SECURITY ON THE ELECTRONIC HIGHWAY :
HOW TO PREVENT HIGHWAY ROBBERY

JAN PEETERS

fONOROLA Inc.

INTRODUCTION

Good morning Ladies and Gentlemen. It's a pleasure for me to be here today to discuss with you the kinds of activities we are engaged in relating to the electronic highway. I will touch upon who we are as a company, the kind of "information highway" service we are currently offering our customer base and, via that experience, offer some words of wisdom on the question of security on electronic networks.

As many of you are well aware, the current structure of our economy is now firmly service oriented. Such an economy depends on large amounts of information being communicated between government and citizens, business and customers. As our economy has grown and changed in its orientation, it has gradually outstripped the capability of paper-based information management systems to handle. Hence, the change over the last twenty years to electronic systems.

What has allowed this change to occur has been the recent confluence of computers, communications, content and consumer electronics. This confluence, via compatible standards, the formation of specific, user-friendly content and the capability for people to work together from distant locations has created enough critical mass in these systems to permit the rapid exchange of information in electronic form.

This shift of media for information exchange creates incredible demand for telecommunications capacity - not just raw capacity but provision of switched and dedicated services for specific applications. If you want to work together, and you are here in Montreal and your colleague is in Vancouver, you have to depend on several things working together - good, clear communications channels between the two cities and compatible software between yourself and your colleague, just to name two.

However, as always with the change from one medium of communication and management to another, there are inevitable problems. One of the most significant of these growing pains has been the incompatibility between networks creating separate and distinct islands of activity but with no connection or information exchange between these islands. This has led to the broken promise of information technology; while the claim has always been there that information technology would increase productivity, the results to date have been disappointing. An example of this was when the internal revenue service gave their field agents portable computers but no improvement or increase in the amount of work was registered.

The solution for some is to create an electronic highway, a "network of networks", connecting the islands, which will usher in a new age in the way humans communicate, are entertained and do business. Indeed, many U.S. and Canadian companies are banking on the fact that another step in the evolution of electronic networks is just around the corner and investing heavily in improving their network infrastructure or acquiring content to fill the capacity. Examples of these companies include Rogers and Stentor here in Canada and Time Warner and Blockbuster in the U.S. For many, this solution already exists in the form of the world-wide Internet network which is already serving as a remarkable working laboratory in the effort to create an interconnected electronic network, or electronic highway for communication and information exchange.

The Internet's basic functions are electronic mail, electronic data interchange, sharing of information and remote access to specialized information services and databases. Video services are expected to arrive once the backbone network is upgraded to handle the additional capacity. The original charter, or mandate, of the Internet was to service specifically the research and academic community. However, as the network grew and has become the only viable global network to date, businesses began to use the Internet to carry information not specifically mandated for in the Internet charter. As a result, commercial Internet's are being formed to meet this demand.

fONOROLA - the Company

Since its beginnings in late 1988, fONOROLA has grown to occupy a prominent position within the Canadian telecommunications reselling industry. The company's business is to provide long distance voice and data telecommunications services to and from Quebec, Ontario, British Columbia, Alberta and the United States. Its ability to provide such telecommunications services is largely due to its installation of Northern Telecom's most technologically advanced switches, DMS-250 supernodes. These switches, coupled with network management equipment supplied by newbridge networks corporation and fONOROLA's proprietary fONOTRAK system, allow the company to target and maintain a sophisticated, large customer base, and will allow it to optimize the network without significant capital expenditures by increasing traffic volume at off-peak periods.

Over 98% of fONOROLA's Canadian clients use dedicated access lines to access fONOROLA's network. This extensive use of dedicated access lines coupled with the absence of compression has enabled the company to implement a single integrated network for voice, data and image services on a fraud-free basis. fONOROLA intends to optimize the utilization of its telecommunications network by offering residential services to the employees of, and other parties related to, its major clients.

fONOROLA Corporation, the company's United States subsidiary, is the first Canadian controlled company to be licensed to operate as an international reseller of switched voice services from the United States. This license has allowed fONOROLA to actively pursue many opportunities to terminate in Canada calls originating from the United States.

fONOROLA is the only national supplier of commercial Internet services in Canada. What also makes us unique is that we have an interexchange agreement with the largest developer of a commercial Internet in the United States, ANS CO+RE (ANS), whereby we are able to offer our clients complete service in the U.S. ANS is the company which runs the original Internet in the United States and its current customer base includes some of the largest businesses in the U.S.

Other unique characteristics of fONOROLA's commercial Internet service include a highly efficient coast-to-coast network, a 24-hour operations centre to take care of any trouble issues and includes statistical reporting on usage and all of a customer's wide area network engineering issues are handled by us including full network management.

The security issue

As the popularity of this medium grows, however, so do the problems associated with its use. According to a recent Gallup survey, nearly 85% of Canadians worry that the information highway will be a threat to their privacy (Globe and Mail, 3 May 1994). This concern is echoed by the business community, who have expressed great concern with a the related issue, that of security. For a large corporate user, such as the Royal Bank, ensuring that their financial information (which is actually your information) travelling over their computer network be immune from tampering or invasion is of primary concern.

Connection to the Internet poses some special problems. First, it is a public network and to a public network, all of the personal and confidential information on any organizational private network is immediately vulnerable to invasion or attack. I say organizational as opposed to private as this applies equally to any organization whose electronic network is interconnected to the Internet - whether it be business, government, community and non-profit.

The major security problem faced by organizations when information is exchanged via an electronic network is a break-in, either by a "professional" hacker, a bored teen-ager or someone specially hired to seek out intelligence, either military or business. This kind of activity is proof positive that information in itself has attained significant value.

To give you an idea on how easy it is to break in to a corporate or organizational network, the number of lines of computer code that would allow a novice user using a relatively inexpensive personal computer to gain supreme access in thousands of computer networks around the globe runs less than the text on this page. And it is freely available on the Internet system right now, if you know where to look.

The issue of privacy has captured the attention of government's, both provincial and federal, by inclusion of a privacy clause in the Federal Telecommunications Act, creation of a federal agency to monitor abuses of privacy in telecommunications services and publishing privacy principles intended to be used as a guide by both the public and private sectors. In addition, the province of Quebec has recently passed legislation governing the collection, management, and divulgation of personal and confidential information. However, other than a brief foray by the organization of economic cooperation and development, the issue of security of networks has received scant attention or has been subsumed in the question of privacy.

However, the importance of taking action is now becoming critical, as most of business' information is now handled and carried on electronic information networks. Example: 80% of companies in the United States whose electronic information networks have crashed for a period of 24 hours have filed for bankruptcy under chapter 11 of the U.S. Bankruptcy Act (Coopers & Lybrand, 1994).

The business community is beginning to respond to the security issue in a variety of ways - by implementing more elaborate security systems to slow down or prevent hackers from entering their systems; by installing anti-virus programs in their networks; and by installing internetwork "firewalls" or "choke-points" between their private network and the public network to prevent intrusion.

The latter example has been undertaken by our own company. We have participated in the development of a product for our own commercial Internet customers, and for any other person who is interested, that serves as a buffer between the customer's private network and the public portion of the Internet. That buffer serves to disguise the customer's network from any intruder, essentially making it invisible without the proper access and passcodes.

Other forms of security on the Internet use encryption or digital signatures and by the end of the decade, intrusion-detection technology will be available which will be able to detect possible attacks in progress as well as any unusual use of your system.

However, technological solutions alone will not be enough. Security policies will have to be developed for each organization which will aid users of the private networks to determine the risks associated with the particular data they are handling at the time. This will enable the users to make sound decisions regarding the dissemination of data via networks.

Sound like a lot of fuss for nothing? Initially yes, but if your information is worth protecting and you want to gain the advantages that come with connection to the world, take the time to do some of actions I have spoken of today. If you do, one less case of highway robbery will have been recorded in the books.

Thank you very much.


S.D. 08/03/94