Safety Communications System

Živimo v času informacijske družbe, v kateri postaja vse pomembnejša tudi informacijska varnosti, še posebno ko gre za kritično, nacionalno, informacijsko-telekomunikacijsko infrastrukturo. Prav s tem namenom je nastalo diplomsko delo, v katerem se uvodoma seznanimo z informacijsko-telekomunikacijskimi sistemi, dotaknemo se sistemov za varno komunikacijo in osredotočimo na informacijsko-telekomunikacijski sistem TETRA, ki je bil zasnovan prav zaradi potrebe po varni komunikaciji vladnih in nevladnih služb. Želeli smo preveriti ali je bila uporabnikom zagotovljena takšna stopnja informacijske varnosti, kot je bila že predhodno določena z javnimi naročili o nakupu informacijsko-telekomunikacijske infrastrukture, zato smo v letu 2012 pričeli izvajati tehnično varnostno analizo, slovenskega, informacijsko-telekomunikacijskega omrežja. Ugotovimo, da je mogoče s preprosto in cenovno dostopno napravo, namenjeno sprejemanju radijskih signalov iz vakuuma, ter ustrezno programsko opremo, TETRA signal demodulirati, prometne podatke pa analizirati. Nadalje, s podrobnejšim in sistematičnim pregledom prometnih podatkov ugotovimo številne varnostne ranljivosti in z njimi seznanimo pristojne. Zaradi možnosti ogrožanja informacijske varnosti in s tem tudi ogrožanja nacionalne varnosti države, smo pristojnim predlagali, da varnostne ranljivosti, čim hitreje tudi odpravijo. Po javni objavi so varnostne ranljivosti le odpravili in s tem vsem uporabnikom omogočili ustrezno stopnjo informacijske varnosti. Sklenemo lahko, da informacijsko-telekomunikacijski sistem TETRA uporabljajo službe, ki zagotavljajo nacionalno varnost države, zato je še toliko bolj pomembno, da je za komunikacijo uporabnikov, na voljo ustrezna stopnja informacijske varnosti. Tovrstnih, neodvisnih in entuziastično naravnih, varnostnih analiz informacijskih sistemov, v slovenskem prostoru ni prav veliko, zato je diplomsko delo, s katerim želimo spodbuditi pristojne, da bi se v prihodnje bolje zavedali pomena informacijske varnosti, dobra priložnost, da se tudi na tem področju, spremeni nekaj v pozitivno smer.We live in a time of the information society, where the need for IT security is becoming increasingly important, especially when we speak about critical, national information-telecommunication infrastructure. It is for that purpose in particular that I chose to write this diploma paper. The introduction outlines the basics of information-telecommunication systems, we touch upon the topic of secure communication systems and focus on the TETRA information-telecommunication system, which was designed specifically to fulfill the need for secure communications in government and non-government organizations. We wanted to verify whether this type of IT security indeed provided the level of IT security defined in public procurement process involving the purchase of information-telecommunication infrastructure, and so in 2012 we began performing a technical security analysis of the Slovenian information and telecommunication network. We found that the TETRA signal can be demodulated using a simple and inexpensive device, whose purpose is to receive radio signals from a vacuum, and suitable software, making it possible to analyze transmitted data. Furthermore, we have identified numerous security vulnerabilities through a detailed and systematic analysis of transmitted data, and informed the competent authorities accordingly. Due to the identified possibility of compromising the security of information and due to the fact that this presented a threat to national security, we proposed to the competent authorities to address these vulnerabilities as soon as possible. After the matter was disclosed to the public, these vulnerabilities were finally fixed, allowing the suitable information safety for all users. We can conclude that the TETRA information-telecommunication system is used by national security agencies and it is therefore all the more important to ensure a suitable level of information security in communications between these users. Since few independent and enthusiast-originated security analyses of Slovenian information systems exist in Slovenia, the present paper is a good opportunity for promoting positive change in this field and to increase awareness about the importance of information security