Critical Communications Network Security and Disaster Recovery Do You Know How Vulnerable You Really Are? All rights reserved 2005, Alcatel

Transcription

1 Critical Communications Network Security and Disaster Recovery Do You Know How Vulnerable You Really Are? Fabio Tassara - Paul Op De Beeck

2 Scope of the Presentation Critical Communications Network Security and Disaster Recovery Do You Know How Vulnerable You Really Are? Today the majority of corporate information is processed over a geographical distributed Utility Telecom Network The reliability and security of this telecommunication network are mandatory conditions for the Utilities and Utelco business Availability of the information against environment faults Protection of the telecom resources Protection of the network management access Protection of any network access points A highly secure and high availability telecommunication network enables Utility to enhance their business efficiency with real time decision making systems U-Telcos to provide state-of-the-art triple play and business telecommunication services. Presentation October, 2005 Page 2

3 Summary The definition of telecom security Protecting vulnerable areas in utility telecom networks Availability of the information against environment faults Protection of the telecom resources Protection of the network management access Protection of any network access points Security on Triple Play Services Conclusions Presentation October, 2005 Page 3

4 Definition of Quality of Services Parameters The quality of the services supplied by a telecommunication network is perceived by users as a set of parameters: Support The ability to assist the users in employing their services Availability The possibility of the service to be available whenever it is required Operation Plan Easy of deployment and use of the service and related applications Security The overall problems related to authentication, reliability and confidentiality of the information transmitted Presentation October, 2005 Page 4

5 Definition of Network Availability The telecom networks availability is measured as follows: Access probability The probability that a service can be obtained within operating environmental conditions Delay in service access The time between the request for access to services and it being commissioned Coverage Probability of obtaining network access resources for each service Average speed (kbps) Average speed (Kbps) provided by the network for a particular service Service drop The probability that a service, once obtained, will not be unintentionally interrupted Jitter (ms) Maximum variation in the average packet delay Transmission delay (ms) The time that passes between sending packets of data and them being received Presentation October, 2005 Page 5

6 Definition of Network Security The telecom networks security is measured using the following parameters: Vulnerability of the access point Ability of the network provider to prevent or recognise external attacks, of any kind, to the network access tools-devices. Integrity and confidentiality of information Prevents the alteration and the interception of sensitive data in accessing the network or the service. Ratio of non-rejection repudiation (at network level) Probability of errors of the transactions in accessing the network or service Ratio of routing Probability of mistaken routing of the service Presentation October, 2005 Page 6

7 Summary The definition of telecom security Protecting telecom vulnerable areas in utility networks Availability of the information against environment faults Protection of the telecom resources Protection of the network management access Protection of any network access points Security on Triple Play Services Conclusions Presentation October, 2005 Page 7

8 Enabling Mission Critical Communications Potential vulnerable Areas to be protected: Infrastructure (optical devices and telecom network) Telecom resources (access devices) NOC External access (Internet access) SCADA Optical cables Power Grid Unified NOC OSS / BSS (SCADA) (NMS) (Billing) NG SDH Management Suite IP MPLS Security Access Router RTU Meter TPR Enterprise QoS Optical Device Ethernet, ATM, TDM Triple Play Optical cables AVAILABILITY % Optical Multi Service ISP / ASP Corporate network Internet access Presentation October, 2005 Page 8

9 Availability of the Information Against Environment Faults Telecom Infrastructure Protection against interruption of fibre (Availability) The network topology (ring, mashed) in addition to the carrier grade equipment avoids any single point of failure in the telecommunication network Optical performance monitoring enables to analyze lasers or fiber degradation and prevent network faults Protection against interruption to traffic (Availability) The automatic traffic restoration enables less then 50 ms traffic switches at any traffic aggregation level SNCP, MPS, 2 or 4 fibers MS-Spring, GMPLS, etc. GFP LCAS, RPR, MPLS, etc. HV Grid Optical cables NG SDH Optical device Optical Multi Service Ethernet, ATM, TDM Optical cables Presentation October, 2005 Page 9

10 Protection of the Telecom Resources Node intrusion Carrier-grade devices have been designed to guarantee the inaccessibility of service data the inaccessibility of management, routing and control information A log of operator actions and external events (Security) Management Channels intrusion (Security) The Carrier-grade management and supervision channel (DCN) is self protected (OSI or OSPF) and segregated from the traffic information Alcatel systems detect any intrusion in the management channels Node Operations The hardware must guarantee its hitless upgrades The firmware must guarantee its hitless evolutions Any power cut or equipment reset/restart must not affect the traffic (Availability) Presentation October, 2005 Page 10

11 Protection of the Network Management Access The NOC has an internet access (Security) Firewall and gateways must protect the corporate information NOC Operators access (Security) Powered logging and security profile systems have to regulate the operator access to network resources, operations and information The NOC should support Business Continuity (Availability) The geographical redundancy of the NOC guarantees the non-stop network surveillance in case of human errors, natural or criminal events Any Mission Critical information (OSS, BSS, etc.) has to be mirrored over distance. Large data centers containing mission critical information should support long distance Business Continuity and Disaster Recovery Presentation October, 2005 Page 11

12 Protection of any Network Access Points Hacker intrusion (Security) Any single Network Access Point must block the access to the Network information Implementing Ethernet Services (Security) The Ethernet Services has to respect the Metro Ethernet Forum standardization E/GE E/GE E/GE E/GE E/GE E/GE E/GE E/GE Private E-Line is a dedicated bandwidth (over SDH) for P2P Guaranteed QoS is secure and high reliable by definition (LL-like) Virtual Line (VPL or VLL) enables to shared bandwidth with different QoS /SLA optimize the transmitted bandwidth and add flexibility E-LAN Service and VPLS are dedicated/shared bandwidth for Any-to-Any (Multipoint) connections with multiple QoS/SLA The virtualization of the LL enables multi corporate LANs IP MPLS and VPLS implement unparalleled security and resilience Presentation October, 2005 Page 12

13 Summary The definition of telecom security Protecting telecom vulnerable areas in utility networks Availability of the information against environment faults Protection of the telecom resources Protection of the network management access Protection of any network access points Security on Triple Play Services Conclusions Presentation October, 2005 Page 13

14 U-Telco s Building Independent Networks for Whole Sale Triple Play Customer Network Operated by U-Telco Service Provider & Content Providers Access Residents xdsl FTTx Public ( University, Government ) Business Presentation October, 2005 Page 14

15 Understanding the Network Requirements for Triple Play CONSUMER ENTERTAINMENT Massive Bandwidth Scaling 20Mb/s to 100Mb/s per subscriber QoS for Multiple Services Scale QoS mechanisms, enforce service interaction per-sub., per-service Policy scaling Scale security, anti-spoofing, accounting, filtering, policing etc. Multicast & Unicast Any mode of operation & optimize architecture for BTV as well as 100% VoD High-availability Per-path, per-link, per-node HA, across the network Flexibility Support for any mode of operation minimized risk Optimized Cost Structure Linear, predictable (non-exponential) Streamlined network & service operations Presentation October, 2005 Page 15

16 One Common Architecture for Business and Residential Services... Home Gateway Fiber based Broadband access Distributed Subscriber Management Broadcast TV Video On Demand High Speed Internet Home Gateway BTV Home Gateway App block BSA VPLS enabled IP/MPLS Backbone BSR DHCP Head-end System Internet HGW BSA BSR IP VoIP HGW Optical Networking Centralized service delivery VoD Fiber based Broadband access BSA: Broadband Service Aggregation BSR: Broadband Service Routing Presentation October, 2005 Page 16

17 Distributed Subscriber Management Addressing the Security Challenges Network Security and Authentication is needed to prevent Denial of Service and Theft of Service Security requires: No unauthorized user-user communication Per user and per service traffic segregation, broadcast filtering No doubt about a subscriber s identity Scalable for per-user filters for anti-spoofing Bandwidth Isolation/User fairness Dedicated per user resources ( queues ) providing Hierarchical QoS Reduced per-subscriber provisioning speeds up service activation and reduces human errors DHCP snooping to auto-configure anti-spoofing rules Presentation October, 2005 Page 17

18 Summary The definition of telecom security Protecting telecom vulnerable areas in utility networks Availability of the information against environment faults Protection of the telecom resources Protection of the network management access Protection of any network access points Security on Triple Play Services Conclusions Presentation October, 2005 Page 18

19 Benefits of Reliable Telecom Networks A Reliable Telecom Network allows Utilities to implement Real-time decision-making systems (SCADA, tele-protection, AMR) Large bandwidth telecommunication systems (IP convergence) Business Continuity systems (SAN) U-Telcos to Implement large bandwidth aggregation for reliable voice, data and video services (triple play ) Provide high QoS business services (VLL, VPLS) Launch innovative access technologies (PLC, FTTU, PON, xdsl, WiMAX, etc) Easily introduce new telecom services (network scalability) Presentation October, 2005 Page 19

20 Benefits of Secure Telecom Networks A Secure Telecom Network allows Utilities to implement Mission critical systems (SCADA, tele-protection, AMR) Minimize the IT security investments (traffic segregation) Segregate their mission critical information (Disaster recovery) U-Telcos to Focus the security efforts by service since the traffic is segregated at telecom level (L0 WDM, L1 GFP-LCAS, L2 RPR, L3 MPLS) Implement multi user services with guaranteed QoS (Virtualization) Provide high QoS business services (VLL, VPLS) Launch innovative access technologies (PLC, FTTU, PON, xdsl, WiMAX, etc) Easily introduce new telecom services (network security) Presentation October, 2005 Page 20

21 Alcatel Offer to Utilities Technology partnership and a complete telecom portfolio Widespread Telecommunication experience Worldwide support team (150 countries) Professional Services to consult, design, build and run Telecommunication projects Project Management certified by PMI CONSULT Design/Planning Audit/Optimization Engineering Procurement DESIGN Business Plan Integration Project Management Quality Assurance Operation Installation RUN Maintenance Outsourcing Commissioning Training BUILD Presentation October, 2005 Page 21

22 Presentation October, 2005 Page 22