Faire la pause: European Cyber Week à Rennes, day two

On day two, the approach was quite different but no less interesting: the topics covered training, penetration testing and protection from treats. Key points:

• Simulation environments are very important because of the several use cases, for example, you could use a simulation to recreate an attack by leveraging on virtualization and traffic generators to replay the packets and perform a post-mortem analysis. Other use is for training by using a virtualised version of the real products, topology and traffic generators and controls to provide a learning environment. Something analogous to a flight simulator. It is way cheaper that playing with the real equipment. This makes me remember when I learned about networking protocols using Packet Tracer or GNS3.
• Testing environments are really important to provide training for personnel in order to operate a platform properly and to make hacking exercises to find vulnerabilities in  the system. Specially this last part, involves not only the technical expertise on protocols and commands but also deals with the physical aspects of the infrastructure in buildings. All attack surface, (may be virtual, physical) is susceptible to be exploited and used as entry point to compromise an organization.
• Businesses do not wait for communication Service Providers to help to implement security procedures or protection plans. Businesses and companies are taking their first approach to the problem by deploying tests and self-penetration exercises. The network is just a data pipe. This insight makes me think about the role of the infrastructure provider or slice provider to a company... A telecom would care about what traffic the customer has inside the slice? My responsibility as a telecom operator is to provide the resources and guarantee the SLAs with my customer... the same way when we provided E1s, VPLS, VPNs...
• An authorized penetration testing is a procedure that involves a lot of administrative planning! even the presenters (from SODIFRANCE) told a fun anecdote about an "out of jail card" (pun from a Monopoly card. Everything has to be set up properly.
• The approach proposed by the presenter (from Thales Communications and Security) covered a test-bed for a service. I wonder if the same could be done for the infrastructure. I think it is possible, since virtualisation techniques span the different layers of the anatomy of a service.
• There is a saying that states that if the only tool you have is a hammer, all your problems would be shaped like a nail. The key point from the presentation of Franck Sicard is that people tried to apply the same techniques used to secure an IT system to an ICS (Industrial Control System). Every system, service, industry has its special equipment, protocols and processes. The security approach is different in each case.
• The future telecommunication architecture must have the means to provide administrative rights to create snapshots of a slice, in order to provide security features, rollback of configuration and resilience to failures. Could be interesting to think about this scenario.