Security of telecom networks worries ITU

Network operators can save lives and indiscriminate punishment of law abiding citizens, only if they promptly respond to request on call log of criminal related cases for improved security, reports REMMY NWEKE.


A victim of GSM?
A roadside radio mechanic living at Mushin, a Lagos suburb, Mr. Uzor Ikenna, needed to make a few cash withdrawal for a very important family engagement, so, on Wednesday morning, he headed to a nearby branch of the bank where he maintains a savings account, along Oshodi-Apapa Expressway also in Lagos.

By 11.35am, Uzor was already within the bank’s compound when he got a call on his handset and had to retrieve to outside the gate in order to answer the call, after which he was on his way back to the banking hall, when a police officer on duty accosted him, demanded for the phone, which he deposited without much ado and went in to conduct his transactions in the bank.

He was barely in when a group of armed robbers struck and carted away huge sums of money. When the robbers left, the police man came in to search of Mr. Uzor, claiming that the call he received earlier was with the robbers and placed him under arrest. He was later transferred to Panti for further investigation.

Although experts have argued that the call log could be provided by the network and investigated, the Police detained Uzor for over two weeks, to ascertain whether or not he is a member of the armed robbery gang in any form nor simply a victim of growing usage of the Global System for Mobile communications (GSM) services in a country like Nigeria.

Worried by telecom security lapses:
And in efforts to confront the issues of security lapses in the telecommunications sector, the global telecom regulator, the International Telecommunication Union (ITU), recently made some recommendations for a secured telecommunications. ITU through the Telecommunication Standardization Bureau (ITU-T), noted that security in telecommunications and Information Technology is a very salient subject.

An overview of issues and the deployment of existing ITU-T recommendations for secure telecommunications, ITU said, it could be categorized to include the basic security architectures and services, open systems security architecture, lower and upper layer security models, the security frameworks, security architecture for systems providing end-to-end communications, in addition to the fundamentals of protection: Threats, Vulnerabilities and Risks as well as the security requirements for telecommunication networks.

Basics:

On basic security architectures, experts at ITU said noted that during the communications standardization work in the early 1980s, the need to address elements of security architecture was recognized, which led to the development of the Open Systems Security Architecture (ITU-T Rec. X.800). This notwithstanding, it was recognized that this was but the first stage in the development of a suite of standards to support security services and mechanisms.

“This work, most of which was done in collaboration with International Standards Organisation (ISO), resulting in further recommendations, including security models and frameworks that specify how particular types of protection can be applied in particular environments,” ITU official said.

Additionally, our sources stressed on the need for other security architectures, such as the security architectures for Open Distributed Processing and for Systems Providing End-to-end Communications, were identified.

The recently published ITU-T Rec. X.805, according to the global regulator, addresses this need and complements other recommendations of X.800 series by offering security solutions aimed at providing end-to-end network security.

The first of the this series of communications security architectures to be standardized was ITU-T Rec. X.800, defining the general security-related architectural elements that could be applied in relation to the circumstances for which protection is required. Particularly, experts said, X.800 provides a general description of security services and the related mechanisms that may be used to provide the services.

It also defines, in terms of the seven-layer Open Systems Interconnection (OSI) Basic Reference Model, the most appropriate location for implementing the security services.

Accordingly, ITU-T recommendation X.800 is concerned only with those visible aspects of a communications path that permit end systems to achieve the secure transfer of information between them. “It does not attempt to provide any kind of implementation specification and it does not provide the means to assess conformance of any implementation to this or any other security standard. Nor does it indicate, in any detail, the additional security measures may be needed in end-systems to support the OSI security features.”


Underlying concept of X.800:
Although X.800 was developed specifically as the OSI security architecture, the underlying concepts were shown to have much broader applicability and acceptance.

The standard is, therefore, particularly important as it represents the first internationally-agreed consensus on the definitions of the basic security services Authentication, Access Control, Data Confidentiality (AACDC), Data Integrity and Non-repudiation), along with more general (pervasive) services such as trusted functionality, event detection and security audit and recovery.

However, prior to X.800 there had been a wide range of views on what basic security services were required and what exactly each service would do. Emphasizing that X.800 reflects a strong, international consensus on these services.


Value and applicability:
Experts highlighted that the value and general applicability of X.800 results specifically from the fact that it represents a significant consensus on the meaning of the terms used to describe security features, on the set of security services needed to provide protection for data communications, and on the nature of those security services.

At the developmental level, ITU experts informed that the need for additional related communications security standards paved the way for work on a number of supporting standards and complementary architectural recommendations followed by the development of X.800.

These included the Lower and Upper Layer Security Models (X.802 and X.803), the purpose of which was an indication of how the security concepts developed in the Security Frameworks could be applied to specific areas of Open Systems architectures.

“The purpose of the Upper Layers Security Model (X.803) is to provide standards developers with the architectural model for the development of application-independent security services and protocols in the upper layers of 7-layer OSI model,” experts declared in the recommendation.

Noteworthy is that the recommendation provided guidance on the positioning of and inter-relationships between security services in the session, presentation and application layers.

In particular, the recommendation described how security transformation functions, such as encipherment were addressed at the application and presentation layers, additional to the concept of security exchange is introduced.

Frameworks:
The security frameworks, as said by ITU were developed to provide comprehensive and consistent descriptions of the security services defined in X.800. They are intended to address all aspects of how the security services could be applied in the context of specific security architecture, including possible future security architectures.

The frameworks, therefore, focus on providing protection for systems, objects within systems and interaction between systems, without necessarily addressing the methodology for constructing systems or mechanisms.

The frameworks address both data elements and sequences of operations, excluding protocol elements that are used to obtain specific security services, which may apply to the communicating entities of systems as well as to data exchanged between, and managed by systems.

An overview of this framework introduces the other frameworks and describes common concepts consisting of security domains, security authorities and security policies that are used in all the frameworks, thereby describing a generic data format that could be used to convey both authentication and access control information securely.

From Geneva to India:
Thus, in his message at the just concluded Hyderabad meeting in India, for the Internet Governance Forum (IGF), the Secretary General, ITU, Dr. Hamadoun Toure, pointed out that IGF was created as the result of the most wide-ranging, comprehensive and inclusive debate ever held on the future of the Internet, which went through the two-phased World Summit on the Information Society (WSIS) held in Geneva and Tunis, ITU proactively solicited contributions from stakeholders worldwide.

He noted that intensive preparatory went into Tunis phase of WSIS culminating in significant global consensus on the principles governing ongoing policy deliberations. This saw, eventually that the summit spoke of a breakthrough agreement on Internet governance which acknowledged the need for enhanced global cooperation.

Toure said, the need for equality of governments worldwide and application of principles of national sovereignty in each country’s management of its Country Code Top Level Domain (ccTLD), as laid down in paragraph 35 of the Tunis Agenda for the Information Society, was a highlight at the summit.


Importance of global application:
“We underlined the importance of strengthened cooperation in the development of globally applicable principles for the management of critical Internet resources. We hailed the agreement, and the creation of the IGF in accordance with paragraph 72 of the Tunis Agenda, as a turning point that would pave the way for all countries to exercise their national rights in managing their own critical Internet resources,” he said.

Expressing excitement over the progress achieved by Internet Corporation for Assigned Names and Numbers (ICANN) over the past three years on critical issues such as security and internationalization of the Domain Name System (DNS); he underscored the fact that ITU has been very active in implementing both the letter and the spirit of WSIS commitments, which saw to the launch of the Global Cybersecurity Agenda (GCA), a global framework for international cooperation aimed at enhancing public confidence and security in the use of ICTs.

ITU’s push:
This, he said, is because children are increasingly vulnerable to the predations of cybercriminals, which motivated ITU’s recent enhancement of the GCA with the launch of its new Child Online Protection initiative, which ITU’s 2008 World Telecommunication Standardization Assembly adopted key recommendations on Internet Protocol version Six (IPv6) and on non-discriminatory access to Internet resources.

ITU Council last month created a new working group dedicated to accelerating the pace of work on Internet-related public policy issues. ITU also continues to push for faster progress in building international Internet connectivity in developing countries. Even as at last year’s ITU Connect Africa summit alone $55 billion was raised unprecedentedly in investment commitments specifically targeting regional connectivity projects.

General objectives:
In the general security objectives for telecommunications networks of these recommendations, ITU-T described the ultimate aim of the security measures taken in telecommunication networks and focuses on what security requirements achieved rather than on how it is done.

The security objectives for telecommunication networks were only for authorized users to be able to access and use telecommunication networks; access and operate on assets they are authorized to access; affords telecommunication networks to provide privacy at the level set by the security policies of the network, even as all users should be held accountable for their own but only their own actions in telecommunication networks.

Equally, ITU outlined other goals of the recommendations to include ensuring availability, and protection against unsolicited access or operations, just as it should be possible to retrieve security-related information from telecommunication networks; but only authorized users should be able to retrieve such information.

However, if security violations are detected, they should be handled in a controlled manner in accordance with a pre-defined plan to minimize potential damage. Also, after a security breach is detected, it should be possible to restore normal security levels based on certain flexibility in order to support different security policies.

Summary:
By implementing the aforementioned security measures the security objectives for telecommunication networks could be achieved via confidentiality; data integrity; surely integrity of system programmes is also required, accountability, including authentication, non-repudiation and access control; and availability.

It is necessary to provide security services and mechanisms to protect telecommunication networks against malicious attacks such as denial of service, eavesdropping, spoofing, tampering with messages such as modification, delay, deletion, insertion, replay, re-routing, misrouting, or re-ordering of messages, and repudiation or forgery.

Protection, according to experts should include prevention, detection and recovery from attacks, as well as management of security-related information, with the practical involvement of members of the Association of Licensed Telecom Operators of Nigeria (ALTON), for instance.

While industry observers suggest that protection may equally include measures to prevent service outages due to natural events like weather or malicious attacks such as violent actions.

Even as they further suggested that the arrest of an individual for answering a call outside some key places like banks and few minutes later a robbery incident occur; could be traceable in terms of charging or acquitting the subscriber who answered call prior to a back robbery by way of making available its data or call traffic on a given mobile phone, and networks.


ITREALMS Online ... delivering news for ICT4D