Industry Brief: Telecommunications Cyber Risk Priorities

Why telecom is a different risk problem

Most sectors protect their own data and operations. An operator protects those and also the infrastructure that other organizations, governments and emergency services rely on. A compromised core router or management system is valuable to an attacker for exactly that reason: it sits on the path of other people’s traffic.

Three features shape the risk. Privilege is concentrated. A small set of management systems, authentication servers and vendor tools can change how the whole network behaves. Trust is long-lived. Signaling, roaming and interconnect arrangements were built on the assumption that operators could trust one another. Availability is a public matter. Regulators treat public electronic communications networks as a sector of high criticality; the EU’s NIS2 Directive lists them under digital infrastructure.

The priorities at a glance

1. The management plane

Joint guidance from CISA, the NSA and the FBI, with agencies in Australia, Canada and New Zealand, reported that PRC-affiliated actors had compromised the networks of major global telecommunications providers for espionage. The agencies also said the activity aligned with weaknesses already present in victim infrastructure, and that they had observed nothing novel.

That second point is the useful one for prioritization. It says the exposure is largely in how networks are run, not in exotic techniques. The guidance points to where to look: management only from trusted devices on a separate out-of-band network, device configurations held in a central store treated as the source of truth, alerts on unauthorized configuration change, flow monitoring at key ingress and egress points, and legacy protocols such as Telnet and SNMPv1/v2c switched off.

A risk register often carries this as one line, usually worded as network compromise. It becomes manageable when it is split into things that can be counted: how many devices are reachable outside the management network, how many still run legacy protocols, how many have configurations that differ from the stored version. Those figures are the baseline a board can track.

Decision: treat unplanned configuration change on a network device as a security event, not only an operations event.

2. Privileged identity

The same guidance asks for phishing-resistant MFA on administrative access, and for a central authentication server for network administration that is kept separate from the primary corporate identity store. Local accounts are for emergencies only.

The reasoning is straightforward. If network administration hangs off the same directory as email, one phished corporate credential starts a path to the network. Separating the two breaks that path and shrinks the number of accounts that matter. Account management was also among the failures the Korean government investigation attributed to SK Telecom, discussed below.

Decision: confirm that network administration identity is isolated from corporate identity, and report how many accounts hold standing administrative rights on production network elements.

3. Subscriber identity and signaling

Public reporting of the Korean government’s joint investigation into the SK Telecom breach gives a measured picture. About 27 million IMSI records were compromised. Of 42,605 servers examined, 28 were infected, with 33 types of malware between them. The investigators moved the start of the intrusion back by roughly ten months from what was first thought. They cited poor management of account information, an inadequate response to earlier breaches and insufficient encryption of key information. The operator was also fined for late breach reporting.

The reporting leaves technical questions open, and this brief takes no view on what the attackers did with the data. The leadership lesson does not depend on those details: subscriber identity data sat on systems where a long intrusion could develop, and the response to earlier warning signs was found wanting.

Signaling carries a different kind of exposure. The GSMA describes SS7 as a protocol built for a world of assumed operator trust, lacking authentication and encryption, and still relevant because it supports SMS-based two-factor authentication, voice, SMS and roaming. It also warns that Global Title leasing can give third parties signaling access without proper identity checks. How much of this applies to a given operator depends on how much of its estate still relies on these protocols. That is something to measure, not assume.

Decision: establish where subscriber identity material is stored and who can reach it, and decide what signaling traffic from partners and lessees is monitored and what is blocked.

4. Suppliers and managed services

Operators run on vendor equipment, vendor software and, often, outsourced operations. Each of those relationships tends to carry standing remote access to systems that matter. A security questionnaire does not show who can reach a production element tonight.

Our assessment is that supplier access should be held to the same standard as internal administration: through the hardened management path, tied to named individuals, limited in time and logged. The practical starting point is an inventory of every supplier with standing access to production network elements, which may not yet exist in one place.

Decision: require time-bound, monitored supplier access through the same controlled path as internal administrators, and retire standing access that cannot be justified.

5. Service continuity and recovery

Restoring a corporate IT estate and restoring a network are different tasks. A network needs known-good device images and configurations, and a management environment that can be trusted to push them. The guidance recommends verifying software images against vendor-published hashes, keeping configurations centrally, and sending logs encrypted to a central location with off-site copies. Each of those is also a recovery asset.

The question to test is narrow and uncomfortable: if the directory, the management systems and the central logs could not be trusted, how would the network be brought back to a known-good state, and in what order would services return?

Decision: name the services that must be restored first, and run a recovery exercise that assumes management systems are compromised.

Decisions to put in front of the executive team

• Adopt configuration change on network devices as a monitored security event, with ownership assigned.

• Separate and harden network administration identity, and report the count of standing administrative accounts.

• Map subscriber identity data and signaling exposure, and set a target for reducing what is reachable.

• Inventory supplier access to production network elements and remove what cannot be justified.

• Test recovery of the network from a known-good state under the assumption that management systems are compromised.

What this brief does not claim

The priority order is a judgment built on public guidance and reported incidents, not a ranking of any operator’s actual position. Public reporting on telecom intrusions is partial, and several of the incidents cited are still described only in general terms. Operators should test the order against their own architecture, and revisit it when standards, technology or threat assumptions change materially.

Sources

• Enhanced Visibility and Hardening Guidance for Communications Infrastructure (CISA, NSA, FBI, ASD’s ACSC, CCCS and NCSC-NZ)

• Joint guidance on PRC-affiliated actors compromising telecommunications networks (PDF) (FBI IC3)

• Official probe finds SKT’s security failures led to massive data breach (Light Reading, reporting on the Korean government investigation)

• SS7: Securing a Legacy Protocol in a Modern Threat Landscape (GSMA)

• NIS2 scope visual: sectors of high criticality and other critical sectors (Centre for Cybersecurity Belgium)