How Can Telecom Companies Reduce Data Security Risks

The telecommunications industry is one of the biggest collectors of sensitive information in the world. With millions of customers sharing personally identifiable information (PII) and financial data with them, telecom companies are relentlessly targeted by cybercriminals.

According to cybersecurity firm EfficientIP, 43% of telecom operators suffered from Domain Name System (DNS)-based malware attacks in 2018, with a staggering 81% taking three days or more to apply a critical security patch after a data breach was detected. The same report showed that the telecommunications sector has the most sensitive data stolen across all industries, with 30% of telcos that participated in the survey reporting sensitive customer information stolen.

More recently, security company Cloudflare reported that the telecommunications industry was the most targeted by another major cybersecurity threat, distributed denial of service (DDoS) attacks, in the first quarter of 2021, a significant jump from the previous year.

A Kaspersky report also showed that cybercriminals often recruit insiders to attack telecom providers. Hackers turn disgruntled employees into malicious insiders or blackmail staff using compromising information gathered from open sources. Almost 28% of all telecom-targeting cyberattacks involved malicious activity by insiders at the time the report was released.

But such attacks are not the only thing telecom companies need to be worried about. Sensitive data such as PII and financial information are also protected under a new wave of data protection laws and international standards. From the EU’s General Data Protection Regulation (GDPR) to Brazil’s Lei Geral de Proteção de Dados (LGPD) and Japan’s Act on the Protection of Personal Information (APPI), the protection of personal data has become a legal obligation worldwide. Failure to comply with these laws can lead to massive financial penalties and reputational damage.

When it comes to financial information, the Payment Card Industry Data Security Standard (PCI DSS) was set up by the world’s biggest card brands to ensure the protection of payment systems from breaches, fraud, and theft of cardholder data. While not legally binding, PCI DSS is a general standard adopted by financial service providers across the world and compliance is required for any organization wishing to accept credit or debit card payments, whether in person, over the phone or online.

For all these reasons, data security should be a prime concern for the telecom sector. But how can telcos minimize these cyber risks and avoid data loss? Here are our recommendations.

Limiting sensitive data transfers

The human factor is often the weakest link in a cybersecurity strategy. Whether they have been compromised by malicious outsiders or are one careless step away from a data leak, insider threats are a very real security concern. Telecom companies can limit the damage employees can do by implementing Data Loss Prevention (DLP) solutions.

DLP technology protects sensitive data directly. Telcos can choose predefined profiles for sensitive information such as PII and credit card information, but also compliance-oriented profiles for laws and standards such as GDPR and PCI DSS. These definitions can be customized to serve a particular telecom company’s needs and include other categories of sensitive data such as intellectual property and source code.

Once sensitive data is defined, DLP solutions can search for it through hundreds of file types using contextual scanning and content inspection. The movements of files containing sensitive information can then be monitored in real-time, and their transfer can be limited or blocked. In this way, telecommunications companies can prevent employees from sharing sensitive information via messaging apps, file-sharing services, personal emails and more.

Controlling removable devices

Another way in which employees can exfiltrate data is through removable devices. USBs, in particular, are easy to hide and misplace, making them ideal tools for data theft and a constant source of data loss.  To prevent employees from using USBs or limit their use of company-trusted devices, telcos can turn to DLP solutions.

DLP tools come with device control features that allow companies to block or limit the use of USB and peripheral ports as well as Bluetooth connections. By preventing employees from connecting personal removable devices which do not meet company security standards and might be a source of network infection, telcos can help keep data secure.

Cross-platform capabilities

Telecom companies often run a mixed-operating system environment. Most security products will focus on a specific operating system – frequently Windows, which is the predominant operating system in the enterprise – and offer only stripped-down versions for other operating systems.

This can expose computers running on other operating systems to data breaches. While some operating systems are less vulnerable to external security threats, data stored on them is just as exposed to insider negligence or malicious intent as well as employee-targeting cyberattacks such as those based on phishing and social engineering.

Therefore, it is essential for telecom companies to choose data security services to ensure that all operating systems on their network are offered the same level of protection. This can translate into multiple products, each specialized in a single OS or cross-platform solutions such as Endpoint Protector that offer feature parity for Windows, macOS and Linux.

In conclusion

Telecom companies are a data goldmine, making them one of the most targeted industries in the world. From DNS and DDoS attacks to the collusion of malicious insiders and employee negligence, telcos have a lot of vulnerabilities they need to address through their cybersecurity strategies.

To ensure network security, telecommunications companies should look beyond basic security measures like firewalls and antimalware solutions to more profound fundamental changes such as a shift towards Zero Trust architecture and a data-centric approach to cybersecurity.