Editor’s note: This is the sixth article in the "Real words or buzzwords?" series from SecurityInfoWatch.com contributor Ray Bernard about how real words can become empty words and stifle technology progress.
The term network-friendly started popping up in the physical security industry around 2003, and was in use in the IT domain earlier than that, in recognition of the fact that some applications and systems performed better over a network than others, and some created less of a burden on network resources than other apps and systems.
Since the term first appeared in the physical security industry, rarely could the sales people of the companies who used the term define it clearly when asked. Without a definition, specifiers and end-user customers took it simply as a marketing hype word, primarily because early network-connected devices and systems had or caused mysterious troubles of one kind or another. For example, several brands of network cameras would go offline if a network administrator ran the popular Network Mapper program (commonly called “Nmap”) to scan the network. This did not happen with cameras from Axis Communications, but that’s because Axis came from the IT world and had a very thorough understanding of networking.
Several security industry companies have asserted that network-friendly meant “works well over a network,” but their concept of “works well” was too shortsighted. It is one thing to work well when three devices are talking on a benchtop network. It’s completely another to work well in a corporate network environment with hundreds or thousands of active devices connected.
Network Neighborhood
Rodney Thayer, a network researcher at Smithee, Spelvin, Agnew & Plinge, Inc., uses the concept of a “network neighborhood” to provide a context for discussions about what it means to participate in a shared network infrastructure. Of course, how a “good neighbor” is defined is very dependent upon what neighborhood you’re talking about, and that’s the point. It’s also one of the reasons why no formal definition for network-friendly has been established, despite the widespread use of this important term.
What network-friendly means depends on what the network is, and when we use the term “network” in this context, we’re not just talking about the connectivity from one point to another. A residential or industrial neighborhood is more than its streets, intersections, and traffic lights. Similarly, an electronic network neighborhood includes not just network paths and connections—but all the devices connected to the network. It is important to remember that just as residential and business neighborhoods change over time, so do device network neighborhoods. Being network-friendly must also take that aspect of networks into account.
The Importance of Network-Friendly
Renting a home or office in a neighborhood does not automatically make a person a good neighbor. Likewise, the ability for a device to connect to and communicate across an IP network does not make that device a good network neighbor.
This is why members of the World Wide Web Consortium (W3C), an international community that develops standards for the web and is led by the inventor of the Internet—Tim Berners-Lee, established a community group for Network-Friendly App and WebApp Best Practices. As their home page explains, this group was formed because network-friendliness of mobile applications is a critical issue facing the mobile industry.
Over the past six months, I have had many executives, sales people and developers from over a dozen physical security industry manufacturers proudly tell me that their product development strategy is “mobile first.” Yet the developers I talked to didn’t have a concept for a network-friendly mobile application, and I’m willing to bet that their company’s executives and sales people don’t either.
They should have been aware of, and their developers should have been applying, the 98-page guideline document titled, “Smarter Apps for Smarter Phones”, whose version 4.0 was published by the GSM (Global System for Mobile Communications) Association in 2014. The following three paragraphs are from this guideline’s Introduction. Note that “signaling” is a telecommunications term for messages in a cellular phone network that convey cellular connection management information. The amount or quantity of these messages is the “signaling load”, which is discussed below.
The rapid rise in demand for mobile data has taken key [cellular network] industry stakeholders by surprise, particularly the [cellular] network operators at the forefront of delivering services to customers. A direct consequence of the huge success in the uptake of data services is a greatly increased signaling load at the [cellular] network level independent of the volume of data traffic. End-users and application developers are largely unaware of increased signaling load as this is only visible to [cellular] network operators/service providers. However, increased signaling load impacts smartphone users, who can experience rapid battery drainage, unresponsive user interface, slow network access and non-functional applications.
As use of smartphone applications increases, so does the signaling load on a disproportionate scale. This is caused by a number of factors, but aspiring enthusiasts, (perhaps with a background in developing desktop applications), who are translating their ideas into network-unfriendly apps that can be easily installed on smartphones, are amongst the main culprits.
As a result, [cellular] network operators are facing the challenge of unprecedented signaling load that is out of proportion to the level of data usage.
Did you know that how a mobile app is engineered can impact the battery life of the mobile device? Manufacturers with a “mobile first” strategy should make sure that any client-server and web application developers get education on the full engineering scope of mobile app development, or are supported by development team members who do have such education and experience.
Security Industry’s Key Technology Weakness
As the physical security industry history shows, it has not been good at fully understanding and making best use of information technology advances, and it does a very poor job of adopting information technology practices. The fact that the industry continues to take important IT concepts and turn them into marketing buzzwords (the reason for this article series) is just one aspect of a larger situation.
This is a key weakness of the industry. It threatens to deprive the industry’s customers of the full benefits of advancing technology. It assures that the customer technology experience will not be a smooth one. It handicaps systems integrators, and leaves them rightfully distrustful of new electronic security devices and systems.
One Example: SNMP
Simple Network Management Protocol (SNMP) is an Internet-standard protocol for collecting and organizing information about managed devices on IP networks. When network devices support the SNMP protocol, they can be monitored and managed using network management software such as the SolarWinds products, What’s Up Gold, or OpenNMS. SNMP was initially defined in 1988, and has been updated several times over the years.
The security industry began putting devices on IP networks in the late 1990’s. Every such device should have had support for SNMP. The reason that some cameras would go offline when a network administrator would run Nmap, is that the camera software was programmed only for its own communications protocol, had insufficient error trapping, and thus would malfunction when SNMP messages were received.
The Security Industry Association established its SNMP working group in 2013, about 15 years after it should have been established. This means that for 15 years, security industry manufacturers did not consider SNMP important enough to warrant the establishment of guidance or standards for networked physical security system devices—even though they were manufacturing network devices and systems.
One result was that security system integrators could not use standard network tools to manage security system networks. What a disservice! Thus, for a decade and a half, many IT professionals have looked upon electronic security systems and their devices with disdain, much to the disadvantage of integrators and their end-user customers.
Fortunately, this security industry picture is changing, as is witnessed by the fact that eight manufacturers currently provide security hardening guides and other cybersecurity advice for the deployment of their products and systems. However, catching up with information technology is a long and broad road, one that continues to place challenges at the industry’s doorsteps. Right now, IoT devices and systems are bringing another realm of engineering into the security arena. Will it be embraced with full understanding that includes the adoption of the relevant engineering good practices? Time will tell.
What Does Network-Friendly Mean?
Because the term network-friendly has different requirements for different technology contexts, it is not practical to study them all. So, what are integrators, security design consultants and end users to do? A simple and practical approach—when someone asserts that a product or system is network-friendly—is to ask outright, “Exactly what do you mean when you say network-friendly?” Hopefully, before too long, we’ll start hearing some very good answers.
About the Author:
Ray Bernard, PSP CHS-III, is a leading technologist and future-thinker who is the principal consultant for Ray Bernard Consulting Services (RBCS), a firm that provides security consulting services for public and private facilities (www.go-rbcs.com). Mr. Bernard is also a Subject Matter Expert Faculty of the Security Executive Council and an active member of the ASIS International member councils for Physical Security and IT Security.
