Safeguarding Network Elements from Hijacking and Malicious Code: Best Practices

Securing network elements is, of course, vital to the integrity of the operation. While direct
attacks on equipment operating systems intended to disable networks for lengthy intervals are
not at all commonplace, intrusions into management systems have occurred in the past and
undoubtedly will occur in the future. Obviously, they should be prevented at all costs. Unfortunately,
many of today’s network elements are more vulnerable than the telco “big iron” of
the past. Telephone circuit switches and asynchronous transfer mode (ATM) switches generally
utilized some variant of Unix as an operating system and involved extremely arcane code
that few hackers ever mastered. Indeed, most of the people who successfully hacked into
telephone central offices were experienced individuals working in telecommunications. In
contrast, many network devices manufactured today use open or commonly understood platforms
such as Linux, Windows NT, or Java. They may incorporate some type of software
firewall to thwart intruders, but they are not inherently difficult to understand or manipulate.
And because wireless transmissions can be physically intercepted with great ease, there is little
physical layer security possible in the network, and the network operator must remain largely
dependent on specialized security software.
The danger is compounded because most equipment today is designed to permit remote
management by an authorized network administrator from a supposedly secure Web site.
Obviously, that greatly eases the job of network administrators, enabling them to respond to
problems in the network anywhere and at any time without having to visit the central office.
However, if the administrator can access the OSS suite, then so can a hacker—if that individual
can get past whatever security measures are in place. Accordingly, the network operator must
make certain that there are no “trap doors” permitting entry into the management system that
bypass authentication measures.