that might threaten their delivery must be taken seriously and addressed proactively and mitigated.

A compendium of threats can be identified?

What form, in a general sense, do these threats take? They can be roughly categorized as follows:

1. Malicious attacks:

These can range from equipment theft and vandalism to terrorism, including cable theft (copper remains a target) to cable damage (deliberate cable damage is rare but not unknown), to signal jamming which can happen on a local or industrial scale.

2. Non-malicious threats:

Routine issues such as common hardware and software failures, still present a security risk. The same can be true of power supply failures which disrupt smooth network operations. And accidental cable damage, the opposite of the deliberate noted above, still has the same security implications.

3. Nature-related risks:

Plain old bad weather! Flooding, high winds and extreme hot or cold temperatures can cause disruption to telecommunication systems. Infrastructure must be protected as much as possible against these risks.

4. Cyber threats:

Perhaps more obvious territory for security issues. That’s because personal data is abundant in telco industry databases making them a target for cybercriminals. Such threats could compromise end users but also potentially cause networks to fail altogether. Device compromise is another issue, with network elements such as routers vulnerable to cyber-attacks. And legacy protocols can present a security problem because, if software is outdated, then equipment could be vulnerable to newer, more sophisticated technology.

5. Misconfiguration threats:

The accidental misconfiguration of active network devices such as routers, switches, firewalls etc., represents a considerable threat. That’s why VC4 partners with NetYCE to provide solutions that reduce any risk or threat related to misconfigurations of network equipment. NetYCE’s solution automates configuration management, with ‘time machine’ tracking and notification of new changes. This helps validate a range of activities, such as verifying adherence to vendor hardening rules (e.g., CIS); checks for Common Vulnerabilities and Exploits (CVE); validation of specific design rules; compliance with regulatory policies (e.g., ISO27002); as well as active configuration monitoring for things like redundancy, active failover, licensing, naming conventions, and more.

Security: a sample Use Case

To dig further, let’s look at one example of a security-related use case in more detail.

We are all aware that different files (for example, drawings, excel sheets, or other simple tools) are often sent over the network to external sources. They are typically not protected and are not sent to secured databases with 2FA within a secured LAN. While it may be inadvisable to do this, unfortunately, this is often the reality. So how can it be addressed?

First, if the network operator can check router configurations to ensure they comply to equipment standard policies, configuration recommendations and sending and receiving company’s design rules, the security risk will diminish. Furthermore, if network hardening is automatic (identifying the network’s vulnerabilities and implementing mechanisms that reduce vulnerabilities), risk will also be ameliorated.

Is the operator managing network inventory effectively and monitor unplanned changes? Is it proactively identifying vulnerabilities in the network, ensuring that firewalls are synchronized and checking ports for unwanted devices? In reality, while risks are increasing, the steps to address them are within reach too.

Protecting against security threats in the network

In fact, there are many steps operators can take to address the security concerns noted above (and others).

They include:

• Upgrading physical network protection (secure property, reinforce cabling etc.)
• Participating in industry security schemes and programs designed to audit and monitor security threats
• Paying greater attention to the locations of network equipment and factoring in specific risks when planning and deploying infrastructure 
• Taking steps in advance to guarantee downtime is minimized if security flaws do occur.

The role of network inventory managing in addressing security threats

Perhaps central to addressing security risks, though, is having access to a consolidated repository of all the data associated with each network asset and service. This is commonly viewed as a critical component of commercial success but it’s an equally important aspect of network security. Awareness of asset placement, performance, capability, usage, status, is vital for not only improving operational performance but also for securing it.  

As a result, being able to access the right inventory platform is critical. Effective network asset management tools have become intrinsic components of the next generation operator’s planning.  They represent a single source of data for all operations and processes from planning to deployment to revenue and security and beyond that cannot be overlooked. 

VC4-IMS, the leading Network Inventory Management solution can show you how to secure your own assets and provide you with a foundation for ensuring that your network security is enhanced. In combination with the NetYCE solution, we also provide tools to check configuration of network equipment, guarding against security and design issues. 

VC4 software helps manage complex networks and plan investments more effectively for future evolution. It helps any network operator – fiber, broadband, mobile – across different sectors, such as telecoms, utilities, education, and rail, as well as large enterprises manage their infrastructure, connections, and customer relationships.