Data discovery to protect against cyber-attacks on telecommunications

Telecommunication companies are a primary target for malicious cyberattacks, given they operate an infrastructure widely used to communicate while simultaneously storing large amounts of sensitive data about their customers. Making matters worse, the telecoms industry continuously ranks among the worst in handling and fighting cybersecurity -- enabling attackers to gain access to personal, sensitive information with a reduced amount of effort compared to other industries where cybersecurity has traditionally been a higher priority. The impact of a cyberattack to a telecommunications company is high and far-reaching, with the potential to lose millions of customers and completely tarnish brand reputation. In this article we'll explore the main types of attacks targeting these organizations and how data discovery can be used to protect against cyber-attacks on telecommunications businesses.

Understanding the main types of attacks in telecommunications

To stay one step ahead of malicious actors, it’s important to understand the evolving threat landscape facing the telecommunications sector. There are two primary types of cyberattacks targeting telecommunications providers -- direct and indirect attacks. 

Direct attacks are often spearheaded by cybercriminals who aim to access the telecommunications company and its third parties who store and process personal and sensitive data on its behalf. An example of a recent direct attack occurred in March 2020 to Rogers, a Canadian communications and media company with over 10 million subscribers. The data breach was caused by an external provider accidentally making information available online that provided access to Rogers’ customer database, leaking personal information (PI) like names, addresses, and contact information. While it was a third party who lost the data, Rogers ultimately shouldered the responsibility of making good with its customers given they were the entity who each customer provided their data to.

Indirect attacks occur when cybercriminals attack a company’s customers by accessing the data stored on company systems via a trusted third party source. Think of it as instead of breaking in via the front gate to get into an intended property, you break in via the neighbor’s gate which has an unlocked side entrance into the intended property. For example, in July 2019, telecommunications provider Sprint experienced a data breach in which hackers gained access to customers’ login information and all of the data associated with these accounts, including first and last names, phone numbers, device types, home addresses, PINs, billing numbers, Device IDs and Subscriber IDs.

Protecting against Direct & Indirect Cyberattacks

Once organizations gain a general understanding of the main types of cyberattacks targeting the telecommunications industry, it’s time to put proactive security measures in place to better safeguard the business’ most valuable asset -- its data. A few immediate, simple security measures to protect against emerging cyberthreats include:

• Have a team in place: While security should be everyone’s responsibility within an organization, it’s also important to have a right team in place that is responsible for the implementation of security tools and ongoing adaptation of preventive measures. At minimum, telecommunications companies of any size should appoint a cybersecurity leader who holds the responsibility of ensuring ongoing data security and can help guide the organization through ongoing training, tool implementation, security budgeting and more.
• Prioritize cybersecurity and privacy companywide: Security and privacy are often thought of as an IT problem when in fact, they are squarely a business problem. To achieve this, implement strategies and procedures that put cybersecurity and privacy at the forefront of your organization by developing processes that engage staff at all levels, regardless of seniority of tenure. By educating all personnel early, you can invoke a cultural change which emphasizes the importance of security and awareness of how personal and sensitive data must be handled. Make these initiatives a priority across the entire business, and again, emphasize how security is a shared responsibility.
• Invest in the right technology: Organizations can’t assume they’re secure if they don’t invest in the appropriate technology to do so. When budgeting, plan for the addition of tools that bolster an organization’s security posture, such as data discovery software, which enables businesses to become fully aware of, and remediate sensitive information, regardless of where it's stored.

Data Discovery: The first step in protecting Customer Data

Telecommunications companies sit on a goldmine of personal and sensitive customer data. It’s imperative to protect this data from motivated cybercriminals. The first step to protect such valuable data is data discovery. By having a deep understanding of what data they have, where it resides as well as how it’s being protected from hackers, telecommunications companies can ensure business success and retention of loyal customers. 

With Ground Labs’ award-winning Enterprise Recon, telecommunications organizations can discover over 300 predefined and variant types of data from over 50 countries and take immediate actions to better secure their most sensitive assets. 

With data breaches happening so frequently, organizations can’t afford to wait any longer. Take the first step to better data protection today. 

Book a demo with a Ground Labs expert to learn why telecommunications companies, including Optus and Vodafone, trust us to discover their sensitive data.