https://getit.orgTransforming the Planet – Energy for all – Communicatons for all

While walking through E-mail, doing my morning [[SITREP]], and sipping coffee I was surprise to see a request from a peer asking about X.805 Certification info.  What is “X.805 Certification?”

For those who have never run into [[X.805]], it is a [[ITU]] security reference model submitted by Lucent from their security practices team. As seen by the slide below, it has a lot of impressive illustrations. The spec is informative and a useful tool to walk a variety of people through the complexities of security and resiliency in a telecommunications network. But …….

….. X.805 is not something that leads to “certification.” Why? Back in 2005 – 2006 many people in the SP Security community tried to use X.805 as a risk assessment tool. The goal was to use X.805 to review the security and resiliency of services in a SP’s network. Any effective risk assessment tool will lead the investigator to actionable findings. These findings are the exposures, policy flaws, and other security risk which are problems that need to be resolved.  The hope was that the X.805 model would lead to actions a SP can implement – resulting in a more secure and resilient services.  At lease, that was the hope. Unfortunately,  some of the best minds in the SP Security industry could not figure out how to make X.805 work.

In my personal experience, I was trying to use it to find issues on one service only to find my 100+ page analysis report was not leading me any where. When you have a model that has “72 Security perspectives” will get “thick.” Add to this other peers who were running into similar difficulties. In one case, the Chief of Security for a really big SP in Europe asked one of the co-authors of X.805 to show how the approach will work on a small network — where you can spot problems and fix them. The co-author could not hand over any risk assessment that demonstrated actionable results.

So what happened? X.805 is a nice contribution to the industry, but it did not really deliver what SPs were looking for. IETF did look at it, but found the major conceptural flaw with the lack of applying the [[End to End Model]]. Eric Rescorla  ekr@rtfm.com blogged about this after a session at the IETF: Thoughts on X.805. Others took lessons from this and moved forward with models which could deliver results. Cisco Systems developed first the Cisco Operational Process Model (COPM) then the Cisco Comprehensive Security Assessment Model. This mismatch to the [[End to End Model]] and the inabilty to turn X.805 into a tool which produced deliverables mostly is the reason why the only Alcatel-Lucent and ‘Consultants’ who produce lots of Powerpoint slides are the only ones still talking about X.805.

With about 47,000 attendees to the exhibition and conference in Barcelona, Mobile World Congress was quite a vibrant experienced indeed.

What was of particular interest to me, was the Internet revolution on mobile- finally! How bringing the Internet (and its related applications such as social networking) has brought a brave new frontier for the mobile phone industry.  

Rather than just focus on mobile standards and which one will succeed in the future, there was a greater emphasis on this whole new world of services and applications, and how gaining and keeping customers coming back and using their networks will be key to making money in this business. As consumers move to the Web 2.0 and Web 3.0 tools, users will demand that the wall gardened approach of different standards, networks and operators be brought down. Interoperability and interconnectivity between standards will be key to success in this new space. Key will also be creating sustainable business models. Interestingly, this is also where the Green Telecom agenda plays a part (bringing down OPEX). It is clear that the connecting the next billion users will come from developing countries, and so being mainly off grid places, Green Power in Telecommunications is key.

Thus this year, there was a great addition of the Green Power Pavilion. Green energy companies, energy efficiency companies, and power management companies were featured. One interesting company is VNL (see my write up under Green ICT).

I was also particularly enamored with new players in the mobile space. Laptop companies such as Acer and Lenovo introduced smart phones to compete with the traditional players such as Nokia, HTC, Samsung and not so traditional ones such as Apple (having led the way). Acer’s Smartphone (DX900) was particularly attractive as it offered connectivity to EDGE, 3G, HSDPA and Wi-Fi. It also had a dual SIM card feature, which is very attractive for the mobile business traveler.

Another interesting thing at MWC 2009 was to see companies such as Yahoo, Microsoft. Adobe, Google showcase or launch old and new mobile software. Apple type user friendly, attractive and touch screen software was the name of the game. Now the question was how to convince either the mobile handset manufacturer or the mobile operator to preload their software so that they can gain market share of eyeballs quicker than just having users upload the software themselves, people were into the worlds skins lookout not this. Not to be left behind, Nokia joined in the “Apple apps store” type approach, by launching its own form of an application store called Ovistore.

This coming together of old and new software companies, computer manufacturers, handset manufacturers and service provider industry truly created a sense of dynamism to MWC. Apart from these big players, there were many mobile application vendors showing off cool mobile tools for the mobile phone. Mobilfilms were also present to encourage more content creation for the mobile phones.

Overall a very fruitful trip and many good networking opportunities. The highlight of my trip was however really meeting Will.I.Am at the Mobile Awards dinner. Being an Obama fan myself who went to DC for the Inauguration, it was indeed a very special treat. I loved his rendition of “It is a New Day” which he sang with Jamie Cullen, a great jazz musician.

We’ve seen a flurry of outages on some of the major submarine cable systems:

https://getit.org/Mediawiki/index.php?title=Submarine_Cable_Systems_in_the_News

Some points everyone is missing.

First, as I pointed out on a NANOG post, cable outages happen all the time. Nothing new. that is why we have a large fleet of ships to repair cables. At the time of these recent outages, 2/3 of the fleet were deployed on jobs (on station, in transit, or in prep) . So it is nice to have attention on this critical resource, but the events are not news. What is news relates to the impact of the outage …. which leads to my second point.
Second, why did the telecommunications providers not safe guard their business by trading and investing in capacity around choke points? Many of the countries most impacted are not stuck with one submarine cable. They have multiple paths. Most submarine cables which land in the effected countries are way stations – where you have two paths going out. What does this mean? It means that each of these telecommunications providers have options. Options which allow for redundancy and recovery planning.

The real story is the lack of redundancy planning. Engineers did not work out how their telecommunications services would recover if known areas of common submarine cable incidents really happened. Now, some would say that redundancy is expensive. True, but that is part of the business. Plus, if you get into the planning, asking about recovery option, talking to peers (competitors) about swapping reserved capacity during an emergency, or looking at Layer 3 recovery options, reveal options. But these options will not appear unless the engineers responsible for the “engineering” work ask the questions. These engineers are the IP engineers – pushing on the layer 2 (circuit), and layer 1 (submarine systems engineers) know exactly what is happening with their telecommunications paths.

For example, asking the submarine company for the list of all their cases where a repair ship had to be sent, where these happened, and the mean time of repair are all facts which are provided to their customers. All it takes is knowing that you can ask for it, then pushing to get it. When you are spending millions of dollars a month on these telecommunication services, you need to ask for the information to safe guard that investment. As seen in the attached map (from Flag), thes submarine cable companies can and will provide the information you need to understand, plan, and implement effective telecommunications recovery plans.

This is not new! We – the telecommunications industry have done this in the past – why cann’t we do it today? The Internet is our new Next Generation Network (IP NGN) for all telecommunications. We cannot throw out the baby with the bath water moving forward with IP NGN.