Many carriers “don’t care or don’t know” whether wholesale traffic poses a security threat, suggested speakers in session on cyber security.
So far “they’ve been a little bit far” from security issues, said Katia Gonzalez Gutierrez, head of fraud prevention at BICS. Julia Fraser, VP of professional services at Level 3, warned: “What does [a security breach] do to your stock price? What’s the reputational damage? And what does it cost to recover?”
Ben Von Seeger, VP for global network service providers at Cyxtera Technologies, lamented that “in 1996 they developed the firewall, and then VPNs, but we don’t have anything else [since]. The firewall doesn’t work any more.”
Arnd Baranowski, CEO of Oculeus, said: “Wholesale operators are telling me they don’t care whether traffic is going through the network is fraud or not. There has to be a change in thinking.”
Fraser said that Level 3 “spends a lot of time telling wholesale customers about threats – it’s the right thing to do”. She added: “We need more of that. It’s cooperation between a group of people who effectively compete.” But “we get a mixed response – sometimes a negative manner”, when the Level 3 phones to warn a customer.
Gonzalez Gutierrez said the i3Forum has a valuable role in helping wholesale operators work together. “There has to be a difference between wholesale carriers and what’s happening with enterprise customers – it’s on a different level,” she said.
The wholesale business “doesn’t look at the content”, she agreed. “This is where the i3Forum is starting to work, sharing information appropriately.” But “it’s always a bit delicate to share information”, because of commercial confidentiality. “We need to be quite careful.”
But the i3Forum “is still only 40 carriers in that group”, she added.
Fighting fraud “is a matter of speed”, said Baranowski. “We have to get this automated. We have to get to a point where we exchange information quickly.”
Telcos have done “pretty well so far as a sector” in avoiding cyber security issues, Patrick Donegan, founder and principal analyst at HardenStance, told the conference. Most common causes of problems are due to network failure. “Cyber-related attacks are a minor cause.”
One of the most significant issues though was at UK operator TalkTalk, which lost customer data in a number of attacks. “We saw a significant update of telcos recruiting cyber security people after those,” said Donegan.
But he warned that things will get worse: “The adversaries are focused on winning. Companies are not so focused on winning.”
However Fraser warned of “a degree of fatigue in clients” when she talks to them about cyber security. “We want to help manage that fatigue.”
And some carriers don’t even have security departments, said Gonzalez Gutierrez. “One carrier told us they had been hacked and they didn’t even realise until [afterwards].”
“Every carrier should have an anti-fraud system,” said Baranowski. “And there should be a 15-minute deadline between detection and fighting.”
But that’s too long, said Gonzalez Gutierrez. “We need to move to real time.”
