I. Introduction

Upon our return from the Consumer Electronics Show and exposure to a dazzling array of electronic devices, computers, smart handheld devices, telephones, transportable storage units, connectivity possibilities from high speed power line and wireless connectivity possibilities that extend information flow through the enterprise, SMB, SOHO, home (now nearly a digital home), mobile devices we carry  even into our vehicles, it is time for our annual rant about security and threats imposed by the plethora of technology. The consumer and business users are faced with an ever expanding horizon of potential attacks at the desk, home, and virtually any environment. Our focus is the connectivity aspects – wire line, wireless, smart devices and transportable information systems (flash drives or discs).

We conduct surveys in the Home, the SOHO (Small Office Home Office), SMB (Small Medium Business, and Enterprise environments to monitor the awareness and impacts of emerging concepts/technologies upon information security and malicious attacks. We have included the home environment this year as connectivity within the home has increased to nearly critical mass. The survey results can be mixed at times and reflect the knowledge levels of the typical survey participants and early adopters.

Given the increasing flow of information in voice (including VoIP), video, and data formats, convergence and triple play offerings remains somewhat confusing to many not just at  home but also in business. The understanding of VoIP is nearly universal for most have either read about the technology or have tried voice over the Internet at a show, friend’s home or office. One overlying concern is the potential for increased security breaches with the additional media modes and streams and what protection levels are necessary for the assessed risk levels.

We will discuss the perceptions and technological needs based upon our user and industry discussions. We do not intend to enter into an extensive technology discourse for the merits and ultimate success in the marketplace is a function of satisfying the user perceptions and needs.

II. Definitions

For our purposes we define each item as follows (others may vary the terminology):

a. VoIP – “Packet” voice transmission over the IP networks (i.e. Internet and Intranets in some people’s minds). We consider IP Telephony as a subset of VoIP.

b. Convergence – Transmission and receipt of Voice (Analog or Digital), Data, and Video over the same global transmission networks.

c. Triple Play - All three media types (Voice, Data, and Video) are combined in an activity.

d. Connectivity and Security Risks – Wireless (all flavors), Wireline, Powerline, Physical, Spyware, Malware, Phishing, Rootkits, Theft/Loss

III. VoIP

The concept of voice transmission in digital (packet format) has been discussed seemingly for decades as a logical replacement for the traditional TDM (time division multiplexed) analog technology. TDM has served the community with a high reliability and consistent quality with dial-tone high availability and virtually no dropped line calls – setting a high standard for VoIP to in most market sectors. Cost savings is a consideration but applications (such as call centers and telecommuting), accessibility, reliability, quality, and ease of configuration/operation continue to be key drivers in our opinion. The latest Skype offering of $30 per annum for calls to both VoIP users and wire line sets has driven many more home users to try and use VoIP.

IP phones use IP for signaling and streaming of voice.  There is no phone jack (RJ-11 Connector) needed for there is a direct LAN/WAN connection through the computer connectivity to the network. One obvious problem in most cases is that if the power fails at your site and there is no back up generator to keep the router functioning, there is no communications capability unless one has a cell phone or access to a land line with (gasp) modem speeds. We did locate an emergency crank phone at CES which would allow you to communicate.

Intrinsic in the IP phone features is the duality of voice and data with both being always on and always connected to the network. The screen interfaces rapidly improved and features of the IP phone are beyond those of the land line sets and PBXs. A Key opportunity is to simplify the feature functionality and help screens for the non-technical user and make it as simple as the traditional “punching numbers” of a traditional handset. Another opportunity is the IP PBX arena with easy to use systems and software. Minimizing complexity is vital for success in serving the SOHO through the Enterprise segments. However, security issues must be addressed and must become a non issue (essentially plug and play) with respect to triple play deployment in these segments.

However, there are special considerations/caveats for VoIP or the WLAN. Typical packet or cell protocols tend to be “bursty” but VoIP must be predictable with a steady stream of packets. Latency is critical with VoIP for any delays or intermittent packet receipt inhibits quality and may actually result in disjointed speech receipt. The limited bandwidth also is more error prone than the wired connection.

Security is of the utmost importance for the WLAN and WAN are global and there are no boundaries. WLAN signaling is exposed and particularly vulnerable. Secure authentication and encryption is a must but encryption can affect latency (encryption requires another computing step on each end to encrypt and decrypt) and resultant quality. An opportunity exists for those companies able to seamlessly minimize the encryption and related delays perhaps with MPLS like techniques to streamline the end point to end point connection.

Another opportunity evident to us in the VoIP quality improvement/maintenance to foster excellent user experiences with the technology. Why? The dynamic networks and use patterns necessitates vigilant monitoring, especially in the wireless components. Here probes, sensors, and engines are crucial for fault analysis with consoles to permit multi-location analyses. The focus is providing maximum QoS (Quality of Service).

As noted in an earlier newsletter – “VoIP is not a perfect system but is dramatically improving.” What problems can be encountered while using VoIP? An echo may be heard by the users if latency is high. The phone rings but the answerer cannot hear the caller for a firewall is blocking the call. SIP (session initiation protocol). Registrations may not work through a firewall. The phone cannot place a call for it will not register on SIP or to the H.323 gateway. The quality breaks down with simultaneous calls due to insufficient ram, CPU power, or bandwidth. Remember where problems exist in the network there is opportunity and your core technologies might be able to create a solution, especially to prevent security breeches.

Security issues are being addressed but in our minds there remains a long road ahead, not only in authentication issues, data integrity, and “pipe" security, but in a seamless integration of security and encryption without performance degradation.

IV. Convergence

Convergence is the concurrent transport of voice, video and data. End points are becoming both voice and data aware and data and voice converge at the application level and business workflow operations. Voice, Video and Data are becoming available anywhere, anytime and anyplace. Video has been added to the mix and now streaming video is available on the desk top and can be accessed anywhere with a smart device using a web connection. All may originate over the same network but typically are not interwoven in most applications. That is where “Triple Play” enters the picture and will be discussed in subsequent paragraphs.

When one transport such as TCP/IP is used for all communications and networked applications (voice and multimedia plus data), a converged network is achieved.  Traditional applications on the converged networks include fax (now using ITU standards T.37 and T.38) for Fax over IP (FoIP), fire and burglary systems, surveillance systems, video conferencing, voice mail, IVR (interactive voice response), CT, and E911. Additional applications are white board applications, instant text messaging, and video streaming to mention a few. New applications are merely a function of one’s imagination for the transport can deliver what is needed in most cases with the exception of bandwidth and processing power limitations. However, each new application and media mode integration opens venues for potential attacks.

V. “Triple Play”

Many are actually using triple play activities but are not aware of the technology requirements – just the results. Opportunities abound in this arena but the vendors are well advised to use an applications approach not a technology enablement to the mass market.

Currently each media type uses a different system. A telephone is used for voice; a video system for video conference calls; and various data collaboration systems for data sharing. In a triple play approach, all the three media types are combined. For example – Viewing an email to open a session with the sender; easily switching between voice and video and voice only or vice versa as with a smart phone/device; and sharing desktop applications during the session. In essence, a single device for all communications applications - TVoIP/TVoDSL, VoD, PVR, and DVR – is available...

There are numerous drivers fostering this emergence. Video deployment has improved with better video codecs (H.263, MPEG4, and H.264); cheaper LCD and memory components; improved battery life for handhelds; and cheaper and lower power processors. Cellular 3G, Wireless (WiFi and WiMax), Wireline IP and Wireline PSTN can all be converged today. Cellular 3G is in mass deployment. Video streaming is routine and video on demand is available. Messaging such as IM, MMS, and Video Mail has become ubiquitous. Video telephony and online multi-participant gaming are commonplace on 3G cellular networks and will spill into other applications. Wireless IP connectivity is gaining in acceptance and with converged networks the triple play is enabled. Wireline activity is also present to add to the sector.

As the service operators increase the connectivity between networks and offer cross network services such as Voice/Video mail, Multimedia Server services, Voice/Video recording capabilities, and Video Portals, additional applications will be developed at price points that are acceptable to the mass markets. Within this increasing complexity of information flows and delivery mechanisms, opportunity abounds for security purveyors not only independently but in global alliances to mitigate threats as much as possible with plug and play solutions.

We continue to advise our clients to research and assess the opportunities in VoIP, Convergence, Triple Play, and Security (intrusion, detection, prevention, and self healing) sectors. The revenue and profit potential for even the most mundane (in the eye of the beholder) are rising dramatically. Vendors need to continue to conduct sufficient market and product research to identify the areas of the highest potentials and matches to the organizations strengths in view of the decreasing time to market requirements and shortened life cycle.

VI. “Connectivity and Security Risks”

If we so desire, we can be connected 24/7 with very few location exceptions. Cellular, Wi-Fi, Wi-Max, Wireline, and now Powerline are all available for connecting nearly all our devices including HDTV in a high speed (802.11n) home network. The vulnerability from an ever increasing number of entry points to the home, SOHO, SMB, and Enterprise networks keep rising.

Security issues/threats now emanate from many directions. The same technology to connect disparate networks, provide seamless interoperability between systems and converged network management through web connections are opportune areas for security breeches.  

Unfortunately, in our surveys, we find many do not create and follow basic security, risk assessment, and vigilance policies. Surprisingly, we continue to find corporate networks unprotected from some thing as basic as identity management (who can connect to the network) to unprotected wireless access points.

The problem appears to worsen at the Home, SOHO and many SMB locations. For example, in setting up a wireless home network, many do not use WEP to eliminate rogue connectivity. It would appear intuitively obvious this is a problem that needs to be solved – Is there a plug and play setup program for the unsophisticated home user. The problem will be exacerbates as more devices are added to the home network including the SOHO.

Security attacks are becoming more sophisticated. No longer is it simple Spyware but increasing damaging Malware, Phising, and Rootkits that we all face. How many smart phones are protected? How many laptops connecting to public wireless networks are securely protected from carrying a threat back to their base network? How many are carrying unknown (to them) threats on the ubiquitous flash drives or small portable drive many of us carry to a meeting instead of a laptop? How do we keep from allowing such a threat from a portable drive or smart phone to enter the network? We do need to keep in mind that walking with a flash or similar drive is now part of the network as is a portable music or video player. This is independent of information format for we all receive voice, video, and data routinely, any of which can be corrupted by a security attack.

One element generally not discussed as part of the security/threat issues is the physical protection of the location. At CES, we saw the Laser Shield, a security device to protect home (and other) entry points. There are other systems and mechanisms for such physical security. As the values of our electronic devices in our “digital” homes, physical protection should be a consideration for the Home or SOHO.

Network security and Malware attacks are one aspect of this problem. Loss of laptops and company data losses of confidential corporate and customer information is major concern given the financial and business exposure. The thumb flash drive (now over 8GB) and portable hard drives are another risk factor. I cannot recall the number of times I have had to search for a tiny thumb drive I unknowingly brushed off my office desk. How do we keep track of these small tools we use especially traveling? One industry survey indicated that over 33% of firms do not regulate mobile devices and and have no security policy for them. Also, up to 25% of the devices transmit proprietary information. This is another opportunity for those who can provide pulg and play security for such items.

Some vendor interaction is welcomed such as the fingerprint reader now standard on some laptops as a basic protection. Identity management is increasing in corporate networks. Many now will not allow an unrecognized device – laptop, flash drive, music player – to attach unhindered to the network. Some thumb drives offer some levels of security with the device. However, an encryption methodology in routine use by corporations will nearly resolve the data loss problem. The same is true of users at their desk or home. An opportunity exists, particularly in the user environment, for an easy to use and easy to decrypt software packages. Perhaps they could be preloaded in new computer and device sales.

Regrettably, the security and threat mitigation seem to remain low on the radar screens of many hardware and software vendors. In general, the visibility (not necessarily effort) does seem to be increasing across the board. We strongly urge our clients to closely review their current security, risk assessment, and threat mitigation policies to ensure they are in place. Mobile security may need the most attention for it may not have the visibility that LAN and WAN threats have to the IT staff.

Opportunity abounds in this arena throughout all market segments. Our clients are advised to look closely at the potential revenue streams via their internal competencies or through strategic alliances.

Meanwhile back to updating our Spyware and internet security software, as we get ready to attend several security shows including RSA in SF this February.  Expect a follow up report.

Ed. Poshkus, Principal Analyst

Jeri Trippe, Editor

Issue No: 2007-011      01-15-2007I

If there are questions about the content or opinions expressed, contact E. Poshkus at edp@venturestechwatch.com

VenturesTechnology Watch Editor: Jeri Trippe   jerit@venturestechwatch.com