The challenge of protecting the world's biggest telco

This article was originally published on Technology.Info.
As part of our continuing strategy for growth, ITProPortal has joined forces with Technology.Info to help us bring you the very best coverage we possibly can.

Richard Knowlton is Group Security Director at Vodafone. He is appearing at

Cyber Security Expo in a keynote presentation

on Wednesday 8th October.

His global role with the world’s biggest telco brings substantial risks and pressures. Dialing in from his base in Italy, he focused on some in a recent interview with us.

Since we last spoke, the world seems to have got more dangerous - not less. How has this impacted on the risks that businesses like Vodafone face?

In general the broad

security threats

that multinational face don't tend to change much over time. State actors, organised crime, hacktivists and extremists are very much the background noise to my life.

However, a specific concern for Vodafone is

data attacks

. Our crown jewels are customer details, the call content, location data, who they are calling. Plus of course stock price sensitive information such as M&A plans makes us a juicy target.

Then there are attacks launched across our networks aimed at our major enterprise clients. We are also part of the

critical Infrastructure

, and so all of these factors play into the complex

risk management framework

that Vodafone has.

Are huge multinationals like Vodafone increasingly a target for hackers, criminals and hacktivists?

The simple answer is yes. Every month we face 70bn cyber events, blocking about 250,000 attempts to

hack into our networks

. These are huge numbers that result in about 60 or 70 events that warrant really serious attention.

As a business Vodafone is expanding fast into new markets which makes us an even bigger target. More generally the attackers are developing in sophistication at an extraordinary rate. To combat this close cooperation is essential with industry peers and government.

But a criticism of many large enterprises is that they won't share intelligence on cyber attacks as they feel it would be bad PR?

The sharing of intelligence on cyber attacks and defence best practice is essential, and we all need to get better at it as fast as possible. We all need each other.

The

UK Computer

Information Security Partnership (CISP) is a good model, but really valuable exchanges need a mutual level of trust. The telecoms, finance and defence sectors tend to work well because they have been the subject of extreme attacks for much longer. The intelligence exchange carries on behind the scenes and largely carries no PR risk.

There are of course tricky issues around notifying customers when a breach has been identified. Our approach is based on a firm principle: the customer is king. Transparency is the only way we will retain the confidence of our customers.

Smartphones and social media are becoming a third front in wars and conflicts. How hard is it to resist calls to shut down networks in troubled operating regions?

The Arab Spring was a wakeup call that we were now in the front line, not just us but the whole telecoms sector. So we took a cross sector approach with eight partners in the telecoms sector and published our

guiding principles

, for anyone to read.

These state our principles on how we manage situations. If there is a deteriorating situation in country x, and the government asks us to switch off our network, the principles set out exactly what we do. We will make that request public, questioning if this is really what they want to do.

We were the first global telecom company to publish full information on what national governments demand from us and how far we go along with them. This was published in June in our Annual Sustainability Report, and has had a big impact around the world. Many other

telecom companies

are now putting the issue at the top of their agendas.

It’s an area that we are absolutely determined to strike the right balance between our customers’ rights and our legal obligations.

What is your hope for the world of cyber security in 2015?

First, that all of us do everything possible to encourage greater co-operation to protect ourselves against cyber attacks.

Intelligence exchange

, that's crucial, but also we need to focus on the knotty public policy issues.

For example, on EU law we need to ensure there is a private public partnership approach to legislation. We don't want extra layers of legislation, which is often irrelevant by the time it gets to the statute.

I’m the Vodafone representative on the board of the

Internet Security Alliance

, and working very hard to establish a European version (ISAFE) to help thrash out such matters.

My second hope is for more security awareness at board level. Still too many see

cyber security

as a technical issue, throw money at the CISO and CIO and hope the problem will go away. We have to make it an enterprise wide risk issue. The ISA has just published a paper on principles for managing cyber risk for Boards of Directors. It’s been downloaded 9000 times already.

Finally, what’s the best thing about being based in Italy?

This question is more difficult than it seems! Lots of people would say the people, the food and the wine, but I think the greatest thing about Italy, and Sardinia in particular, is that the work life balance is geared much more towards the life bit. In an international job like mine, it’s really important to get that right.

Richard Knowlton's keynote presentation titled "

Keeping the world’s biggest phone business safe and its shareholders happy

" will take place at Cyber Security EXPO in London ExCel this October.

Topics