THE NEED FOR SDN-BASED APPROACH TO CYBERSECURITY RESPONSE

Today, the cybersecurity industry is faced with an increasingly capable set of threat actors using advanced strategies, tactics, and techniques. Threat actors are able to leverage advanced tools to apply them within multi-phased and multi-pronged campaigns to reach their objectives. While defenders are improving their ability to model, visualize, and understand those attack strategies as well as identifying gaps in their organizational defensive posture, there remains significant challenges in how defenders are approaching the response to these sophisticated attacks.

Spotlight

EffectiveSoft

EffectiveSoft is an international software development service provider with more than 16 years of professional experience. We are headquartered in San Diego, CA, and offer both local and off-shore presence. EffectveSoft team today counts up to 250 people (both onsite and off-shore). We have been 3x MS Gold Certified and 2x MS Silver Certified. We provide a full cycle of software development services, with main focus on MS Stack, Java, PHP and mobile technologies.

OTHER ARTICLES
Software, Low-Code App Development, Application Development Platform

Are Telcos Ready for a Quantum Leap?

Article | August 23, 2023

Quantum technologies present both an opportunity for telcos to solve difficult problems and provide new services and a security threat that could require extensive IT investment. Are Telcos Ready for a Quantum Leap? When Andrew Lord, Senior Manager, Optical Networks and Quantum Research at BT, first started presenting quantum technologies at customer events six or seven years ago, his was the graveyard shift, he says, entertaining attendees at the end of the day with talk of 'crazy quantum stuff.' "But that is no longer the case," says Lord. "Over the last two years, I've noticed a shift where I now speak before lunch, and customers actively seek us out." Two developments may be causing the shift: Customers’ growing awareness of the threats and opportunities that quantum computing presents, plus a recent spike in investment in quantum technology. In 2022, investors plowed $2.35 billion into quantum technology startups, which include companies in quantum computing, communications and sensing, according to McKinsey. The public sector has also been digging deep into its pockets. Last year, the United States added $1.8 billion to its previous spending on quantum technology, and the EU committed an extra $1.2 billion, the consultancy noted, while China made total investments of $15.3 billion. According to Luke Ibbetson, Head of Group R&D at Vodafone, quantum computing's promise lies in solving a probabilistic equation within a few hours. This task would take a classical computer a million years to accomplish. This breakthrough would enable telcos to address optimization problems related to network planning, optimization, and base station placement. The flip side is that a powerful quantum computer could also break the public-key cryptography that protects today’s IT systems from hackers. As a spokesperson at Deutsche Telekom remarks: “Telcos will have to react to the threat of quantum computers to communication security because their core business model is at risk, which is offering secure digital communications.” The idea of quantum computing posing a security threat is not new. In 1994, Peter Shor, a mathematician working at AT&T Bell Labs, showed how a quantum computer could solve the logarithms used to encrypt data. “His work simultaneously ignited multiple new lines of research in quantum computing, information science, and cryptography,” according to an article by the Massachusetts Institute of Technology, where Shor is currently working. Beyond The Lab What has changed nearly thirty years on is that quantum computing is creeping out of the lab. Sizeable obstacles to large-scale quantum computing, however, remain. Quantum computers are highly sensitive to interference from noise, temperature, movement or electromagnetic fields and, therefore, very difficult and expensive to build and operate, especially at scale: IBM’s latest quantum processor, for example, operates at a very low temperature of approximately 0.02 degrees Kelvin. When Deutsche Telekom’s T-Labs tested telco use cases, it found quantum computing coped well with small problem statements. “However, when the problem size was scaled to real-world problem sizes, the quality of the QComp solution degraded,” according to the spokesperson. The company is now awaiting the next generation of quantum computing platforms to redo the analyses. All of this means, for now, quantum computers are not large and powerful enough to crack Shor’s algorithm. The question is, when will someone succeed? The Global Risk Institute tracks the quantum threat timeline. In its latest annual report, the organization asked 40 quantum experts whether they thought it likely that within the next ten years, a quantum computer would break an encryption scheme like RSA-2048 in under 24 hours. Over half the respondents judged the event to be more than 5% likely, and almost a quarter considered it to be more than 50% likely. Any breakthrough will come from a relatively small number of actors. Today, governments and academic institutions are home to around half of the 163 projects accounted for worldwide by Global Quantum Intelligence, a research and analysis company, according to its CEO, André M. König, with big technology companies and specialized startups accounting for the rest. Q2K Nonetheless, the impact of quantum computing could be widespread, even if relatively few of them are built. The challenge of preparing for a post-quantum future is often called Q2K in reference to the Y2K bug. In the late 1990s, many (but not all) governmental organizations and companies spent millions of dollars on Y2K systems integration to ensure that IT programs written from the 1960s through the 1980s would be able to recognize dates after December 31, 1999, all while being uncertain of the scale or the impact of the risk if they didn’t. ‘Q2K’ differs in that there is no specific deadline, and the dangers of a major security breach are much clearer cut. However, it is similar in demanding a lot of work on aging systems. “Cryptography is used everywhere,” points out Lory Thorpe, IBM’s Director of Global Solutions and Offerings, Telecommunications. She adds, “Because telco systems have been built over periods of decades, people don’t actually know where cryptography is being used. So, if you start to look at the impact of public key cryptography and digital signatures being compromised, you start to look at how those two things impact open source, how that impacts the core network, the radio network, [and] OSS/BSS, network management, how the network management speaks to the network functions and so on.” This complexity is why some analysts recommend that telcos take action now. “You’re going to find tens of thousands of vulnerabilities that are critical and vulnerable to a quantum attack. So, do you have to worry about it today? Absolutely - even if it’s in 2035,” says König. “Anyone who has ever done [IT implementation projects], and anyone who’s ever worked in cybersecurity [knows], tens of thousands of vulnerabilities that are critical [requires] years and years and years of just traditional integration work. So, even if you’re skeptical about quantum, if you haven’t started today, it is almost too late already.” Don’t Panic! For the past two to three years, Vodafone has been preparing to migrate some of its cryptographic systems to be quantum-safe, according to Ibbetson. He believes there is no need to panic about this. However, telcos must start planning now. König said, "The telecoms industry as a whole is not moving as quickly as some other sectors, notably the banking, pharmaceutical, and automotive industries. In these sectors, post-quantum security planning often involves CEOs at a very strategic level." For this reason, Vodafone joined forces with IBM in September 2022 to establish the GSMA Post-Quantum Telco Network Taskforce. “Even though many industries are preparing to be able to defend against future quantum threats, we didn’t see anything happening particularly in in the telco space, and we wanted to make sure that it was a focus,” says Ibbetson. “Obviously it will turn into an IT-style transformation, but it’s starting now with understanding what it is we need to mobilize that.” AT&T has also been working to pinpoint what needs to be addressed. Last year, the company said it aims to be quantum-ready by 2025, in the sense that it will have done its due diligence and identified a clear path forward. Minding Your PQCs Companies across multiple sectors are looking to post-quantum cryptography (PQC) to secure their systems, which will use new algorithms that are much harder to crack than RSA. König contends that PQC needs to become “a standard component of companies’ agile defense posture” and believes the development of PQC systems by software and hardware companies will help keep upgrade costs under control. “From a financial point of view, vendors do a fantastic job bringing this to market and making it very accessible,” says König. Lord, who has been researching quantum technologies at BT for over a decade, is also confident that there is “going to be much more available technology.” As a result, even smaller telcos will be able to invest in securing their systems. “It doesn't need a big boy with lots of money [for] research to do something around PQC. There’s a lot of work going on to ratify the best of those solutions,” says Lord. There are several reasons why eyes are on software based PQC. Firstly, it can be used to secure data that was encrypted in the past, quantum computing advances will make vulnerable in the future. In addition, the quantum-based alternative to PQC for securing network traffic called quantum key distribution (QKD), comes with a huge drawback for wireless operators. QKD is hardware-based and uses quantum mechanics to prevent interception across optical fiber and satellite (i.e., free space optical) networks, making it secure, albeit expensive. But for reasons of physics, it does not work on mobile networks. Setting Standards Given the importance of PQC, a lot of effort is going into standardizing robust algorithms. The political weight of the US and the size of its technology industry mean that the US government’s National Institute of Standards and Technology (NIST) is playing a key role in the technical evaluation of post-quantum standardization algorithms and creating standards. NIST expects to publish the first set of post-quantum cryptography standards in 2024. In the meantime, Dustin Moody, a NIST mathematician, recommends (in answers emailed to inform) that companies “become familiar and do some testing with the algorithms being standardized, and how they will fit in your products and applications. Ensure that you are using current best-practice cryptographic algorithms and security strengths in your existing applications. Have somebody designated to be leading the effort to transition. QKD There is no absolute guarantee, however, that a quantum computer in the future won’t find a way to crack PQC. Therefore, institutions such as government agencies and banks remain interested in using QKD fiber and satellite networks to ensure the highest levels of security for data transmission. The European Commission, for example, is working with the 27 EU Member States and the European Space Agency (ESA) to design, develop and deploy a QKD-based European Quantum Communication Infrastructure (EuroQCI). It will be made up of fiber networks linking strategic sites at national and cross-border levels and a space segment based on satellites. EuroQCI will reinforce the protection of Europe’s governmental institutions, their data centers, hospitals, energy grids, and more,” according to the EU. Telecom operators are involved in some of the national programs, including Orange, which is coordinating France’s part of the program called FranceQCI (Quantum Communication Infrastructure). Separately, this month, Toshiba and Orange announced they had successfully demonstrated the viability of deploying QKD on existing commercial networks. Outside the EU, BT has already built and is now operating a commercial metro quantum-encryption network in London. “The London network has three quantum nodes, which are the bearers carrying the quantum traffic for all of the access ingress,” explains Lord. For example, a customer in London's Canary Wharf could link via the network to the nearest quantum-enabled BT exchange. From there, it joins a metro network, which carries the keys from multiple customers “in an aggregated cost-effective way to the egress points,” according to Lord. “It is not trivial because you can mess things up and [get] the wrong keys,” explains Lord. “You really have to be more careful about authentication and key management. And then it's all about how you engineer your quantum resources to handle bigger aggregation.” It also gives BT the opportunity to explore how to integrate quantum systems downstream into its whole network. “What I'm telling the quantum world is that they need to get into the real world because a system that uses quantum is still going to be 90%, non-quantum and all of the usual networking rules and engineering practices apply. You still need to know how to handle fiber. You still need to know how to provision a piece of equipment and integrate it into a network.” SK Telecom is also heavily involved in quantum-related research, with developments including QKD systems for the control and interworking of quantum cryptography communication networks. Japan is another important center of QKD research. A QKD network has existed in Tokyo since 2010, and in 2020, financial services company Nomura Securities Co., Ltd. tested the transmission of data across the Tokyo QKD network. As the EU’s project makes clear, satellite is an important part of the mix. Lord expects satellite-based QKD networks to come on stream as of 2025 and 2026, enabling the purchase of wholesale quantum keys from a dedicated satellite quantum provider. Back in 2017, China already used the satellite to make the first very long-distance transmission of data secured by QKD between Beijing and Vienna, a distance of 7,000km. Securing The Edge There are additional efforts to secure communications with edge devices. BT’s Lord, for example, sees a role for digital fingerprints for IoT devices, phones, cars and smart meters in the form of a physical unclonable function (PUF) silicon chip, which, because of random imperfections in its manufacture, cannot be copied. In the UK, BT is trialing a combination of QKD and PUF to secure the end-to-end journey of a driverless car. The connection to the roadside depends on standard radio with PUF authentication, while transmission from the roadside unit onward, as well as the overall control of the autonomous vehicle network, incorporate QKD, explains Lord. SK Telecom has developed what it describes as a quantum-enhanced cryptographic chip with Korea Computer & Systems (KCS) and ID Quantique. Telefónica Spain has partnered on the development of a quantum-safe 5G SIM card and has integrated quantum technology into its cloud service hosted in its virtual data centers. Given China’s heavy investment in quantum technologies, it is no surprise to see its telecom operators involved in the field. China Telecom, for example, recently invested three billion yuan ($434m) in quantum technology deployment, according to Reuters. Quantum in The Cloud Some of America's biggest technology companies are investing in quantum computing. Today, it is even possible to access quantum computing facilities via the cloud, albeit at on small scale. IBM's cloud access to quantum computers is free for the most basic level, rising to $1.60 per second for the next level. And it is just the beginning. America's big tech companies are racing to build quantum computers at scale. One measure of scale is the size of a quantum processor, which is measured in qubits. While a traditional computer stores information as a 0 or 1, a qubit can represent both 0 and 1 simultaneously. This unique property enables a quantum computer to explore multiple potential solutions to a problem simultaneously; and the greater the stability of its qubits, the more efficient it becomes. IBM has a long history in quantum research and development. In 1998, it unveiled what was then a ground-breaking 2-qubit computer. By 2022, it had produced a 433-qubit processor, and in 2023, it aims to produce a 1,121-qubit processor. Separately, this month, it announced the construction of its first quantum data center in Europe, which it expects to begin offering commercial services as of next year. Google is also firmly in the race to build a large-scale quantum computer. In 2019, a paper in Nature featured Google’s Sycamore processor and the speed with which it undertakes computational tasks. More recent work includes an experimental demonstration of it’s possible to reduce errors by increasing the number of qubits. Microsoft reckons that "a quantum machine capable of solving many of the hardest problems facing humanity will ultimately require at least 1 million stable qubits that can perform 1 quintillion operations while making at most a single error." To this end, it is working on what it calls a new type of qubit, a topological qubit. Amazon announced in 2021 an AWS Center for Quantum Computing on the Caltech campus to build a fault-tolerant quantum computer.

Read More
AI Tech

Empowering Industry 4.0 with Artificial Intelligence

Article | September 8, 2023

The next step in industrial technology is about robotics, computers and equipment becoming connected to the Internet of Things (IoT) and enhanced by machine learning algorithms. Industry 4.0 has the potential to be a powerful driver of economic growth, predicted to add between $500 billion- $1.5 trillion in value to the global economy between 2018 and 2022, according to a report by Capgemini.

Read More
Software, Future Tech, Application Development Platform

How Artificial Intelligence Is Transforming Businesses

Article | August 7, 2023

Whilst there are many people that associate AI with sci-fi novels and films, its reputation as an antagonist to fictional dystopic worlds is now becoming a thing of the past, as the technology becomes more and more integrated into our everyday lives. AI technologies have become increasingly more present in our daily lives, not just with Alexa’s in the home, but also throughout businesses everywhere, disrupting a variety of different industries with often tremendous results. The technology has helped to streamline even the most mundane of tasks whilst having a breath-taking impact on a company’s efficiency and productivity

Read More

The advances of AI in healthcare

Article | February 11, 2020

With the Government investing £250 million into the project, the Lab will consider how to use AI for the benefit of patients – whether this be the deployment of existing AI methods, the development of new technologies or the testing of their safety. Amongst other things, the initiative will aim to deliver earlier diagnoses of cancer. It is estimated that in excess of 50,000 extra patients could see their cancer being detected at an early stage, thus boosting survival rates. More specifically, a study has shown that AI is quicker in identifying brain tumour tissue than a pathologist.This would have a positive knock-on effect in other areas, such as enabling money to be saved (that otherwise would have been spent on further treatment) and reducing the workload of staff (at a time when there is a crisis in NHS workforce numbers).

Read More

Spotlight

EffectiveSoft

EffectiveSoft is an international software development service provider with more than 16 years of professional experience. We are headquartered in San Diego, CA, and offer both local and off-shore presence. EffectveSoft team today counts up to 250 people (both onsite and off-shore). We have been 3x MS Gold Certified and 2x MS Silver Certified. We provide a full cycle of software development services, with main focus on MS Stack, Java, PHP and mobile technologies.

Related News

Cisco Extends On-Premises 'ACI Anywhere' SDN Offering to AWS Cloud

Virtualization Review | April 11, 2019

Cisco Systems followed up on its ACI Anywhere initiative announced last January that seeks to extend its software-defined networking (SDN) technology called Application Centric Infrastructure (ACI) beyond the datacenter -- in this case to the AWS cloud. To do that, the company this week unveiled Cisco Cloud ACI for AWS, which follows on the ACI Anywhere initiative the company previously announced in order to broaden ACI's reach to the AWS and Microsoft Azure clouds. At the time, Cisco said its ACI Anywhere datacenter networking initiative provided flexible deployment options, along with the ability to deploy apps based on business needs criteria rather than technology limitations. "It delivers operational simplicity, application agility and protection in the datacenter -- all delivered in a uniquely open approach that integrates with all hypervisors and container frameworks on which applications are deployed," the company said in announcing the initiative in January. "With ACI Anywhere, that journey extends ACI to any workload, any location, any cloud. Virtual ACI already supports bare metal clouds and remote edge locations.

Read More

AT&T Opens API Marketplace to Complement SDN Portfolio

SDxCentral | March 18, 2019

AT&T today launched a new API marketplace designed to provide businesses with software code to add new services on their sites and applications. It built the marketplace on Ribbon Communications’ Kandy, a cloud-based communications software development platform. “We see the AT&T API Marketplace as a complement to AT&T’s current SDN portfolio,” Greg Johnson, director of voice and collaboration at AT&T Business, wrote in response to questions. “This service rides over the top of [SD-WAN and security] technologies functioning at the application layer.” He cited two-factor authentication as an example of AT&T’s efforts to help businesses decrease fraud on their websites and applications. The network operator is positioning the marketplace for two distinct use cases: turnkey applications and self-service APIs that give developers the flexibility to create custom applications. The self-service APIs enable businesses to add or upgrade services such as click-to-connect communications, two-factor authentication, conferencing, virtual directories and contact centers into their existing environment. Other use cases include automated scheduling, reminders, and broadcast messaging. AT&T plans to regularly add new APIs to the marketplace to increase the number of services available to its business customers, and the operator says it will offer support for more customized integration. “The marketplace will be able to support APIs from multiple software providers and vendors,” Johnson wrote. APIs Work on Over-The-Top Network Transport: “These APIs can function as over the top working on AT&T network transport or any other network transport,” he added. “The APIs are interoperable with outside technologies, and AT&T can connect businesses with developers for hire that can create more tailored solutions to help solve complex needs and use cases.” AT&T is also offering a limited number of pre-packaged applications including click-to-connect communications and a virtual directory that is designed to help customers directly reach the person or department they want without waiting on hold or grinding through an automated phone system.

Read More

AT&T CFO Highlights Software Role in 5G

SDxCentral | March 13, 2019

SDN combined with a surge in new technologies and untapped spectrum holdings are fueling considerable advances for AT&T’s network, CFO John Stephens said at Deutsche Bank’s Media, Internet and Telecom conference. The timing of new technologies coming online, the FirstNet contract win, an expansion of fiber, and 5Gdeployments just getting underway is translating to a “dramatic leapfrog” for AT&T’s mobile business, he said. “We are getting a 50 percent increase on average nationwide in our spectral capacity over a three-year period.” Massive multiple-input multiple-output (MIMO), 256 quadrature amplitude modulation (QAM), and four-way carrier aggregation are achieving new outcomes for AT&T that resolve many of the most challenging aspects of maintaining a network on multiple spectrum bands, he said. “What was challenging about our network before was that we had all the separate spectrum bands, we had all the separate highways, and now with carrier aggregations you can push them all together and use them as if they were one highway.” Timing Is Everything:Because AT&T is putting all of this initial capacity and different technologies in place at once, it’s gaining a “step function above” its 4G LTE network as it evolves to 5G, Stephens said. AT&T is also reducing tower climbs by doing all of this at once, he added. “When we climb a tower now … we are putting up equipment that is 5G enabled by software. So when the 5G software comes out and we want to turn our evolving networking into a 5G network, we can do it from a download or a data card or software update. We don’t have to climb it again,” Stephens said. AT&T was the first U.S. carrier to launch a standards-based mobile 5G network, starting with a dozen markets late last year. It also virtualized the software control of 65 percent of its core network functions by the end of 2018, and intends to reach 75 percent control by 2020.

Read More

Cisco Extends On-Premises 'ACI Anywhere' SDN Offering to AWS Cloud

Virtualization Review | April 11, 2019

Cisco Systems followed up on its ACI Anywhere initiative announced last January that seeks to extend its software-defined networking (SDN) technology called Application Centric Infrastructure (ACI) beyond the datacenter -- in this case to the AWS cloud. To do that, the company this week unveiled Cisco Cloud ACI for AWS, which follows on the ACI Anywhere initiative the company previously announced in order to broaden ACI's reach to the AWS and Microsoft Azure clouds. At the time, Cisco said its ACI Anywhere datacenter networking initiative provided flexible deployment options, along with the ability to deploy apps based on business needs criteria rather than technology limitations. "It delivers operational simplicity, application agility and protection in the datacenter -- all delivered in a uniquely open approach that integrates with all hypervisors and container frameworks on which applications are deployed," the company said in announcing the initiative in January. "With ACI Anywhere, that journey extends ACI to any workload, any location, any cloud. Virtual ACI already supports bare metal clouds and remote edge locations.

Read More

AT&T Opens API Marketplace to Complement SDN Portfolio

SDxCentral | March 18, 2019

AT&T today launched a new API marketplace designed to provide businesses with software code to add new services on their sites and applications. It built the marketplace on Ribbon Communications’ Kandy, a cloud-based communications software development platform. “We see the AT&T API Marketplace as a complement to AT&T’s current SDN portfolio,” Greg Johnson, director of voice and collaboration at AT&T Business, wrote in response to questions. “This service rides over the top of [SD-WAN and security] technologies functioning at the application layer.” He cited two-factor authentication as an example of AT&T’s efforts to help businesses decrease fraud on their websites and applications. The network operator is positioning the marketplace for two distinct use cases: turnkey applications and self-service APIs that give developers the flexibility to create custom applications. The self-service APIs enable businesses to add or upgrade services such as click-to-connect communications, two-factor authentication, conferencing, virtual directories and contact centers into their existing environment. Other use cases include automated scheduling, reminders, and broadcast messaging. AT&T plans to regularly add new APIs to the marketplace to increase the number of services available to its business customers, and the operator says it will offer support for more customized integration. “The marketplace will be able to support APIs from multiple software providers and vendors,” Johnson wrote. APIs Work on Over-The-Top Network Transport: “These APIs can function as over the top working on AT&T network transport or any other network transport,” he added. “The APIs are interoperable with outside technologies, and AT&T can connect businesses with developers for hire that can create more tailored solutions to help solve complex needs and use cases.” AT&T is also offering a limited number of pre-packaged applications including click-to-connect communications and a virtual directory that is designed to help customers directly reach the person or department they want without waiting on hold or grinding through an automated phone system.

Read More

AT&T CFO Highlights Software Role in 5G

SDxCentral | March 13, 2019

SDN combined with a surge in new technologies and untapped spectrum holdings are fueling considerable advances for AT&T’s network, CFO John Stephens said at Deutsche Bank’s Media, Internet and Telecom conference. The timing of new technologies coming online, the FirstNet contract win, an expansion of fiber, and 5Gdeployments just getting underway is translating to a “dramatic leapfrog” for AT&T’s mobile business, he said. “We are getting a 50 percent increase on average nationwide in our spectral capacity over a three-year period.” Massive multiple-input multiple-output (MIMO), 256 quadrature amplitude modulation (QAM), and four-way carrier aggregation are achieving new outcomes for AT&T that resolve many of the most challenging aspects of maintaining a network on multiple spectrum bands, he said. “What was challenging about our network before was that we had all the separate spectrum bands, we had all the separate highways, and now with carrier aggregations you can push them all together and use them as if they were one highway.” Timing Is Everything:Because AT&T is putting all of this initial capacity and different technologies in place at once, it’s gaining a “step function above” its 4G LTE network as it evolves to 5G, Stephens said. AT&T is also reducing tower climbs by doing all of this at once, he added. “When we climb a tower now … we are putting up equipment that is 5G enabled by software. So when the 5G software comes out and we want to turn our evolving networking into a 5G network, we can do it from a download or a data card or software update. We don’t have to climb it again,” Stephens said. AT&T was the first U.S. carrier to launch a standards-based mobile 5G network, starting with a dozen markets late last year. It also virtualized the software control of 65 percent of its core network functions by the end of 2018, and intends to reach 75 percent control by 2020.

Read More

Events