Home
About Black Swan Editorial Mission Reports & Papers
Fraud Systems SIM Box Roaming Fraud PBX Fraud Subscription Databases
RA Practices Business Assurance RA Maturity RA Consulting Bill Testing
Wholesale Systems Net Inventory Margin Assure Partner Mgmt
Customer Behavior Machine Learning Network Analytics Marketing Analytics
Network Behavior Mobile & IoT Security Trusted Communication Signaling
Email a colleague    

September 2011

LTE Monitoring: The Virtue of Combining Service and Security Assurance

interview with James Heath & Steve Shalita

LTE Monitoring: The Virtue of Combining Service and Security Assurance

Are network operators prepared for the Pandora’s box of security and performance risks created by an all-IP network?  If not, they could be getting all the ills of the Internet with few of its benefits.

But why choose IP if it has so many weaknesses?  Initially data networks were based on ATM or Frame Relay, but the popularity of the Internet drove operators to IP.  IP works well for its intended purpose, but about five years ago the introduction of time-sensitive services, like IPTV and VoIP, showed the limitations of IP technology.  Of course there are all sorts of features in ATM and TDM networks to handle real-time communications that are missing in IP.

Happily, the weakness in IP traffic management is being addressed by deep packet inspection (DPI).  By peering deep inside the packet, you can understand what type of traffic it is and how it ought to be handled.  Similarly, the weakness in IP service assurance was addressed by Network Behavioral Analysis (NBA), which is the gathering and analyzing of traffic metrics at various points in the network to better detect security and performance issues.

Steven Shalita, the VP of Marketing at NetScout, is with us today to talk about network behavioral analysis (NBA), and why NBA is becoming necessary to provide security and service assurance in IP networks.  Steve has been with NetScout for three years with a two-year interlude at Alcatel-Lucent’s IP Division and time at Redback and Cisco.  Steve delves into how IP complicates service assurance and service delivery, and shows an approach to safeguarding the end-user experience and the service provider’s profitability.

James Heath: Steve, NetScout has been providing service assurance and traffic management solutions for a long time to service providers and enterprises.  How do these two different markets approach network security in your experience?

Steve Shalita: We often have enterprises use our products in cyber defense, but it’s less common among our service provider customers.  Their interest in us is centered on the user experience, through service quality and service management.  And this is because in the past the service providers felt there was little chance that their network was threatened and so their security efforts concentrated on selling enterprises ways to protect data-in-motion, like a VPN.

With service providers moving away from the traditional TDM technology to the much more dynamic environment that IP offers, traffic patterns will be more unpredictable and the number of different terminal devices and applications will be greater.  So, just as the threat risk increases, traffic flow visibility decreases.

But telecom has been doing IP networking for at least a decade, so what’s different?  What are the issues that are causing fits for the service providers?

In a way, service providers have had it easy in the past because they were never forced to do a full cut-over to IP.  They could upgrade their systems region-by-region.

With LTE it’s different.  Wireless companies always had the advantage of a strong standards group, 3GPP, which provided a stock network architecture, so every LTE network will be all-IP.  This rollout is having a revolutionary impact on the perceived need for service monitoring.

You see, IP networks need to be instrumented quite differently from TDM networks.  With TDM, all types of links — SONET/SDH, ATM, etc. — were provisioned between the connection points.  So to monitor TDM, monitoring the signaling channel was sufficient to service-assure voice in 2G, 3G and circuit-switched networks.  However, in the IP environment, monitoring the signaling is no longer enough.  You must also turn your attention to the data plane.

Now the data plane is really hard to analyze, not only from a capacity and volume point of view but also in terms of extracting information and understanding the dynamics of an IP session.  The stateless data sessions of Web surfing are a great example.  Every time you click a new Web page, a new connection is made, and each one requires authentication, so you’re constantly hitting the DNS servers, the AAA servers, the wireless HLR and similar devices.

The other complication for wireless telecoms is the growing popularity of Wi-Fi hotspots and femtocells.  Both use third-party networks to carry wireless traffic back to the mobile core.  This lack of visibility all the way out to the handset is a big management concern.  At least with NetScout you can see the traffic coming in and can classify it.

You are not a traditional security vendor as you used NBA initially to provide service assurance and then moved into security.  What advantages do you provide over others who took the route from cyber defense space?

I think the simple answer to that is investment leverage.  Much of the technology required to do security-specific anomaly detection is already resident in our service-assurance solution.  And because we can leverage our skill of finding deviations and abnormalities in service traffic, it saves a service provider the expense of buying a purpose-built security solution.

Most of our telecom customers deploy our nGenius Infinistream appliance because it not only gives them our Adaptive Session Intelligence (ASI) capability — a granular transaction session-oriented metadata — but also an ability to store packets for historical analysis.  Having the nGenius Infinistream store those packets gives them the ability to reconstruct a data conversation as if it were happening in real-time and to forensically analyze it for both service delivery and security anomalies.

So the investment made to assure service delivery can be leveraged to get the incremental benefit of security visibility.

The traffic volumes of service provider networks are usually huge so you obviously can’t monitor everything.  Are there some rules of thumb or standard operating procedures that service providers follow to prioritize what needs monitoring?

For a mobile network the No. 1 location of problem generation is DNS, whether it be DNS flooding or other types of performance issues.  So operators typically start in that area, in the authentication or federation layer, which includes DNS, the AAA server and the HLR.

The next place they tend to look at is the mobile core, the common gateways between the radio access network, (RAN), and the voice or data transport networks.  Because all traffic is flowing through it, by monitoring these gateways in the mobile core you’re seeing all elements of a conversation.  You’re seeing the protocols, the setup, data and voice traffic and the individual subscribers.

The next priority is to expand to the data center where applications are hosted, then to the apps store where services or applications are delivered to the user.  From there they tend to push out to the Radio Access Network (RAN) and its links.  So each point they cover will give them another increment of visibility.

As for monitoring the cell-site backhauls or out at the RNCs, BSCs, and NodeBs, that isn’t as prevalent today because of cost, and because it’s unnecessary.  You get a great amount of visibility just by monitoring the mobile core.  You have the granularity of seeing down to the cell site, down to the subscriber.  So a typical deployment footprint covers these various connection points and the core.

Obviously, monitoring of the network traffic can turn up two kinds of anomalies: a security-related anomaly such as a bot or infection, and a performance anomaly — both of which could threaten an outage.  Can you give us some examples of such outages that you’ve detected?

Carriers are pretty guarded about sharing information like this and unfortunately all my anecdotes would be too specific and identify a carrier.  Yet if you look at the most spectacular telecom outages as example — and I am not saying we detected any of them — these outages at NTT, AT&T and Verizon all started out as little things that could have been detected and averted.

These problems manifested themselves over time, which could have been as simple as a route flap or a DNS problem and eventually escalated to a complete outage.  Whether that’s security-related or performance-related, whether it’s intentional or unintentional, our system would detect those deviations very early on before users or large numbers of users are impacted.

Do you have any advice for service providers or enterprises on what they might do to look at their security problems and how NetScout is really able to help?

The security risks are real and they threaten service providers’ abilities to provide service assurance.  Service-assurance risk is compounded by IP traffic patterns and the dramatic increase in traffic volume brought by broadband access.  Also, simultaneously, users are becoming less tolerant of bad service yet they want to use more devices running more applications.

It’s becoming vitally important to make the proper investment to address those challenges so they can improve their situational awareness.  NBA, the analysis of the information gained by peering deep inside packets at certain points in the network, is an essential way to address internal network security and network performance.

But IP packet-flow visibility provided by NBA is not the end in itself.  It is the means to the end.  IP networks packet analysis is the only way to extract the information needed to manage your traffic.  That’s the strength of NBA.  We’re good at it and that’s been the key to our success.

This article first appeared in Billing and OSS World.

Copyright 2011 Black Swan Telecom Journal

 
James Heath

James Heath

James Heath is a senior consultant for Ericsson and a former analyst with Technology Research Institute (TRI).  He authored a 2010 multi-client study on Botnet defense, “Advanced Network Security for the Large Enterprise: Market Analysis Report and Guide to Cyber Security Solutions that Defend Against Botnets, Denial-of-Service and Data Theft Attacks.“  Previously, while at Dittberner Associates, he tracked the broadband access and Switch and Router markets in more than 65 countries and authored studies on broadband, IPTV, LTE, and Carrier Routers.

Steven Shalita

Steven Shalita

Steven is Vice President, Marketing at Netscout Systems and leads their global marketing activities.

Steve returned to NetScout in July of 2008, having been Director, Product Marketing at NetScout from 1997 through 1999.

During his time away, he held marketing leadership positions at Alcatel-Lucent, Redback Networks, Hewlett-Packard and Cisco Systems.   Contact Steven via

Black Swan Solution Guides & Papers

cSwans of a Feather

  • NuData Analyzes Behaviors to Stop Automated Fraud Attacks & Identify Fake Customers Inside the Firewall — interview with Robert Capps — A cybercrime expert examines the role of behavioral analysis and explains why it’s critical even when the device identity is known.  He also explains how human-like automation is detected and why an analysis of browser level activity delivers an extra edge in identifying fraud attacks.
  • Metadata Toolkit: Mediating the IP Network in Support of Fresh Security Apps — interview with Bob Noel — Mediating the IP network has always been an issue due to its sheer complexity.  But now a clever software supplier uses metadata to abstract network events and economically enable the development of near-real-time security apps.
  • A Big Win/Win: Protecting Mobile Users While Boosting Revenue — by Dan Baker — Increasingly mobile operators will turn to the cloud to find compelling services.  This white paper explains the benefits of a cloud security service that detects and blocks malware.
  • LTE Monitoring: The Virtue of Combining Service and Security Assurance — interview with James Heath & Steve Shalita — The arrival of  LTE, the all-IP wireless standard, greatly complicates the guaranteee of service quality and security.  This article details of the many challenge and reasons why additional investments will be required to remain secure.  Fortunately a saving grace is proposed: a single Network Behavioral analysis (NBA) system for anomaly detection that serves the dual missions of service assurance and cybersecurity.

Related Articles

  • Tokopedia, Indonesia’s E-Commerce King, Partners with 11 Million Merchants; Adopts Multi-Cloud to Drive Innovation — interview with Warren Aw & Ryan de Melo — Indonesia’s Tokopedia, founded in 2009, has grown to become one of world’s leading e-commerce players.  Read about its success, technology direction, and multi-cloud connectivity adoption.
  • Bridge Alliance: Knocking Down Regional & Mobile Connectivity Barriers so Connected Car Markets Get Rolling in Asia — interview with Kwee Kchwee — The CEO of an Asian consortium of mobile operators explains how they  help simplify and harmonize their members‘ operations in support of multi-national corporations.  This integration is enabling two huge industries to come together in Asia: auto manufacturing and telco.
  • Epsilon’s Infiny NaaS Platform Brings Global Connection, Agility & Fast Provision for IoT, Clouds & Enterprises in Southeast Asia, China & Beyond — interview with Warren Aw — Network as a Service, powered by Software Defined Networks, are a faster, more agile, and more partner-friendly way of making data global connections.  A leading NaaS provider explains the benefits for cloud apps, enterprise IT, and IoT.
  • PCCW Global: On Leveraging Global IoT Connectivity to Create Mission Critical Use Cases for Enterprises — interview with Craig Price — A leading wholesale executive explains the business challenges of the current global IoT scene as it spans many spheres: technical, political, marketing, and enterprise customer value creation.
  • Senet’s Cloud & Shared Gateways Drive LoRaWAN IoT Adoption for Enterprise Businesses, Smart Cities & Telecoms — interview with Bruce Chatterley — An IoT netowork pioneer explains how LoRaWAN tech fits in the larger IoT ecosystem.  He gives use case examples, describes deployment restraints/costs, and shows how partnering, gateway sharing, and flexible deployment options are stimulating growth.
  • ARM Data Center Software’s Cloud-Based Network Inventory Links Network, Operations, Billing, Sales & CRM to One Database — interview with Joe McDermott & Frank McDermott — A firm offering a cloud-based network inventory system explains the virtues of: a single underlying database, flexible conversions, task-checking workflow, new software business models, views that identify stranded assets, and connecting to Microsoft’s cloud platform.
  • Pure Play NFV: Lessons Learned from Masergy’s Virtual Deployment for a Global Enterprise — interview with Prayson Pate — NFV is just getting off the ground, but one cloud provider to enterprises making a stir in virtual technology waters is Masergy.  Here are lessons learned from Masergy’s recent global deployment using a NFV pure play software approach.
  • The Digital Enabler: A Charging, Self-Care & Marketing Platform at the Core of the Mobile Business — interview with Jennifer Kyriakakis — The digital enabler is a central platform that ties together charging, self-care, and marketing.  The article explains why leading operators consider digital enablers pivotal to their digital strategies.
  • Delivering Service Assurance Excellence at a Reduced Operating Cost — interview with Gregg Hara — The great diversity and complexity of today’s networks make service assurance a big challenge.  But advances in off-the-shelf software now permit the configuring and visualizing of services across multiple technologies on a modest operating budget.
  • Are Cloud-Based Call Centers the Next Hot Product for the SMB Market? — interview with Doron Dovrat — Quality customer service can improve a company’s corporate identity and drive business growth.  But many SMBs are priced out of acquiring modern call center technology.  This article explains the benefits of affordable and flexible cloud-based call centers.
  • Flexing the OSS & Network to Support the Digital Ecosystem — interview with Ken Dilbeck — The need for telecoms to support a broader digital ecosystem requires an enormous change to OSS infrastructures and the way networks are being managed.  This interview sheds light on these challenges.
  • Crossing the Rubicon: Is it Time for Tier Ones to Move to a Real-Time Analytics BSS? — interview with Andy Tiller — Will tier one operators continue to maintain their quilt works of legacy and adjunct platforms — or will they radically transform their BSS architecture into a new  system designed to address the new telecom era?  An advocate for radical transformation discusses: real-time analytics, billing for enterprises, partnering mashups, and on-going transformation work at Telenor.
  • Paradigm Shift in OSS Software: Network Topology Views via Enterprise-Search — interview with Benedict Enweani — Enterprise-search is a wildly successful technology on the web, yet its influence has not yet rippled to the IT main stream.  But now a large Middle Eastern operator has deployed a major service assurance application using enterprise-search.  The interview discusses this multi-dimensional topology solution and compares it to traditional network inventory.
  • The Multi-Vendor MPLS: Enabling Tier 2 and 3 Telecoms to Offer World-Class Networks to SMBs — interview with Prabhu Ramachandran — MPLS is a networking technology that has caught fire in the last decade.  Yet the complexity of MPLS has relegated to being mostly a large carrier solution.  Now a developer of a multi-vendor MPLS solutions explains why the next wave of MPLS adoption will come from tier 2/3 carriers supporting SMB customers.
  • Enabling Telecoms & Utilities to Adapt to the Winds of Business Change — interview with Kirill Rechter — Billing is in the midst of momentous change.  Its value is no longer just around delivering multi-play services or sophisticated rating.  In this article you’ll learn how a billing/CRM supplier has adapted to the times by offering deeper value around the larger business issues of its telecom and utility clients.
  • Driving Customer Care Results & Cost Savings from Big Data Facts — interview with Brian Jurutka — Mobile broadband and today’s dizzying array of app and network technology present a big challenge to customer care.  In fact, care agents have a hard time staying one step ahead of customers who call to report problems.  But network analytics comes to the rescue with advanced mobile handset troubleshooting and an ability to put greater intelligence at the fingertips of highly trained reps.
  • Hadoop and M2M Meet Device and Network Management Systems — interview with Eric Wegner — Telecom big-data in networks is more than customer experience managment: it’s also about M2M plus network and element management systems.  This interview discusses the explosion in machine-to-machine devices, the virtues and drawbacks of Hadoop, and the network impact of shrink-wrapped search.
  • The Data Center & Cloud Infrastructure Boom: Is Your Sales/Engineering Team Equipped to Win? — by Dan Baker — The build-out of enterprise clouds and data centers is a golden opportunity for systems integrators, carriers, and cloud providers.  But the firms who win this business will have sales and engineering teams who can drive an effective and streamlined requirements-to-design-to-order process.  This white paper points to a solution — a collaborative solution designs system — and explains 8 key capabilities of an ideal platform.
  • Big Data: Is it Ready for Prime Time in Customer Experience Management? — interview with Thomas Sutter — Customer experience management is one of the most challenging of OSS domains and some suppliers are touting “big data” solutions as the silver bullet for CEM upgrades and consolidation.  This interview challenges the readiness of big data soluions to tackle OSS issues and deliver the cost savings.  The article also provides advice on managing technology risks, software vendor partnering, and the strategies of different OSS suppliers.
  • Calculated Risk: The Race to Deliver the Next Generation of LTE Service Management — interview with Edoardo Rizzi — LTE and the emerging heterogeneous networks are likely to shake up the service management and customer experience management worlds.  Learn about the many new network management challenges LTE presents, and how a small OSS software firm aims to beat the big established players to market with a bold new technology and strategy.
  • Decom Dilemma: Why Tearing Down Networks is Often Harder than Deploying Them — interview with Dan Hays — For every new 4G LTE and IP-based infrastructure deployed, there typically a legacy network that’s been rendered obsolete and needs to be decommissioned.  This article takes you through the many complexities of network decom, such as facilities planning, site lease terminations, green-safe equipment disposal, and tax relief programs.
  • Migration Success or Migraine Headache: Why Upfront Planning is Key to Network Decom — interview with Ron Angner — Shutting down old networks and migrating customers to new ones is among the most challenging activities a network operators does today.  This article provides advice on the many network issues surrounding migration and decommissioning.  Topics discussed include inventory reconciliation, LEC/CLEC coordination, and protection of customers in the midst of projects that require great program management skills.
  • Navigating the Telecom Solutions Wilderness: Advice from Some Veteran Mountaineers — interview with Al Brisard — Telecom solutions vendors struggle mightily to position their solutions and figure out what to offer next in a market where there’s considerable product and service crossover.  In this article, a veteran order management specialist firm lays out its strategy for mixing deep-bench functional expertise with process consulting, analytics, and custom API development.
  • Will Telecoms Sink Under the Weight of their Bloated and Out-of-Control Product Stacks? — interview with Simon Muderack — Telecoms pay daily for their lack of product integration as they constantly reinvent product wheels, lose customer intelligence, and waste time/money.  This article makes the case of an enterprise product catalog.  Drawing on central catalog cases at a few Tier 1 operators, the article explains the benefits: reducing billing and provisioning costs, promoting product reuse, and smoothing operations.
  • Virtual Operator Life: Enabling Multi-Level Resellers Through an Active Product Catalog — interview with Rob Hill — The value of product distribution via virtual operators is immense.  They enable a carrier to sell to markets it cannot profitably serve directly.  Yet the need for greater reseller flexibility in the bundling and pricing of increasingly complex IP and cloud services is now a major channel barrier.  This article explains what’s behind an innovative product catalog solution that doubles as a service creation environment for resellers in multiple tiers.
  • Telecom Blocking & Tackling: Executing the Fundamentals of the Order-to-Bill Process — interview with Ron Angner — Just as football teams need to be good at the basics of blocking and tackling, telecoms need to excel at their own fundamental skillset: the order-to-cash process.  In this article, a leading consulting firm explains its methodology for taking operators on the path towards order-to-cash excellence.  Issues discussed include: provisioning intervals; standardization and simplicity; the transition from legacy to improved process; and the major role that industry metrics play.
  • Wireline Act IV, Scene II: Packaging Network & SaaS Services Together to Serve SMBs — by John Frame — As revenue from telephony services has steadily declined, fixed network operators have scrambled to support VoIP, enhanced IP services, and now cloud applications.  This shift has also brought challenges to the provisioning software vendors who support the operators.  In this interview, a leading supplier explains how it’s transforming from plain ol‘ OSS software provider to packager of on-net and SaaS solutions from an array of third party cloud providers.
  • Telecom Merger Juggling Act: How to Convert the Back Office and Keep Customers and Investors Happy at the Same Time — interview with Curtis Mills — Billing and OSS conversions as the result of a merger are a risky activity as evidenced by famous cases at Fairpoint and Hawaiian Telcom.  This article offers advice on how to head off problems by monitoring key operations checkpoints, asking the right questions, and leading with a proven conversion methodology.
  • Is Order Management a Provisioning System or Your Best Salesperson? — by John Konczal — Order management as a differentiator is a very new concept to many CSP people, but it’s become a very real sales booster in many industries.  Using electronics retailer BestBuy as an example, the article points to several innovations that can — and are — being applied by CSPs today.  The article concludes with 8 key questions an operator should ask to measure advanced order management progress.
  • NEC Takes the Telecom Cloud from PowerPoint to Live Customers — interview with Shinya Kukita — In the cloud computing world, it’s a long road from technology success to telecom busness opportunity.  But this story about how NEC and Telefonica are partnering to offer cloud services to small and medium enterprises shows the experience of early cloud adoption.  Issues discussed in the article include: customer types, cloud application varieties, geographic region acceptance, and selling challenges.
  • Billing As Enabler for the Next Killer Business Model — interview with Scott Swartz — Facebook, cloud services, and Google Ads are examples of innovative business models that demand unique or non-standard billing techniques.  The article shows how flexible, change-on-the-fly, and metadata-driven billing architectures are enabling CSPs to offer truly ground breaking services.
  • Real-Time Provisioning of SIM Cards: A Boon to GSM Operators — interview with Simo Isomaki — Software-controlled SIM card configuration is revolutionizing the activation of GSM phones.  The article explains how dynamic SIM management decouples the selection of numbers/services and delivers new opportunities to market during the customer acquisition and intial provisoining phase.
  • A Cynic Converted: IN/Prepaid Platforms Are Now Pretty Cool — interview with Grant Lenahan — Service delivery platforms born in the IN era are often painted as inflexible and expensive to maintain.  Learn how modern SDPs with protocol mediation, high availability, and flexible Service Creation Environments are delivering value for operators such as Brazil’s Oi.
  • Achieving Revenue Maximization in the Telecom Contact Center — interview with Robert Lamb — Optimizing the contact center offers one of the greatest returns on investment for a CSP.  The director of AT&T’s contact center services business explains how telecoms can strike an “artful balance” between contact center investment and cost savings.  The discussion draws from AT&T’s consulting with world class customers like Ford, Dell, Discover Financial, DISH Network, and General Motors.
  • Mobile Broadband: The Customer Service Assurance Challenge — interview with Michele Campriani — iPhone and Android traffic is surging but operators struggle with network congestion and dropping ARPUs.  The answer?  Direct  resources and service quality measures to ensure VIPs are indeed getting the quality they expect.  Using real-life examples that cut to the chase of technical complexities, this article explains the chief causes of service quality degradation and describes efficient ways to deal with the problem.
  • Telco-in-a-Box: Are Telecoms Back in the B/OSS Business? — interview with Jim Dunlap — Most telecoms have long since folded their merchant B/OSS software/services businesses.  But now Cycle30, a subsidiary of Alaskan operator GCI, is offering a order-to-cash managed service for other operators and utilities.  The article discusses the company’s unique business model and contrasts it with billing service bureau and licensed software approaches.
  • Bricks, Mortar & Well-Trained Reps Make a Comeback in Customer Management — interview with Scott Kohlman — Greater industry competition, service complexity, and employee turnover have raised the bar in the customer support.  Indeed, complex services are putting an emphasis on quality care interactions in the store, on the web, and through the call center.  In this article you’ll learn about innovations in CRM, multi-tabbed agent portals,  call center agent training, customer treatment philosophies, and the impact of  self-service.
  • 21st Century Order Management: The Cross-Channel Sales Conversation — by John Konczal — Selling a mobile service is generally not a one-and-done transaction.  It often involves several interactions — across the web, call center, store, and even kiosks.  This article explains the power of a “cross-channel hub” which sits above all sales channels, interacts with them all, and allows a CSP to keep the sales conversation moving forward seamlessly.
  • Building a B/OSS Business Through Common Sense Customer Service — by David West — Delivering customer service excellence doesn‘t require mastering some secret technique.  The premise of this article is that plain dealing with customers and employees is all that’s needed for a winning formula.  The argument is spelling out in a simple 4 step methodology along with some practical examples.