Eight big US telcos join forces on network cybersecurity

AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, Verizon and Zayo are working together in a communications cybersecurity group to information and respond rapidly to threats.

Eight US telecom operators are setting up a cybersecurity threat intelligence sharing group to coordinate the sector's defense and response to more sophisticated and persistent threats to critical communications infrastructure.

AT&T, Charter Communications, Comcast, Cox Communications, Lumen Technologies, T-Mobile, Verizon and Zayo are the founding members of the Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC) that will start operations month. The board of the nonprofit organization will comprise the chief information and security officers from each of the eight operators, led by AT&T CISO Rich Baich as chairman.

The group formalizes the information sharing that already happens among telco security teams so that they can collaborate on preparation for new cyberthreats, alert each other to unusual network activity and, in the event of a cyberattack, quickly convene to coordinate a collective response.

"We're not going to be operating in silos when a potential event occurs. There'll be information sharing across all that…[and] coordinated response based on that information sharing," said Baich.

"We could be sharing vulnerabilities that we find to be an issue. We could be sharing information related to different types of cyber techniques that are being utilized," Baich explained. "Most importantly, though, it is having that trusted forum and the right relationships that someone can just make a phone call to get an answer."

The type of information shared will range from tactical to strategic, including criminal and nation-state threats.

Sector-specific ISACs are common, and more than one is dedicated to telecoms, such as the Communications ISAC (COMM-ISAC), which was established in 1984. The new C2 ISAC is different in that it is focused on cybersecurity, while others cover broader security areas including physical threats and natural disasters. Also, it is a private sector-only group, unlike others that tend to be public-private collaborations.

C2 ISAC says it will work closely and collaborate with US and international government entities and regulators, but the agencies will not participate in the organization. Membership is restricted to private-sector network operators.

Baich also envisions the group expanding to telecom operators in other countries, but for now it is US-focused with the initial eight members.

Valerie Moon has been appointed executive director of C2 ISAC, overseeing day-to-day operations. She recently served as chief strategy officer at the Cybersecurity and Infrastructure Security Agency (CISA), following a long career at the FBI.

A rationale for creating a new intelligence sharing group is the need for speed in responding to cyberattacks and staying ahead of a rapidly changing threat landscape. Leaving out government and regulators from the organization is seen as a way to make sharing easier by avoiding complex regulatory and legal requirements for what information can be distributed and how.

Mark Clancy, senior vice president of cybersecurity at T-Mobile, said the objective is to "reduce the friction" in sharing information among the operators. "We created the structure to help ease that flow of information, because the people who attack T-Mobile are the ones who are going to attack everyone else," he explained.

There are times when an operator might see something odd in the network but not know what it is – occurrences Clancy describes as "wisps of smoke." Being able to "phone a friend" to ask if they're seeing the same thing "gets us better triangulation of what's happening, and that may be a criminal threat or it may be a nation state threat," he explained.

Clancy pointed to the financial and defense sectors as models for good threat information sharing. "They've been doing it much longer. They've had private-to-private venues and private-public venues. We've really only had the public-private venue, which I think has slowed down some of our ability to collaborate on these threats," he said.

Verizon CISO Nasrin Rezai said in an emailed statement: "By formalizing real-time intelligence sharing among industry leaders, we are building a unified defense that no single company could achieve alone."

At the FCC's Cybersecurity Workshop for Telecommunications Carriers last week, Mitre CTO Charles Clancy provided a view of how cyberthreats are changing and the way the telecom sector needs to respond. Mitre maintains the Mitre Att&ck Framework , the widely used global database of adversary tactics and techniques based on real-world observations that is available to anyone, anywhere for free.

According to Clancy, legacy critical infrastructure defenses were designed for "non-destructive and episodic nation-state threats."

"However, the threat that we could face in a couple years from a nation state adversary is persistent, not episodic, and is destructive, not purely to establish presence and to steal information," said Clancy. "And that change, I think, is why we need to deal with and manage those threats differently."

Senior Editor, Light Reading

Michelle Donegan covers all things 5G, 6G and mobile tech for Light Reading. She has been writing the telecoms sector since the early 1990s.

Her first job was with Global Telephony magazine in Chicago, where she got an intro to publishing and tech reporting. After moving to the UK in 1999, she has covered telecoms tech, business and policy issues at publications including Communications Week International and Total Telecom. She was also part of Light Reading’s European editorial team from 2007 to 2013. Between stints at Light Reading, she was busy freelancing and was a regular contributor to Mobile Europe, Mobile World Live, TelcoTitans, TM Forum, and more.