A Rose by any other Name…

The cable industry’s move into commercial services is well documented. The related evolution of its platform from enterprise class to carrier class is equally well known, but a harder topic to qualify because the terms used are growing more vague—and may be losing their meaning altogether. Such things as the "five nines" and the myriad measurements in service level agreements (SLAs) attest to the precision with which engineers measure network performance. On the marketing level, however, the definitions given the particular level of performance achieved by the network get a bit murkier. "`Carrier class’ is somewhat misused across the market," says Ben Stanger, a senior marketing manager for Cisco. "Everyone wanted to latch onto it." There still is a differentiation between carrier and enterprise class, says Alan Lough, MCI’s senior manager for Internet Access Services. This suggests that there are interesting times ahead. In the past, Lough says, small- and medium-size business customers got carrier class telephone services "by default"—simply because they were attached to the regional Bell operating companies’ (RBOCs’) network. Times have changed as local area network (LAN)-based technologies invade the wide area network (WAN). It remains to be seen how these businesses will react if voice over Internet protocol (VoIP) services don’t quite measure up. "Now they are looking at VoIP because of the price," Lough says. "They will not get the same level of service in terms of quality or range of services that they got in the past." The terms also are becoming antiquated because carrier and enterprise networks no longer are distinct. The emergence of IP and Ethernet in the telecom network makes the end-to-end network more of a mixed affair than in the days when there were more tangible walls between the protocols and platforms that dominated the LAN and the WAN. Whatever the marketing phrase used, operators are aware that reliability is key. This is a big part of PacketCable, says Nicos Achilleoudis, a Cisco product manager. PacketCable assigns a maximum number of minutes per year various segments of the network can go down, he says. In assessing cable reliability, it is helpful to break the network into headend, hybrid fiber/coax (HFC) network and subscriber premises segments, says Stan Brovont, the vice president of marketing and product management for Arris. It is further possible to define reliability into two overall categories: availability (whether the network is up) and quality of service (whether the network is responding well enough to support the service being offered). In the HFC network, increased redundancy keeps packets flowing in scenarios where in the past service would have stopped. Equipment is becoming more robust as well. For instance, Arris’ Cadent C4 cable modem termination system (CMTS) now allows "hitless" upgrades. Other units, Brovont says, need to be taken off-line—sometimes for several hours—to be upgraded. The new software allows software upgrades to be downloaded and put in use without taking the system down at all. "If I have to reboot [the CMTS] like a PC, it takes time to recover," Brovont says. "There will be no service, whether for voice or data." Cisco’s CMTSs perform surveillance on the network and report anomalies that can be caught before they result in downtime, Achilleoudis said. "Definitely, the CMTS is very important. That is really the gateway to the last piece [of the network] that the cable operator owns." Whatever the definition that is used, most feel the industry is doing a good job in creating robust networks. Both the cable industry’s VoIP and circuit-switched services are making the grade, according to Mike Paxton, a senior analyst for In-Stat/MDR. "Most [customers] say there is not significant difference in the quality of service between the cable operators or the RBOC. — Carl Weinschenk VoIP Security Agenda How Not to Lose Future Telephony Subs Voice over Internet protocol (VoIP) telephony services have enjoyed a bubble-like shelter from most security storms for one simple reason: With only a relatively small number of IP telephony users at which to aim, hackers haven’t tended to bother. Yet. But that is about to quickly change as attackers become more familiar with the technology and as vulnerabilities come to light. Already, groups such as CERT have pointed out chinks in protocols that enable VoIP, including H.323 and session initiation protocol (SIP). "As VoIP captures market share, so too will it capture the attention of the hacker and cracker communities," Eric Rosenfeld, project director of PacketCable Security at CableLabs warned at a recent VoIP conference. The good news is that PacketCable has a strong set of security services. "Combine a set of secure interfaces with a strong set of operational security requirements and procedures, and the result will be a secure network upon which VoIP services can be offered," Rosenfeld says. Attack on the Hacks Of course, VoIP security is not just of concern to CableLabs and the cable engineering community. Various other providers want to juice up their networks with VoIP, and they’re also looking for ways to understand and mitigate VoIP security risks. Enter the VoIP Security Alliance, which announced its formation in February. A wide range of VoIP vendors, providers and security researchers sit on the group’s technical board, including Michael Emmendorfer of Charter, Martin Euchner of Siemens, Andy Huckridge of Spirent and Rick Kuhn of the National Institute of Standards and Technology. Alliance Chair David Endler of Tipping Point predicts that in the next couple years, VoIP-specific attacks could start to occur in earnest. Endler is careful to point out that VOIPSA has no intention of setting standards. It will instead ally itself with the SIPForum and the Internet Engineering Task Force to provide a resource that reveals VoIP vulnerabilities and ways to counter them. VOIPSA will use discussion lists, white papers, sponsorship of VoIP security research projects, and the development of free tools and methodologies for public use to meet its goals. "VoIP has the potential of becoming widely deployed in critical infrastructure, and without an active community in VoIP security, the quality and reliability of VoIP can easily regress into the patch-and-penetrate race we have had to witness with other widely deployed communication software," says Ari Takanen, CEO of Codenomicon, and a member of VOIPSA’s technical board. —Laura Hamilton