Once upon a time, there were three discrete types of networks: enterprise, industrial, and telecommunications. They had their own borders and their own security rules. But the Internet swooped in and took a sledgehammer to the walls around the enterprise. And all manner of formerly ‘dumb’ objects grabbed a microchip and hopped on for the ride, as did our data and apps, which skittered off to new homes in the clouds. And telco operators and software vendors scrambled to keep these restless, borderless networks stitched together.
But where did the center of gravity for security land in all this? And whose job is it to defend enterprises from mobile threats that know no boundaries?
A recent survey conducted by Mobile World Live (MWL) [1] indicates network convergence is pacing ahead of the solutions required for effective global security. To get a clear picture of what’s happening, MWL took a step that is too rare in surveys: they segregated questions and analyzed results by respondent categories, namely communications service providers (CSPs), enterprises, and technology vendors. They then set aside the vendors responses for a clear view of enterprise needs and expectations and CPS capabilities to meet them. The result is unique insights that are meaningful to all three groups as our networks converge.
Here are a few key insights from the survey:
The top attack vector (phishing) is a cross-border one, but defenses are siloed and insufficient
Phishing is the most prevalent initial attack vector and the second most expensive, with an average cost of USD 4.76 million per breach. [2] And mobile phishing in all its forms (vishing - voice phishing, smishing - SMS phishing, and quishing - QR code phishing) is growing at a triple digit pace, with AI boosting attack effectiveness. [2]
The targets of these attacks range from consumer bank accounts to sensitive corporate data to critical infrastructure, with the latter disturbingly rising 30% in 2022, with more than 420 million attacks worldwide. [3]
However, even though telecommunications networks are themselves critical infrastructure, CSPs are still not doing enough to protect themselves or the enterprises they serve. For example, in this survey, only 59% of CSPs report having implemented a messaging firewall, and just 51% have implemented a signaling firewall.
Enterprises look first to CSPs for mobile threat defense, but CSPs are not meeting expectations
CSPs are not alone in not doing enough to combat mobile phishing threats: less than a quarter of enterprise respondents reported investing in any kind of protection for voice and mobile messaging fraud. While highly sophisticated enterprise security solutions exist that address such threats, respondents report looking first and foremost to telecom operators for protection (47%), followed by cloud providers (26%), managed IT providers (11%), systems integrators (8%), or direct software vendors (8%).
There is a logic to this given the central role of mobile devices and mobile networks in phishing propagation, but CSPs seem to be at a “physician heal thyself” inflection point given low firewall implementation rates, and the low rate of adoption rate for mobile threat intelligence services (less than half: 46%).
However, CSP security leaders, meaning those that prioritize security internally and through partnerships and integrations, overwhelmingly report that their cybersecurity capabilities play an important or extremely important role in B2B customers buying their products and services. And the responses from enterprises back this up: 85% say that security does indeed play an important or very important role in their telecom purchasing decisions.
Enterprise vendors can play an important role in filling the gaps
Our enterprise, industrial and telecom networks are so deeply intertwined there is no option other than to address security issues systemically, and for CSPs and enterprise cybersecurity vendors to pursue joint opportunities for achieving global visibility and sharing threat intelligence.
This is a must for better anticipating and responding to threats, and delivering the defense-in-depth protection essential for converged networks. And certainly, there is no doubt that enterprises today are deeply affected by mobile threats such as subscriber data breaches and DDoS attacks, interconnect and signaling attacks, spyware injection, mobile phishing and IoT device compromise.
In addition to lifting the security boat for all, collaboration can drive innovation and boost revenue for both enterprise security vendors and CSPs. CSPs need to keep in mind, as this survey shows, that (lucrative) business customers give great weight to security in their buying decisions, and that they are used to paying for security when it is shown to have a direct impact on reducing the risk of costly breaches – and increasingly, penalties and brand damage from regulatory transgressions.
And enterprise security vendors need to keep in mind the high level of trust organizations place in mobile operators, and the unique insights they can bring to mobile-born threats penetrating the IT and industrial networks. This can help enterprise vendors deliver better results for customers while boosting their financial success in step with revenue growth for CSPs.
One fertile environment for fostering such cross-domain understanding and collaboration is of course private 5G, which is an epicenter for innovation in converged networks, and for tackling new opportunities and challenges associated with AI, with threat intelligence sharing (and monetization), with global observability, and with creative problem solving for security gaps in areas like home office connectivity and device monitoring and protection.
Endnotes
[1] Statistics and sources are cited in the Mobile World Live (MWL) survey report, Mobile network security: Bridging the gap between enterprise needs and CSP capabilities.
[2] IBM 2023 Cost of a Data Breach Report.
[3] Forescout Research - Vedere Labs report, 2023 Global Threat Roundup.
