Securing National Communications Infrastructure

Data security and protection are of utmost importance, particularly for governments and telecommunication companies that are responsible for safeguarding this valuable asset. 

As the world becomes increasingly interconnected through advanced technologies like 5G and fixed broadband networks, robust security measures are more critical today than ever before.

The recent formation of the Global Coalition on Telecommunications (GCOT) by the UK and four international partners signals a collaborative effort to strengthen national infrastructure against state-sponsored threat actors. However, it is essential to acknowledge that the challenges go beyond simply investigating external networks.

Huawei & The State-Sponsored Threat

The controversy surrounding Huawei, the Chinese telecommunications giant, has been a focal point in discussing state-sponsored threats these past years. Allegations of espionage and network shutdowns have heightened concerns about protecting data and the UK’s critical infrastructure. At the height of its controversial coverage, a reported 47% of Britons believed in a threat posed by the Chinese company and called for sanctions against the firm. In response, a designated vendor direction document was issued to 35 telecom companies, calling for Huawei technology to be removed from the UK’s 5G public networks by the end of 2027.

Despite mounting concerns, smaller companies often turn to Huawei due to its competitive pricing. This reliance on Huawei's technology, even with its known risks, has led to the proliferation of their equipment in 5G and fixed networks, raising questions about the overall security posture of the UK telecommunications industry.

Telecoms Under ‘siege’

Despite the UK Government’s global initiatives to crack down on state-sponsored threats, a recent Google Cloud report highlights a surge in cyberattacks on telecom companies during Q1 2023. The global telecoms sector has experienced a staggering 85% of the top 1,000 distributed denial of service (DDoS) attacks during this period, and this raises the question as to where these attacks are coming from. Despite state-sponsored threat actors being linked to numerous incidents, an often-overlooked aspect is the ability to scrutinise our own networks and re-direct the security focus there. These findings underscore the urgency for a comprehensive approach to cybersecurity that extends beyond merely investigating external, international threats. 

Technology from various sources continues to find its way into UK networks, which means constructing a new approach that enhances security first while providing the flexibility to adapt to evolving threats without a complete overhaul of physical equipment. This includes upgrading legacy tech infrastructure to meet modern security requirements and fostering international security information sharing. By doing so, both public and private security teams can better anticipate and respond to emerging threats, creating a more resilient telecommunications ecosystem. 

Introducing A New Approach - Network Disaggregation

It’s also essential to address the fact that operators need to balance security and cost efficiency. This challenging task requires careful consideration of various factors, including network architecture, security protocols, and operational costs. So, how can they build secure networks without compromising on costs? 

One promising way to enhance telecom security is through network disaggregation. This involves decoupling hardware and software, allowing for the combination of open components to form a complete switching and routing device.

Telcos can purchase white-box hardware from anywhere globally and run independent software from a trusted source, minimising security risks. As foreign threats often lie in the software aspect of the network, not the hardware, telcos can purchase cheaper hardware and couple it with trusted software to create a cost-effective network with little security risk. Should a security concern arise, the ability to switch software without vendor lock-in adds a layer of adaptability and flexibility.

The decoupling of hardware and software provides network characteristics that enhance security as network disaggregation: enables quick software updates and patches, facilitates the selection of best-of-breed security tools from different vendors, reduces risks associated with vendor lock-in, provides granular security controls for precise configuration, enables isolation and segmentation to contain breaches, supports custom security implementations, allows scalable security architecture independent of hardware, offers centralised management for enhanced visibility and control, and ensures secure boot and hardware verification to only run trusted components on routing devices.

Securing The Future Of Our Networks

Overall, network disaggregation addresses key security concerns and offers scalability, allowing telco operators to expand their networks by adding and removing white boxes as needed. This flexibility aligns with the dynamic nature of cyber threats, ensuring that telecommunications networks can evolve without compromising security.

As the telecommunications industry grapples with the challenges posed by state-sponsored threat actors, it is important to adopt a comprehensive strategy beyond investigating external networks.

Going forward, the UK government has demonstrated its commitment through a £70 million round of funding for Future Telecoms Research Hubs, which is a step in the right direction. However, embracing network disaggregation is a natural step in protecting the UK’s critical national infrastructure against external threats ensuring a resilient and secure digital future for all.

Richard Brandon is VP of Strategy at RtBrick

Image: Diana den Held

You Might Also Read: 

Smartphones Are More Vulnerable Than You Think:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Intelligent Automation & AI Can Improve Business Resilience
Creating A Top-Notch Financial App With Advanced Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

4Secure

4Secure

4Secure is a cyber security company providing services and solutions to counter and respond to the most sophisticated and targeted cyber threats.

Sepior

Sepior

Our vision is to make Sepior the leading provider of cloud-encryption software in the world.

Ledger

Ledger

Ledger is a leader in security and infrastructure solutions for cryptocurrencies and blockchain applications using its proprietary technology.

Ziroh Labs

Ziroh Labs

Ziroh Labs leverages advanced cryptography to keep your highly sensitive, private data safe throughout the lifecycle of data.

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

SWEDAC is the national accreditation body for Sweden. The directory of members provides details of organisations offering certification services for ISO 27001.

Southwest Research Institute (SwRI)

Southwest Research Institute (SwRI)

Southwest Research Institute SwRI are R&D problem solvers providing independent services to government and industry clients. Areas of expertise include Cybersecurity, Intelligent Networks and IoT.

Phosphorous Cybersecurity

Phosphorous Cybersecurity

Phosphorus has fully automated remediation of the two biggest IoT vulnerabilities, out of date firmware and default credentials.

Titans24

Titans24

Titans24 is a Software-as-a-Service security platform for web applications. It prevents attacks on business websites that are protected under 11 cyber-security layers.

IT Jobs Watch

IT Jobs Watch

IT Jobs Watch provides a concise and accurate map of the prevailing IT job market conditions in the UK.

Network Center Inc (NCI)

Network Center Inc (NCI)

NCI is one of the largest IT solution providers in the Midwest. We specialize in industry specific technology solutions, service, support, and expertise for small to enterprise businesses.

CloudCover

CloudCover

CloudCover is a software-defined cybersecurity risk solution that provides risk awareness, risk analytics, and data security in real time.

Truly Secure

Truly Secure

Truly Secure is an IT Service Provider that ensures greater efficiency and security within a company's technological environment.

Harbor Networks

Harbor Networks

Harbor Networks is a communications systems integrator and managed services provider. We provide business consultation services for voice and data communication technology.

Deloitte

Deloitte

Deloitte is a multinational professional services firm providing audit, consulting, financial advisory, risk management, tax, and related services to clients.

CyberUp

CyberUp

CyberUp is a nonprofit organization created to strengthen the cybersecurity workforce. We help employers reimagine how they grow and scale their cybersecurity workforce.

Myntex

Myntex

Myntex® is a leading encrypted phone provider, managing a world-class on-site Canadian data center. Our solutions protect against data breaches, digital surveillance, and cybercrime.