Network Security: Costly Issues

As long as networking of computers was confined to the local

area, the cost of connectivity (the physical layer or Layer 1 in the OSI model)

was insignificant (about 5% of the total network cost). However, with the advent

of enterprise-wise integrated information systems (IIS) such as various

enterprise resource planning systems (ERPs), and the consequent need for

continuous WAN computing, the cost of the physical layer or connectivity has

assumed significant proportions (almost 60-70% of the total network cost). It

has, therefore, become a matter of serious concern for all multi-locational

organizations (MLOs).

The most important aspect of networks designed for WAN computing

is the need for 100% security of the centralized or distributed databases linked

together by the WAN. There cannot and must not be any compromise on security.

Another point is that the operating cost of pure data or

computer connectivity is added to the cost of MLOs. To reduce this additional

cost burden, MLOs tend to take some risks, allured by competing offerings by

different ISPs. They apparently save some money in setting up and operating cost

of their pure data WANs by going along the VPN route, but at the risk of

impairing the security of their databases at different organization locations.

The VPN Route



Let us see how much money MLOs can save by taking the VPN route. Let us
assume that the data load impinged on the WAN at each location is 62.2 kbps.

This would be the load impinged by twenty-eight computers in each location

connected to the LAN with mail and FTP load of 0.22 kbps per computer, and

assuming that 25% of the computers will be simultaneously using the Remote

Access facility from each location. In the central location, the number of

computers may be assumed to be about 100. While the mail and FTP load from these

computers get impinged on the WAN, the Remote Access load does not get impinged

on the WAN, as the databases are in the same location.

How Secure is VPN?



In the P2P network, the leased lines are laid out from one company location
to another, bypassing all the public domain PSTN switches. Hence, no MLO

outsider can access the P2P leased lines and the network built with these. This

ensures 100% security from external intrusion.

In the VPN network, you will see that the router ports of your

VPN network has continuous physical access through the tier-1 IP switch

associated with the Core or Edge router at the Internet backbone node in the

city to all the public domain networks like the PSTN, ISDN, and broadband. Once

such access is available continuously, a professional hacker can break into your

network by cracking through the CUG (closed user group) code, which separates

your VPN from that of others and the public domain networks. This makes VPN

security vulnerable to hacking.

Hence, from both the cost and security angles, the P2P data

network appears to be superior to the VPN networks. In this context, it is,

therefore, unwise on the part of network planners to put their databases in

jeopardy by opting for the VPN WAN connectivity with a mistaken belief that it

is less expensive and guarantees security of databases.

In the above two examples, only pure data connectivity is

considered. Pure data network add to the present telecommunications costs of a

MLOs. Thus, if the present inter-locational telecom (telephony and fax) cost is

X, then the total cost of communications between MLO locations will be as under

for the two cases.

The availability of 24x7 point-to-point leased line connections

between MLO locations makes it possible to consider using this for all kinds of

inter-locational communications of the MLO-speech, fax, data (RA, FTP, Mail),

voice and voice-data conferencing, particularly if the X figure is large.

Integration Approach



Integration of the three different modes of communication, speech, fax, and
data, have been attempted for almost fifteen years with varying degrees of

success with the advent of digital leased lines. The first was fixed channel

multiplexing (FCM) where channels were dedicated for speech, fax, and data.

While this worked well the users felt that when any of the channels were not

being used, the bandwidth associated was being wasted. The next development was

adaptable bandwidth multiplexing (ABM) where the multiplexer allowed the use of

one channel bandwidth currently unused by another channel to increase the latter's

bandwidth and consequently throughput. While this method eliminated the problem

of wasted bandwidth, it brought with it the problem of inter-channel

interference. If voice was given priority, the data call would drop or slow down

the moment a voice call was initiated. If data was given priority, the voice

call would drop as soon as a data call was initiated. The next development was

to digitize the voice and send the voice packets continuously in queue with the

data packets through the WAN to the intended destination. To send the

originating packets to the desired destination and to receive back the response

packets to the telephone which initiated the call, it is necessary to break the

digitized speech into small core packets and add a header carrying the address

of the destination location, the telephone trunk it has seized, the number of

the telephone called. Similarly, the originating address will have to be given

in the form of a tail packet. This additional information of header and tail

packets increases the bandwidth requirement in VoIP. Typically to set up a

single voice call using VoIP, the bandwidth consumed will be 60 kbps (toll

quality) or 36/40 KBPS (near toll quality). Thus, while VoIP eliminated the

problem of wasted bandwidth of FCM, and inter-channel interference of ABM, it

brought with it a new problem of increased bandwidth requirement. In today's

telecom scenario, more bandwidth means more cost. Thus, the advantage that could

accrue in reducing communication costs through integration of speech, fax, and

data over P2P leased line networks, gets nullified by the increased bandwidth

requirement. The quality of speech is also not up to the mark and in many cases

where VoIP has been implemented people tend to use the circuit switched public

telephone network or their mobile phones in preference to the available VoIP

phone.

It is a well-established fact that for any real time

communication like speech, fax, video, a synchronous communication link is

ideal. This is best achieved through circuit switching. It is also a

well-established fact that an asynchronous communication link is ideal for heavy

data traffic, and is extensively used for IP data networks like the Internet.

Extensive research over the last 17 years has produced a

networking system, which uses circuit switching (for speech and fax

communications) and packet switching (for data communications) using channel

splitters at either end of a digital leased line. An EPAX converts the circuit

switched trunks into universal channels, which may be used for speech, fax, and

data alternately. There is, therefore, no wasted bandwidth. Further, the channel

splitters act like fixed channel multiplexers, and therefore there is no

inter-channel interference. The system also uses analogue circuits to bring data

from low data volume locations like residences, guest houses, small offices, etc

by terminating these into E&M trunks or long line extensions on the EPAXs,

and leading this to the IP data network through analogue extensions, high speed

dial-up modems, and multiple serial port cards sitting the PCI slots of any

server connected to the LAN. The universal channels have individual channel

bandwidths of 12.8 kpbs, and since circuit switching I involved, no head and

tail packets are required. Thus, the bandwidth required for speech and fax

integration is not very large, and total operating cost of these networks is

such that considerable savings can be affected in the MLOs total present telecom

and datacom costs.

Any network will be used only if it is easy to use and easy to

access. Thus, all people who need to speak to people in other locations

frequently must have a NET telephone. These are simple analogue phones costing

Rs 600-1000 and not as expensive as the IP phones, which cost around Rs 10,000

each. Thus, they may be given to all people who need to speak to other

locations. Similarly, the NET fax machines should be located in such a location

that those who need to use it frequently do not have to walk long distances.

In our 10-location MLO, let us assume that, at central location,

fifty people will need NET phones and the building is large enough to warrant

ten NET fax machines for ease of access.

Using these and the earlier computer numbers, we have designed

an integrated voice/fax/data network.

Pankaj Mitra





vadmail@cybermedia.co.in



The author is the MD at MIDAS Automation and Telecommunications