Author: Charles Brookson

Charles Brookson OBE CEng FIET FRSA 

I chaired the CEPT Algorithm Expert Group for GSM mobile back in 1986, to design the processes for technical security, part of the Security Expert Group chaired by Thomas Haug. I then worked in Security Standards Groups such as ETSI, SMG and 3GPP. My career was with BT, one2one, UK Government and Consultancy, where I still tinker with mobile standards. For accidental reasons, I’ve been involved in security algorithms and protocols since the late 1970’s.

We took the business model first in GSM:

UK Operators could not sell direct to the public, only through retailers, to encourage retail competition. We had to come up with a secure design that allowed the Operators to sell subscriptions, and the retailers to sell phones. Of course, this model has radically changed since then.

I’ve always designed security with how they are used in the real world, and work out who trusts who, and what parts need to be secured against any possible threats.

I’d had plenty of experience of poor security in the manufacture and design of analogue mobile phones, so we wanted the security under the total control of the Operator, and we came up with the physically secure SIM smart card (we’d already been using tokens and cards in British Telecom BT for security, so it was an obvious answer).

Then we looked at the security threats:

I didn’t want any Operator to have to trust the security of any other Operator, so we came up with the idea of putting your own algorithms on the SIM card, and not sharing it, only passing the means (using triplets) to other Operators. 

By this method we prevented any other Operator from being able to defraud others. I wanted this, as I had seen this happening in BT, with rogue payment requests and funny happenings from other Operators and Countries.

Then we had the practicalities, nobody thought we needed security:

I was told that security was not really that important at all, which I also strongly disagreed with. After all, we had seen all the cloning issues of ESN and MIN on analogue mobile systems such as TACs (1G). The decision makers didn’t want to pay for security back in those days, or even these days, except when forced by regulation! Isn’t it strange how many businesses take security seriously after a hack or fraud has occurred?

I also wanted some level of privacy, to stop eavesdropping (we’d had cases of eavesdropping of our UK Royal family for example), but we were told that this was not very important and should have minimal impact on the silicon. We came up with privacy algorithms that could meet export control requirements (42-bit keys for then COCOM regulations), last about ten years, and be made using 2000 to 3000 transistors.

I was told that we wanted a way of checking the type-approval for regulatory purposes, so only tested devices could be used on networks (this was legal requirement in Denmark for example). We came up with the IMEI, a serial number for each mobile, which could be easily inserted at the factory.

In pursuit of privacy, so we came up with the idea of a temporary identifier used over the air (TMSI), and this sort of worked quite well (it does default to the real one or IMSI on set up).

Finally, we were told all of this was to have no impact on call set up time or complexity, so we were not able to add the third handshake to allow mutual authentication. This was to prove a big mistake. Base stations would always be expensive I was told, and so it was just not required, as who would ever be able to replicate their own base station!  (The complexity fallacy in Security I’ve heard many times: “This will never be broken because it is too expensive and complex …”).

The result of all this?

In the early 1990’s we had a GSM security system that was designed for half a dozen countries, and it worked well for the first ten years. It then grew and was adopted worldwide as GSM became the De Facto global standard.

Then we had a succession of evolutions from GPRS and EDGE, to 3G, 4G and 5G. All the time we just built on what had already been designed, without questioning the rationale. Backward compatibility was king!

I chaired the GSM Association Security Group for the first 25 years of its existence, and after the first ten years I spent the rest of my career putting sticking plaster solutions on the various technical requirements to ensure that they creaked along, as the security gradually fell apart.

For example, we had to get Operators to sign disclaimers that they were adopting insecure algorithms, when they insisted on using the example default authentication algorithm which had already been broken. Then they were surprised that their authentication had been broken and their SIM Cards cloned! I suspect that many just did not care or have enough technical people or knowledge to even understand that they needed to design their own, our original design intention.

We now have electronic SIMs, which are based on hardware provided by mobile device manufacturers, so now the inherent security is no longer controlled by the Operator. It also breaks my rule of not trusting devices, especially mass-produced electronic consumer equipment.

We had to remove support for the older privacy algorithms from handsets, even when we’d seen many open papers from hackers on them being broken, to force Operators to put in newer ones. There was no real will to change the algorithms after 20 years of service, well after their “best-before-end” date of the designed 10 years.

We spent many years in Standards groups looking at how we could put back in mutual authentication (I have the original 1987 papers showing that we had it in, but of course it got rejected by those who did not understand why we needed it). This led to all the false base station attacks and bidding down of algorithms – because with no mutual authentication the mobile must trust the network. Interestingly, one variation of GSM did not use authentication at all (to speed up the process). It made very little difference to the speed at set up and scares me every time I think about it (it still exists).

The IMEI was then used to prevent stolen phones by law enforcement and governments, so there was now a financial incentive by criminals to change it. This led to even more Standards work to try and fix it, which has not really been resolved. A case of using something for a purpose it was not intended for, and therefore criminals would put more resources put into breaking it, and then break the whole rationale of the original design (aided by manufacturers with insecure IMEIs in their hardware).

Finally, of course, the whole business model is now multifarious, not that anyone seems to think about this aspect. Operators now sell mobiles direct and through shops, we have Virtual Operators (MVNO), we have private networks and so on. It seems that nobody designs security against a business models for mobile, it’s just presented as a recipe, and you try and pick and choose ingredients that you might force to fit your needs. 

So, we do need a revolution?

Yes, we most certainly do! 6G and beyond needs radical new thinking!

We have gaily carried on using old principles and business models (even though we have moved on) without much original thinking. I rarely see business models or threat analysis associated with any security thinking for mobile networks. We are still using protocols, signalling systems and concepts that are almost 40 years old, and using them to evolve systems for the next 20 years. 

My cynical thought is that this suits everyone involved, and they just to have tinker with what they have, and then they can tell the world they can throw out the old and buy something shiny and new!

It’s my contention the foundation stones that we are basing the evolution to 6G are broken, or no longer relevant. We need a radical rethink to make something new that is useful for what we now need. We did that with GSM (the first time we really used encryption on a public system, and had open interfaces, and many other things). We need to do that again ….

Postscript:

Like everyone in history who spreads thoughts against conventional wisdom, I expect to be labelled a heretic by reactionary forces who don’t want to change. 

But I’m going to fight for my cause, even though it may end up with being burnt at the stake … to this end I’ve proposed a new ETSI White paper (which has been accepted by TC CYBER Committee) on this subject to help shape thinking for future security. That way it will be free for everyone to read, and not behind a pay wall.

Let’s all work together: I’m sure we can succeed and create a new security system fit for the bright 6G world!

If you would like to discuss 6G and any related topics please feel free to contact us

This month I was voted in as a Fellow of ETSI – The European Telecommunications Standards Institute. This means my picture joins the great and good on the walls of ETSI, and I’ll have to pass it quickly when I’m there. Fortunately, the best resolution picture they had was of a much younger me, so I’m not sure how I’ll fit in with the others.

It did remind me of how old, sorry, experienced   I am: My security career started with the ECS Satellite and crypto: Unfortunately, my 1982 patent on Satellites has me as Charles “Bile” Brookson, which means that it does not often come up in normal searches (it’s “Brice”). I then helped make various chips, both conventional ciphers and public key. My last appearance at Crypto in the USA was in 1984, where I showed our PKI equipment, and I still remember the comments that it would never work!

 

This turned into using Public Key for X.400, which then morphed into X.509. Yes, it never really worked …. We did a lot of security in those days, hardware fax encryption, high speed (2 Mbps), and PKI and Email. We also helped produce BS7799 which then became that large tome, the ISO 27000 series.

In the meantime, in 1986, I chaired the Algorithm Expert Group of CEPT to do all the GSM algorithms. This proved to be a lifetime career, as this Group turned into ETSI. So, I had a life in Standards, SMG10 and 3GPP. In ETSI I was there at the start, and decided security was quite fun: (yes, I’m like that!) I was part of ETSI TC SEC, LI, ran a tiny Security advisory body for the ETSI OCG for a few years, and then started ETSI TC CYBER. I felt obliged to chair Cyber for 4 years and became vice chairman for two more. Whilst doing all this, I also found time to chair the GSMA security group for 25 years.

I’d morphed employers from BT, one2one, and then became a Civil Servant before finally semi-retiring, and helping with old friends at Azenby, and I’m still doing security. I picked up an OBE on the way, which was nice (it allows me to have ceremonies in St Pauls Cathedral).

So, it’s been quite fun. It was nice to be in at security from the start, and see it evolve into a huge worldwide business: And I’m still playing a small part. I’m pleased lots of people and companies made lots of money on stuff I was involved in, just sorry I missed out.

I still remember on getting promotion many years ago as a young lad, when my boss, on my return from an interview, said “Charles, that proves that you can fool all of the people all of the time”.  I’ve tried to live up to that mantra.

I apologise for all the acronyms, they are not important, but you can Google them if you wish!!

Charles (Eur. Ing. Charles Brookson OBE CEng FIET FRSA)

https://www.etsi.org/membership/fellows

Well, most of us have been isolating over the last few months and staying safe in our homes. In our Village in Suffolk, just 180 houses, we’ve still seen people dying, two of whom I know personally. It’s not been too pleasant at all.

Of course, the fraudsters have been quick to exploit the situation in order to gain their cash. I do find the mentality weird – let’s try and get money from someone by persuading them through deception, even though they are suffering mentally and physically. Sadly, as always, this is done from Jurisdictions who don’t seem to care or seem unable to follow up these crimes.

We’ve also got used to phrases like ‘Zoom Bombing’ – who had heard about Zoom before January this year and thought about accidental visitors? The market seems to put a large value on it now, as with many of the tools and software we use – who has tried to buy a Webcam, they seem almost unavailable at any price.

This leads to the thought that mobile phones have now proved themselves really useful to all those at being and working from home, for all types of communication. Has this affected the value chain, when we can still get ‘all you can eat’ data and communications’ for £30 a month? Is there any way this value can be put to use to increase company profits? A matter for further thought, as many parts of industry have now discovered that not all their employees need to be sitting in expensive offices anymore!

So, what has been happening on the security front?

David Rogers, of Copperhorse Ltd, has been keeping us up to date on twitter, and collecting information of the various scams:

There have been false links in messages encouraging people to links mentioning the Covid 19 App – someone whom you came in contact with … please click on the lick and enter all your personal details. There have been similar messages in the USA and Sweden.

David’s web site explains that the motivation is to get personal details, or money for donations of protective equipment[1].

In the UK our Tax Authorities have issued warnings on Covid 19 messages that ask people to click on bogus links to get a refund[2], and there has been joint advice from the UK and USA Cyber authorities[3] about the various issues.

So why am I interested from the mobile aspect? Well, I believe that Operators should be warning and educating customers and taking precautions. Interestingly, I’ve had nothing from my Communication Service Providers. There are many ways an Operator should be alert; indeed, the Industry Association has issued details of the attacks taking place[4]. The precautions of course can include technical measures to identify the messages to customers, and work with the authorities to catch the offenders, and of course share the information with others using the GSMA platform. As a matter of fact, David is also Chair of the GSMA Working Group concerned with these matters

Which brings us on the 5G conspiracy theories linking it Covid 19. It seems unbelievable to a rational person, that what appears to be a memory stick (available for a large sum of money) can really “protect you” from 5G[5], or that you should burn down a 5G base station[6]…. Certainly, a lot of these conspiracies are spread on the social media which so many have depended on for information when in isolation.

The world is certainly changing: The method of working changing. People exploiting misery, and a lack of science, or maybe it has always been thus? Whilst many have also commentated that we about to see the biggest change in working practices since the IT revolution began, there does seem much that needs to be done before we can embrace this brave new world safely and securely. What do you think, let us know in the comments?

[1] https://mobilephonesecurity.org/2020/04/covid-19-sms-text-message-scams-advice-for-mobile-phone-users/

[2] https://www.gov.uk/government/publications/phishing-and-bogus-emails-hm-revenue-and-customs-examples/phishing-emails-and-bogus-contact-hm-revenue-and-customs-examples

[3] https://www.ncsc.gov.uk/news/covid-19-exploited-by-cyber-actors-advisory

[4] https://www.gsma.com/newsroom/resources/covid-19-mobile-cyber-security-fraud-threat-observations-and-incidents/

[5] https://www.bbc.co.uk/news/technology-52810220

[6] https://www.theverge.com/2020/4/4/21207927/5g-towers-burning-uk-coronavirus-conspiracy-theory-link

 

(This is a personal view of the author and does not reflect the view of any of the Standardisation Groups or Organisations he participates in!)

You all know the issues and read about it regularly in the press reports – Baby monitors and Cameras accessed remotely, Cars hijacked (like the famous Jeep take over), Televisions with viruses, talking Home Speakers and many other incidents.

Many of these can be prevented by some simple security procedures, which are now freely available to help people who design connected things. Here is some background to the various activities that are happening now, and what we can expect in the future.

The initial work was done by the IoT Security Foundation [i], who produced some great documents describing the sort of security methods that you should be taking, like eliminating default passwords by forcing change, boot protection, update security and a few simple ideas. It also encourages Companies to have a vulnerability disclosure scheme, to pick up errors and correct them – apparently less than 10% of Companies even have these! They have some great (free) documents, including DIY Certification.

This initiative was taken up by Governments, so for example in the UK the Department for

Digital, Culture, Media & Sport (DCMS) published in February 2019 their own document [ii] – A Code of Practice for Consumer Internet of Things (IoT) Security for manufacturers, with guidance for consumers on smart devices at home.  This is linked to their “Security by Design” ideas. It brings together, in thirteen outcome focused (I like that phrase) guidelines, what is widely considered as good practice in IoT security.

At the same time ETSI (European Telecommunications Standards Institute) published a Telecommunications Standard on IoT Security, which can be used as a basis for Manufacturers and Suppliers across Europe. You can read the press release on how The ETSI Technical Committee on Cybersecurity (TC CYBER) released ETSI TS 103 645, a standard for cybersecurity in the Internet of Things via the link below. The idea of the standard is to establish a security baseline for internet-connected consumer products and provide a basis for future IoT certification schemes. You can also use the link to download a copy [iii].

Notice in the above the mention of a Certification scheme – ETSI is working on an EN which has a legal status within Europe, and this can be used so that manufacturers can meet a Certification scheme under the Cybersecurity Act [iv] – let’s hope we will see this soon.

So now we have a pathway for the future, where we can have Certified IoT devices with security, something that has been long needed. There are other such ideas, for example the Radio Equipment Directive [v] proposes that Privacy and Security should be part of the requirements: That’s the one that goes towards the CE [vi] mark that you see on equipment. Now that’s something I have doubts about, as I think that Technical Requirements should be defined by Technical people and not Lawyers, and there is no need for there to be more than one IoT security requirement, as it will just cause confusion.

So, what can we expect? A perfect world secured IoT devices? Of course not, we all know that won’t happen, but at least it will force a thinking process, and make things better for the average consumer device and user. It will, of course, not protect Critical Infrastructure, for that much better security design is required.

For us involved in Telecommunications it will ensure that our terminals are more secure, and at least reduce the amount of Customer Confusion, help maintain their Privacy and maybe even reduce Fraud. I also have in mind a simple set of security requirements like the IoT ideas, to secure a Telecommunications Operator, but that is another story ……

Useful Links

[i] https://www.iotsecurityfoundation.org/

[ii] https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot-security

[iii] https://www.etsi.org/newsroom/press-releases/1549-2019-02-etsi-releases-first-globally-applicable-standard-for-consumer-iot-security

[iv] https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-act

[v] https://ec.europa.eu/growth/sectors/electrical-engineering/red-directive_en

[vi] https://ec.europa.eu/growth/single-market/ce-marking_en

 

This year, after catching up with Friend’s Blogs about the Mobile World Congress and the latest security revelations which seem to be coming around frequently these days – apparently Cyber Security is the new “Thing”. Hardly surprising, as it something else for the Snake Oil sellers. More antivirus products I expect! And of course, 5G and now 6G: It’s the case of the Emperor’s new clothes every time. I remember when we were forced to call 2G GSM a new wonderful 2.5G – that was because of EDGE. Very silly!!

I agree that 5G is low latency (Good for cars, remote surgical operations and warehouses, otherwise things and people might get a bit cut up). Network slicing, maybe that might work: We do need a good QoS method. But do we really have good Security? Well, looking at the solutions coming to market, it seems that the present implementations do not really address the real security issues. We are still stuck in a world which for example doesn’t recognise the inherent risks of virtual software-based networks, and still depends on identifying individuals to manage it rather than roles.

My view is that we should start again: The real problem is legacy – every time we bring something new out, the old things still have to work. So, we are tied into repeating all the mistakes, by supporting all the old stuff. Also, the big manufacturers that control the Standards don’t want Revolution, they want Evolution: So that all their old stuff still works.

There is also the Marketing Hype, something new is required every time, remember WAP for browsing the Internet? (I wasted lots of time on WAP security: It never worked. The concept of having an untrusted insecure gateway where everything was readable, and every mobile could be switched to it via an unauthenticated SMS, was (I admit now) a trifle dodgy). It all makes verifying the security of a Telecommunications Network really difficult (and probably impossible), as it is so complex, and it is not possible to prove, or test it for correct operation.

I’d like to start again, with a proper Revolution: We did that with GSM, and it meant even at my myopic interest level we could have much better security, like encryption and SIM cards. I’d start with doing security properly again, and make it fit for purpose, Quantum resistant, not based on something 40 years old, with unfixable things like IMEI.

I’d also like to start the radio interface again, and make a mesh network, and properly work with new antennas and broad-spectrum efficiency. I’d also like to start on the infrastructure again to make it suitable for dynamic flexible functions in software, inherent security between functions, fix Signalling with SS7, SDRs for the RF, and software-based virtual networks etc.

Cyber Security Standards – why should you care?

At Azenby we take network and data security very seriously and we are proud to have Charles Brookson, a renowned authority on the  subject, as part of our team. We asked Charles to give us an update on what’s been happening in the world of Cyber Security recently:

ETSI TC Cyber has been going for just over three years, and I’ve been there from the start, since I was involved in setting it up.

For those of you who don’t know, ETSI produces standards for Europe on Telecoms and ICT. There are three standards organisations within Europe and they all cover different sectors of standardisation. It also manages areas like mobile from the GSM days to 5G (www.3gpp.org). It is true of course that ETSI standards are often adopted well beyond the shores of Europe and can be considered to have great influence globally.

Lately we have produced some quite interesting documents and reports, which are well worth looking at for cyber security.

One of them is ETSI guide to quantum safe computing. Although we can’t expect quantum computers for maybe another 10 or 15 years, it’s worth looking at the history of cryptography to see just how long old algorithms are used in devices. GSM A5/1 was produced in 1986, and is still being used today despite being able to be broken within a few minutes. You should be thinking  about Quantum if you’re designing something for the Internet of Things; with an estimated life of 15 to 25 years, you’d have to look at building algorithms to provide confidentiality, integrity and authentication that will hold up for this length of time.

The same goes for Banks and Institutions securing customer information, for example.

So, what does this ETSI guide tell us? Well even with conventional symmetrical algorithms such as AES, you’d have to look at doubling the effective key length in order to remain secure. What is more worrying is that some public key algorithms and elliptic curves will offer no security at all, this is because these type of public key algorithms can be broken by quantum computer: It can be a real concern, because I believe that many of the cloud based resource suppliers for computers are looking at people being able to access a shared quantum computer.

So, if you are designing or looking at new systems, or using systems that may use public key or symmetric algorithms, you ought to have a read of the ETSI guide on quantum computers.

Another report that we have just written is the one on the NIS directive, which is an EC Directive. This one looks at what you have to do to meet the rather opaque statements that are contained within the NIS directive. This should be of interest to anybody who is running a network and information system. Basically, there are some legal requirements that you have to meet, have technical and organizational information system risk management and you have to be capable of exchanging information of incidents securely when there are issues with your system or service.

So, what are we going to be working on in the future? Well there are over 20 documents already produced by the cyber security group, but certainly I think one of the major ones that we will be working on will be how you actually try and meet the General Data Protection Regulation (GDPR) on Data Protection, which is due to be published in May next year. One of the most important features of this will be that if you are trying to meet it as a business, then you have an existing standard that will enable you to at least make sure that you meet all requirements!

We’re also working on Middlebox security, and many other important security issues.

I’d encourage anybody who is interested in these particular areas to come along to ETSI and participate, or at least read the documents.

ETSI TC Cyber details: http://www.etsi.org/technologies-clusters/technologies/cyber-security

• TR 103 456 CYBER; Implementation of the Network and Information Security (NIS) Directive http://www.etsi.org/deliver/etsi_tr/103400_103499/103456/01.01.01_60/tr_103456v010101p.pdf

• EG 203 310 CYBER; Quantum Computing Impact on security of ICT Systems; Recommendations on Business Continuity and Algorithm Selection http://www.etsi.org/deliver/etsi_eg/203300_203399/203310/01.01.01_60/eg_203310v010101p.pdf

And if you think you need some help in getting your network and systems up to standard for cyber security, then feel free to get in contact with us here at Azenby.

On 21st May 2014 I went to the “Light Reading Mobile Network Security Conference“.  It was an interesting session – and unusual in that covered many of the technical challenges of security of LTE.

My particular talk was held in the graveyard slot after lunch, and I tried to skim through the evolution from GSM to LTE. Trying to be light on a very technical issue was difficult! I was asked to comment on the three things to sell IPSec to an operator, and as well as mentioning some technical ones, I also mentioned the difficulty in justifying the risks in terms of the potential cost … try explaining that in Layman’s terms to a CFO.

Some of the issues discussed were stimulating to further thoughts:

• Small Cells were still a challenge for security: The realization of a real small cell clearly diverged from the suggested 3GPP standards. We will probably see more emphasis on security as more they become more exposed to hackers – but since it has already happened when will that be?

• Network Function Virtualization (NFV) featured many of the talks. We also had a presentation from an ETSI Industry Group on this topic. Is this hype or reality? There was a long debate and I felt it was inconclusive on the business case. We’ll see if it matures enough.

• Node balancing and DNS security, which had caused quite a few security issues in the past (and network outages around the world!). Small Cells will just increase the challenge of handling this. One member of the audience even dared to suggest that if you have to allow all this flexibility on loading, why not run your own network?

• The physical security of the LTE infrastructure was addressed by some of the presenters and questions raised. This will clearly be of great importance, as in LTE a lot more of the intelligence is with the eNode(B). There is also the difficulty in managing a mixed network from different vendors, which produce horrendous security and certificate management challenges. This is even true where operators share infrastructures!

If you want to talk about these issues further – practical technical and commercial help is on hand – so do get in touch!

Another Mobile World Congress is over, number thirteen, but not too unlucky for most. We had the new venue, a range of designer tin sheds, but at least there was plenty of space and no rain dodging between buildings, with moving stairways and escalators.

The Cybersecurity presentation was part of the UK Trade and Industry sessions, where I described the work of the Standards Institutions and the various World and European initiatives. I pointed out that although there was general agreement that it was about the confidentiality, integrity and availability of information, nobody had yet agreed on how to spell Cybersecurity (or Cyber security or Cyber-security!).

So what did I find that was new? Well, I guess the messages for me was Data (using up all the capacity and stretching the networks), the rise of the Machine to Machine, the Connected City demonstration was well thought out and provoking, and Near Field Communications demonstrations were fun (I also beamed one Business Card, transferred two photos and got in and out quickly without the usual Photo Identity all with NFC). They all have security issues as well – so I will be busy!

The GSMA Android App was really great, a few bugs, but helped find and time talks and stands, let’s hope it stays for next year, it will make the experience almost truly paperless!

So I guess there was really nothing really new, a few more shiny things and some of the more significant announcements being held over: Like the one that the Samsung S4 would be shown at New York next month. Not forgetting the big players, who did not come to the party, but who also held biggest parties off in the City.

As usual, planning paid off – I had good set of meetings, met a lot of people I knew walking around and happily caught up on the gossip!  The usual fixed events happened – parties, whisky tasting and late nights. I gave a talk on Cybersecurity, only used one box of Business Cards, and Sonny Bear got his Silver Card.

I’ve been going to the Mobile World Congress for many a year. My first appearance was pre-Cannes, on the Athens stage. Over the years I’ve given presentations, chaired panels, judged the awards and partied the nights away! My main interest is in Security, having been in it from the start, but I also like to check out the main theme for the year which in the past have been GPRS, 3G, Apps, LTE and M2M.

I have to come early, as there are lots of meetings before the main event begins, so will be arriving on the Thursday before. Because I booked just after the last one, I have IBIS rooms at 50 euros a night. You should think about planning for next year now!

I usually work out a few things beforehand, as otherwise you waste a lot of time: Key note speeches to attend, talks to go to (in my case the security ones), and talks to give (this year just the UK Cybersecurity one), people I must see (arrange appointments), exhibits I must see (security related and gadgets!). I go through the plan of the exhibits and make a list, and the important evening events to attend. The evening events are most important, as these are where you meet other useful people to catch up with them. I usually have a few invites, and there are some I have to attend where I am a minor functionary (such as ETSI). Others, like the whisky tasting at the Scottish Stand are where everyone meets!

I carry as little as possible, but take an umbrella and water bottle. I also bring my small teddy bear along, and try and blag a pass for him, a sort of security test! Comfortable shoes are a must, as well as stacks of business cards. I also have a Spanish SIM with prepaid data which I recharge every year – the WiFi is not always the fastest. Most of the faces are the same, but everyone moves around companies so you have to keep up with them! I always take time to look through the daily newspaper every day to catch up with the announcements, press releases and themes. Afterwards I type up a small report, and try and follow up the key contacts and ToDo list.

My security tasks for this year? Thinking about Embedded SIMs and Machine to Machine; are people building in security to devices yet? How useful is the latest blast of publicity we get on malware and viruses? I am hoping none of it is too exaggerated! And of course I will be spreading the message about the importance of security in products and services as it has a direct influence on your profit……. too often I see the technology used wrongly, with unrealistic expectations, leading to insecure networks, products and services. Mind you, it keeps me in a job!

So get ready for long treks, long nights and tired feet and heed my top tip – you will get the most out of it if you plan.