UK’s NCSC Advises PAM for Telecom Networks

Cybersecurity is one of the primary focuses of the governments around the world. Since the expanding attack surfaces creating more vulnerabilities for cyber threats, data privacy and security becomes more and more vital in years. Because of this, especially the industries like telecommunications should avoid any cybersecurity gaps within the systems that could disrupt the entire service and therefore these industries are regulated under the rules to assure seamless and secure service. United Kingdom (UK) have been addressing these concerns with the Telecom Security Requirements (TSRs) and updating it constantly. Let’s get a close look to the TSRs of UK.

About the UK Telecom Security Requirements (TSRs)

It's been more than a year and a half since the UK government published its Telecom Supply Chain Review, which includes improvements in cybersecurity risk management and outlines plans to more intensely regulate the UK telecom industry.

The review addresses concerns about the security posture of telecom networks and recommends setting out an up-to-date, resilient security framework for the UK telecom sector. The framework is based on a set of new Telecom Security Requirements (TSRs) controlled by Ofcom and the government.

Initially, TSRs have been published as a formal guide setting the National Cybersecurity Centre's (NCSC) expectations regarding telecommunication networks’ security. It was first published at the beginning of 2020 and was revised in July 2020. Telecom operators have been invited to “voluntarily” adopt and implement this framework to get compliant with these requirements.

Nevertheless, the government is expected to introduce strong enforcement backing this extremely important Telecom security regime, overseen by the government itself and Ofcom. Based on the latest news, the UK government expects telecom operators to give due weight to this recommendation as in all their interactions with NCSC and plans to implement this regime as legislation at the earliest opportunity.

Why Privileged Access Security is crucial for UK Telecom Networks?

TSRs aim to introduce security controls and principles that will help to shrink the security surface and mitigate the risk around the five main areas. One of the primary intents of the TSRs is the segregation of the critical management operations and implementing security measures to control direct access to networks related to the management plane.  TSRs propose the Privileged Access Workstation model to secure access to critical network equipment and ensure the required level of trust for the management to be performed.

This model refers to segregating users’ access through a privileged access workstation, which has the same level of trust as the managed equipment to implement management activities, so it could be possible to minimize the factors that may pose significant risks. This model also allows for more advanced access controls to be implemented, such as segregation of duties, ensuring the required level of trust, and applying least privileged access policies, so that it can be possible to secure access for administrative access, minimizing inconvenience.

Why Krontech is the best solution for Telecom’s Privileged Access Management concerns?

Krontech is a Gartner recognized information security company providing the most Telecom oriented Privileged Access Management (PAM) solutions on the market. Our customer satisfaction success comes from our strong Telecom background and the experience of understanding the needs of Telecom Operators.

To help Telecom organizations address these challenges, mitigate the security risk and reduce the operational complexity of privileged access, Krontech offers the fastest to deploy and the most comprehensive access security platform on the market.

Telecom’s access security problem differs from other industries. Orchestrating dozens of different authentication systems (TACACS, RADIUS, LDAP, AD and more) on a multi-vendor heterogeneous device ecosystem where multi-divisional organizational involvement in operations and decisions are inevitable, creates a massive complexity. One of the main reasons is that the regulations required that the service provider indisputably log every change made to their infrastructure to prevent malicious configurations.

Unlike agent-based traditional PAM solutions, Krontech combines PAM features with built-in multi-factor authentication, AAA server functions (TACACS/RADIUS) and database firewall capabilities in an agentless, vendor agnostic and proxy-based privileged access security platform.

Apart from that, as the pioneer of seamless proxy-based privileged access security approach, our PAM platform, Single Connect, enables secure access segregation to reach critical infrastructure strengthened with the required level of trust principals. Besides, the browse down technology utilized for terminal protocols such as RDP and VNC, provides a significant risk reduction in privileged access to servers and business applications within the organization. If you would like to get further information about our Telecom business cases, you can find it here.

As the UK Telecom organizations continue to embrace the new TSRs, Krontech PAM solution and its team are ready to support the need for end-to-end privileged access security. We also strongly advise you to check the following recommendations from NCSC.

https://www.ncsc.gov.uk/blog-post/protecting-system-administration-with-pam

https://www.ncsc.gov.uk/blog-post/protect-your-management-interfaces