Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

2/2/2017
10:20 AM
Patrick Donegan
Patrick Donegan
News Analysis-Security Now
50%
50%

Nokia's Efforts to Lead in Security

Nokia is maintaining its strategic emphasis on network security and may have some plausible claims to be ahead of its major vendor rivals – but it still has a lot of questions to answer.

You get a sense of the challenge facing traditional telecom vendors in network security when you look at the financial results of some of the leading names in this space. Juniper, once a trail-blazer in security, just rounded off a terrible year for its security business, reporting fourth-quarter 2016 security revenues down 30% compared with a year earlier.

Meanwhile Check Point Software Technologies Ltd. (Nasdaq: CHKP), one of the market's strongest performers, has been widely lauded for growing revenues by 7% in 2016 compared with 2015.

There may be a consensus that cybersecurity is the number one issue for businesses in 2017 but converting fear of cyber threats into orders for security hardware and software is still hard work, even for the best of vendors.

Against this commercial background, Nokia Corp. (NYSE: NOK) has distinguished itself from its peers in being willing to make a strategic push around mobile network security. And last Friday, the company invited some industry analysts to Helsinki to update them on the company's strategy.

The big takeaway for me was that there is no let-up in Nokia's strategic emphasis on security. At the same time there's also no sign of any specific turbo-boost in the pipeline. The roadmap is being worked on to ensure that the leadership it has established relative to Ericsson AB (Nasdaq: ERIC) and Huawei Technologies Co. Ltd. is maintained. It seems to me that the gap is still significant. But it's still not so great that either of its main rivals couldn't close it with a year or two of investment and supporting organizational realignment.

Let's start with LTE security. Nokia was early to ship eNode Bs with PKI certificates pre-installed and early with its own PKI certification authority. It was also quick to resell Juniper Networks Inc. (NYSE: JNPR)'s SRX platform for a Security Gateway (SeG) that could do the basic decryption of S1 traffic at the hand off to the core as well as support firewalling and other security features at that interface.

The update here is that post-Alcatel-Lucent acquisition, the positioning of the former Alcatel-Lucent 7750 Service Router as Nokia's new LTE SEG (security gateway) platform is well underway. Nokia claims to be number one in LTE security: Given the high concentration of LTE security deployments Europe, and given that Nokia was first to market with an end to end solution, the claim is certainly plausible.

Just as interesting, though in a different way, is the company's claim to be number one in Gi Firewall deployments. Nokia claims more than 70 deployments here, including some where it has been contracted to implement the Gi Firewall in front of the mobile packet core or EPC of other vendors.

Let's consider Nokia's "70" number for a moment. There are more than 700 mobile operators worldwide, which means Nokia is claiming market leadership having deployed at less than 10% of the total addressable market. Forget for a minute whether Ericsson, Cisco Systems Inc. (Nasdaq: CSCO) or Huawei have deployed more or less Gi Firewalls than Nokia: The striking thing about Nokia's number to me is what is says about the number of mobile operators worldwide that are still running their mobile packet core or EPC without any Gi Firewall at all.

That there are some doesn't come as a surprise -- I've heard it before and Nokia reaffirmed it on Friday. But that it could be a lot more than just "a few" -- i.e. by implication, it could easily be as many as one in three -- came as a surprise to me. What are these operator folks thinking, exactly? Let me guess: "It won't happen to me"?

Sales of Nokia's NetGuard network-based mobile malware detection solution sound as though they remain sluggish rather than spectacular, with a couple of Tier 1 operators in each major region reportedly using it now. Being focused on helping mobile operators detect and remediate malware once it's already made it onto a smartphone, Nokia doesn't generate the same headlines as security vendors that compete to be first to discover new malware.

But the fact that Nokia's tracking of mobile malware infection rates -- based on seeing hundreds of thousands of mobile malware samples -- is showing an upward trend worldwide aligned with what CTIA reports seeing in the US is something with which few other vendors can compete. Additionally, NetGuard customers benefited from its warning of a big increase in brute force auditing against Telnet servers during the early part of the fall of last year. According to Nokia, it was only subsequently that the Mirai botnet that carried out the attacks on Dynwas identified as the probable cause of that surge.

Consistent with Nokia's targeting of the IoT market, NetGuard is being evolved as the security module for its IMPACT platform for IoT. (See Unknown Document 729958.)

I suspect "slow-ish" rather than "spectacular" also accurately describes sales of Nokia's SS7 security solution, if only because this is still a very nascent market. Operators are initially interested in monitoring what type of traffic is coming into their networks via their STPs (signal transfer points) before they decide exactly what -- if anything -- to do about it. My sense is that Nokia's play here is a flag in the ground targeting the legacy SS7 protocol but that this may serve as a platform from which a more ambitious security solution could evolve over time, potentially targeting newer protocols such as Diameter.

The analyst event was held in conjunction with the Nokia Hackathon. This year, around 150 hackers participated in taking a crack at breaking into Nokia's own network infrastructure as well as that of its operator customer, Elisa Corp. . This was around twice as many as last year's event. The goal is to serve up products with fewer vulnerabilities as well as shorten product development cycles.

Another Nokia Hackathon will be held in the US later this year. The company is also working on resourcing an ongoing bug bounty program for rewarding those that identify vulnerabilities in its products. This is increasingly common in the B2C worlds: I suspect Nokia will be among the first telecom network infrastructure vendors to introduce one in the B2B context.

There were a number of other indicators of strategic intent during the day in the areas of DDoS protection, vulnerability management and IoT security that I'll be watching out for in future.

When the bar is set so low by its peers, it's difficult to avoid being moved by the positives of Nokia's approach to network security. But there are criticisms to be made. For example, except for leveraging it for the new SEG platform, the new router side of the Nokia house doesn't feature prominently enough in the company's security vision for my taste.

There's potential for mainstream network routers to take on a greater role in security policy enforcement in more software programmable telecom networks. Juniper already has a reasonably well developed story here. Nokia could potentially do with one too (or at least an explanation of why this isn't a roadmap the company buys into).

Moreover, many of those same mobile operators that take delivery of an SEG based on the 77XX will already have other physical and virtualized iterations of the same platform deployed throughout their network, including as a cell site gateway. There are opportunities to leverage the 77XX series for security, such as by dropping malicious traffic at the cell site as well as having it apply decryption and other security policies as an SEG deeper in the network.

I've no doubt some of Nokia's folks are thinking about these kinds of things. And yes, perhaps it was too early to talk about them on Friday. All the same I can't help thinking that even some small mention of some kind would help bring all of the company's potential security assets together in a more rounded way. Watch this space -- I will.

— Patrick Donegan, Founder & Principal Analyst, HardenStance

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.
CVE-2020-24565
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25770
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25771
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...