mobile network security - the need to measure security in ... · pdf fileseminar on...

Seminar on IMSI-catchers, Fornebu, 26Aug2015

Mobile network security - the need to measure security in the era of Internet of

Things (IoT)

#mobilspionasje #IoTSec

1 http://www.IoTSec.no

http://www.IoTSec.no

Aug 2015, Josef Noll#mobilspionasje #IoTSec

About

2

Security & Trust


Outline! Mobile phone tracking

➡ The threat ➡ History #mobilspionasje

! From Internet to Internet of Things (IoT) ➡ Kjeller and the Internet ➡ Autonomous systems

! Measurable security for IoT ➡ IoTSec.no - Security for Smart Grid ➡ Future threats

! Conclusions - Lessons learned3

http://IoTSec.no


The threat! Hollande (FR), Merkel (DE) had their mobile

being monitored ! «and we believe it is not happening in Norway?

4

[source: www.rediff.com]

[source: Süddeutsche Zeitung, 18Dec2014]

http://www.rediff.com


History & Comments! 26Nov2014 - Per Anders Johansen

(Aftenposten) phoned to discuss GSMK phone ! 28Nov2014 - Meeting and analysis of values -

«suspicious, wrong behaviour» ! 12Dec2014 - Prior to publishing - «looks

suspect - location dependent» ! 13Dec2014++ - article series published by

Aftenposten ! «surprised about reactions»: Telenor, Netcom,

NKomm, … ! 20Mar2015 - phone conf. with NKomm ! 2Jul2015 - PST legger ned etterforskningen

5

http

://m

m.a

ftenp

oste

n.no

/mob

ilspi

onas

je/

http://mm.aftenposten.no/mobilspionasje/








































































































Can we protect the mobile network?

! Roles of NKomm, Telenor/Netcom, PST ➡ «interested in security?»

! Open security ecosystems ➡ GSM: «Security by obscurity» ➡ LTE: Open security standards ➡ The past and the future

! Security measures ➡ control of fake base stations ➡ small cells (femto cells)

6

«Does it harm

my busin

ess?»


Security measures Solution oriented

! Network monitoring ➡ why does only a

mobile phone listen? ➡ every basestation

listens

! Small (Femto) Cells ➡ man in the middle ➡ My base station is 5

m away

7

[source: seminarsonly.com]

> Hello >< Hello <

> He

llo >

http://seminarsonly.com


How come these guys didn’t think of privacy?

811 ©2007 Deloitte & Touche GmbH WirtschaftsprüfungsgesellschaftWeb 2.0 Expo Berlin 2007

How come these guys didn’t think of that?

Source: http://www.michaelkaul.de/History/history.html

1973 Kjeller

Jon Postel

Steve Crocker

Vinton Cerf1972

http://www.michaelkaul.de/History/history.html

Aug 2015, Josef NollIoTSec.no

Internet of Things Security

9

http://IoTSec.no


The Smart Grid in the close future! Smart grid with prosumers ! various control mechanisms ! attack scenarios ! critical infrastructure

10

Wind farm

Solar farm

Energystorage Distribution

substation

Industrialcustomer

Residential customers

Microgrid

Smart data

control &

management

Energyagent

battery

Intrusionprotection

http://IoTSec.no


IoTSec.no facts

! Research Initiative: Security in IoT for Smart Grids – applicable for Internet of Things (IoT) – focussed on Smart Grid security

! Facts – 1Oct2015 - 30Sep2020, 25 MNOK budget – 10 founding partners, – 18 partners (Aug2015)

! Main outcome – Research in Security for Smart Grid – Industrial Smart Grid Security Centre

11

http://IoTSec.no

http://IoTSec.no


Partners

12

KjellerOslo

Gjøvik

Halden

! Founding partners ➡ University of Oslo (UiO) through the

Institute for Informatics (Ifi) and the University Graduate Centre (UNIK),

➡ Norwegian Computing Centre (NR) ➡ Simula Research Laboratory (SRL) ➡ Gjøvik University College ➡ NCE Smart Energy Markets (NCE Smart) ➡ eSmart Systems (eSmart) ➡ Frederikstad Energi (FEN) ➡ EB Nett (EB) ➡ Movation (MOV)

! Associated Academic Members ➡ Mondragon Unibersitatea, Spain ➡ University of Victoria, Canada ➡ Universidad Carlos III de Madrid, Spain ➡ University of Roma La Sapienza, Italy

! Associated Industrial Members ➡ Mondragon Unibersitatea, Spain ➡ Fredrikstad kommune ➡ EyeSaaS ➡ Nimbeo

! H2020 and ECSEL projects ! COINS Academic Research School

http://IoTSec.no


Research Topics! Tailoring «security challenges» to

targeted research ! Measurable Security, Privacy and

Dependability ! Semantic modelling and provability ! Adaptive security ! Security in IoT Ecosystem

Operational requirements ! Operational security ! Forecast mechanisms ! Operation Centre (from Smart Grid to

Smart City)

13

http://IoTSec.no


Main expected outcome! Robust research community

➡ after 2 years 7 international projects, 2 succeeded ! PhD education

➡ 15 ongoing PhDs ! International involvement

➡ workshops with international partners/1 conference ! Industrial impact, Security Centre @ NCE Smart

➡ Security analyses of existing smart grid infrastructure and technologies

➡ Simulations of cyber-attacks ➡ Security systems of protecting smart grid against cyber-

attack

14

http://IoTSec.no


Conclusions: What I have learned! Mobile phone espionage

➡ yes, it is happening, also in Norway ➡ security costs, but we need to take the costs ➡ clear responsibilities for Ministry of Transport and Communications,

NKomm, Telecom operators, NKomm, … ! Security in Internet of Things (IoT)

➡ autonomous systems ➡ critical infrastructures ➡ Security for Smart Grids - IoTSec.no, Oct2015-Sep2020

! Collaborative approach for a (more) secure Norway ➡ trust is not enough ➡ partnership for security: threats, measures, counter activities

! expected Industrial impact: Security Centre for Smart Grid ➡ hosted in Halden at the Norwegian Centre of Excellence (NCE)

Smart15

http://IoTSec.no


Further Reading! Further reading: search for «Chaos Computer Club IMSI catcher»

16

http

://m

m.a

ftenp

oste

n.no

/mob

ilspi

onas

je/

http://IoTSec.no

https://media.ccc.de/browse/conferences/camp2015/ber15-5-detecting_imsi-catchers_and_other_mobile_network_attacks.html#video









































































































My special thanks to !Per Anders Johansen, Andreas

Bakke Foss and Aftenposten for putting their effort into security

!Rune Rækken and my colleagues from Telenor for the education in 2G, 3G and beyond

!Hans Christian Haugli for the focus on Internet of Things (IoT)

!Andrea Fiaschetti for the invitation to SHIELD - measurable security

!JU Artemis and the Research Councils (Trond Espeli) for support

!Przemyslaw Osocha and Cecilia Coveri for running the SHIELD projects

!Sarfraz Alam, Zahid Iqbal and Mushfiq Chowdhury (UNIK) for the semantics and demos

!Habtamu Abbie (NR) for the good discussions on measurable security

! Iñaki Garitano and Seraj Fayyad for the papers on measurable security

!and all those I have forgotten to mention

17

mobile network security - the need to measure security in ... · pdf fileseminar on...

Documents