Telecommunications Industry: Calling for Security Help?

Telecommunications is one of those industries that many people take for granted—until service is interrupted for one reason or another. We’re accustomed to being connected, whether it’s through our mobile devices or landline phones at home or in the office.

Businesses as well as consumers are highly dependent on telecom companies and the communications infrastructure they provide, and if their operations are down for any length of time, it wreaks havoc. That’s why the cost of a security breach at telecom’s are high.

The sense of security urgency in the industry is even greater when you consider that telecom companies handle not just voice traffic, but data as well. And increasingly these companies are getting into the cloud services business, which means some companies and individual users will have even more reliance on them.

We’ve recently seen attacks against these companies. AT&T experienced two insider data breaches within the span of a few months. The first, in June 2014, saw the company confirm that three employees of one of its vendors accessed some customer accounts without proper authorization.

In a statement, AT&T said "this is completely counter to the way we require our vendors to conduct business. We know our customers count on us and those who support our business to act with integrity and trust, and we take that very seriously. We have taken steps to help prevent this from happening again, we are notifying affected customers, and we have reported this matter to law enforcement."

But then some four months later the company was hit by another attack, this time by an employee illegally accessing the personal information of some of the company’s customers. Information such as Social Security numbers and driver’s license numbers were compromised.

In May 2014, French telecommunications company Orange announced it had been hit with a second major data breach in a matter of months. The company said hackers stole the personal data of 1.3 million customers of its online portal, including names, email addresses, phone numbers, dates of birth and the names of clients’ mobile and Internet operators.

In February, the French company disclosed a separate security breach in which more than 800,000 users' emails, passwords, addresses and phone numbers were stolen from its customer Web site.

South Korean telecom company KT Corp was also the victim of multiple security breaches. In one such attack reported in March 2014, account information of 12 million customers was stolen in what was said to be the second largest Korean data breach in history.

This was the third major data breach KT Corp had suffered in two years. The company lost account information of 200,000 customers in March 2012, and in July 2012 hackers made off with account data of 8.7 million customers after a customer sales system breach.

These examples show that telecommunications companies not only are vulnerable to attack, but that they can get hit several times within a short period. What’s especially concerning is these are organizations that are presumably up on the latest network security technology, because they are in the networking business.

Industry research sheds some light on what telecom companies are facing when it comes to attacks. More than a quarter of the telecommunications companies surveyed by consulting firm PwC (26%) said they had detected 50 or more security incidents in the previous 12 months, compared with the average 24% for all industries.

PwC’s report, “The Global State of Information Security Survey 2015,” produced with CIO and CSO magazines, surveyed a total of 9,700 business and technology executives worldwide from March to May 2014. The most commonly suspected sources of the security incidents were former employees, cited by 37% of the telecom companies. That compares with an average 30% for all industries. Other highly suspected sources of telecommunications company intrusions include current employees, hackers and competitors.

In terms of the impact of incidents on organizations, telecom companies most frequently mentioned the compromise of customer and employee records.

Telecommunications is a regulated industry, and government entities have taken steps to bolster information security within the sector. For example, the U.S. Federal Communications Commission (FCC) formed the Cybersecurity and Communications Reliability Division (CCR), which works with companies in the communications industry “to develop and implement improvements that help ensure the reliability, redundancy and security of the nation's communications infrastructure,” according to the FCC Web site.

CCR oversees and analyzes network outage reports that are submitted by communications providers to identify trends in network disruptions. The staff then works with communications providers to make improvements to communications infrastructure reliability.

But there’s plenty of room for more help in bolstering security in the industry, especially as telecom move further into the cloud service provider market.