ETIS Information Security in Telecommunications

Transcription

1 ETIS Information Security in Telecommunications ENISA workshop on providers resilience 29 October 2009, Paris Fred Werner, Business Development Manager - ETIS

2 Mission & Vision» What is ETIS? ETIS is a membership based organisation which brings together the major telecommunications providers in Europe on key information and communication technology (ICT) issues.» ETIS Mission The mission of ETIS is to enable its members to improve their business performance by personal exchange of information on using ICT effectively.» ETIS Vision The ETIS vision is to be the acknowledged best platform for sharing knowledge on the use of ICT in Telcos.

3 ETIS Pillars of Activity

4 ETIS Members» ETIS represents 25 Telecom providers supplying voice, mobile and data services all over Europe» Total revenue from ETIS Members was estimate at over 270 Billion euro in 2008

5 ETIS Partners & Associates Associate Members contribute technical competence to our working groups and events and gain feedback on user requirements. ETIS Partners are non-profit international bodies with whom we share knowledge on complementary ICT issues

6 Information Security Working Group» What is the ISWG? In January 2004, the Information Security Working group was established as a follow up to a meeting at the Global Security Conference in Sophia Antipolis in November The working group is currently chaired by Andy De Petter from Belgacom and boasts around 30 members from 20 companies. Meets 3-4 times a year, phone conferences, discussion forums, etc» Role of the group The role of the group is to share knowledge and experiences among members concerning Information Security and related matters and when relevant provide requirements to the industry. To help the members protect their information assets and infrastructure The group is the only Information Security group to concentrate on the telecom market.

7 ISWG Topics Some of the main topics addressed Security Benchmarking Resilience, recovery & business continuity management Anti-SPAM, Anti Phising, Data Retention, Data Privacy Security Culture & Information Security Awareness Campaigns Identity Management & TOP Level Policy Document (TLPD) Value & ROI of Information Security Projects Security Governance models ebusiness Security Revenue Assurance & Financial losses due to security breaches Managed Security services The threat of terrorism from a Telco s perspective Sarbanes-Oxley, compliance and Policy IT Network & client Security Architecture Security in the Supply chain & trends in Security Outsourcing

8 ETIS Security Benchmark 2009 Participating Telcos: TDC, Belgacom, KPN, Telecom Italia, Telekom Austria, Turkcell, TeliaSonera and OTE Objective with the Benchmark: Compare Security strategies and approaches among ETIS member companies, thereby enabling these providers to determine which specific aspect of security require attention within their respective organisations. The following themes are covered in depth: In-depth themes 1. Corporate Security Function 2. Security Management 3. Commercial role of security 4. Fraud Management 5. Security in the development process Exploratory themes 1. Business Continuity Management 2. Next generation security readiness 3. Infrastructure security 4. International cooperation

9 CSF size by security area Corporate Breakdown security of fte CSF per size area by (per security billion EUR area revenue) [FTE per billion EUR revenue] 16,00 14,00 12,00 10,00 8,00 6,00 4,00 Differences in CSF set up reflect the choices each operator has made with respect to incorporating specific security areas. 2,00 0,00 A B C D E F G H Information Security Physical Security Fraud Management Personnel Safety Lawful Interception IT & network security Business Continuity Management Internal Investigations Security of products and services Other

10 Business Continuity Plans & NGN Security Only half of the benchmark participants have a specific BCM policy in place, but all have Business Continuity Plans. Maintaining coherence in these Business Continuity Plans is a difficult task and testing and exercising them only occurs sporadically. Whilst telcos are rapidly embracing Next Generation Network (NGN) infrastructure and services, most of their security units still work with traditional security architectures, baselines and methodologies.

11 ETIS Anti-Spam Co-operation Group The target of the group is to learn and to get feedback on success stories and to develop tangible action plans for reducing outbound SPAM, accepted and shared among best-in-class antispam ISPs reduce the ingress SPAM and so to improve their own QoS by helping others in reducing egress SPAM In this context ETIS Anti-SPAM Co-ordination Group it the glue for trusting each other, for sharing knowledge, for developing a common European ISPs Anti-SPAM strategy Most effective best practice is to block port 25

12 Turk Telekom s success after blocking Port25 17 June 2009 Rank: 1 23 September2009 Rank: 9

13 TI s success after implementing best practices The goal of the TI Anti-spam working group, established in 2008 was to get Turk Telekom and Telecom Italia off the top 10 Autonomous System published on TrendMicro. TOP 10 Spammer TrendMicro TOP 20 Spammer TrendMicro Both the objectives have been reached successfully 13

14 BT s BCM pan EU Network discussion Too costly for any one operator to build separate ductways etc By pooling resources across a number of network operators, and creating additional resilience in the transport and switching Gateways, a smarter, more secure BCM network could be set up, with each country retaining it s own primary routes, therefore not negating any reach advantage of operators. Is anyone else discussing this? Any pilot projects under way?

15 Future plans for the ISWG ETIS Security Benchmark 2010 IMS/VoIP security from a Telco perspective Resilience in European e-communication Networks Partnerships: ENISA, CIIP European Public-Private Partnership for Resilience, Member of EU expert panel on Data Retention Next meetings: - 28/29 January, hosted by Bizanga in Paris - 20/21 May, hosted by KPN in the Hague - 14/15 October, hosted by TeliaSonera in Stockholm

16 To join the Information Security Group or Anti Spam Task Force contact: Fred Werner, ETIS Business Development Manager - Tel