Mobile Network and Device Security

Background

Security attacks threaten all forms of ICT, including mobile technologies. Consumer devices are targeted for a variety of reasons, from changing the IMEI number of a mobile phone to re-enable it after theft, through to data extraction or the use of malware to perform functions that have the potential to cause harm to users.

Mobile networks use encryption technologies to make it difficult for criminals to eavesdrop on calls or to intercept data traffic. Legal barriers to the deployment of cryptographic technologies have been reduced in recent years and this has allowed mobile technologies to incorporate stronger and better algorithms and protocols, which remain of significant interest to hackers and security researchers.

Recent years have seen a significant increase in interest in protocols such as SS7 and Diameter, which support interconnection between network operators to support mobile services. The GSMA has led a range of industry initiatives to ensure network operators are aware of the risks and the mitigation options open to them to protect their networks and their customers.

The GSMA’s work and recommendations have been acknowledged by regulators around the world as being sufficient to eliminate the need for regulation.

The GSMA plays a key role in coordinating the industry response to security incidents and it has developed and launched a Coordinated Vulnerability Disclosure (CVD) programme. This allows the GSMA to work with a range of stakeholders, including its operator members, security researchers and industry suppliers, to ensure an appropriate response to threats that could affect services, networks or devices.

The GSMA’s Warning Advice and Reporting Point (WARP) helps coordinate the mobile ecosystem worldwide, and provides crucial support around security challenges. Drawing on the collective knowledge of mobile operators, vendors and security professionals, WARP collects and disseminates information and advice on security incidents within the mobile community — in a trusted and anonymised way. Stakeholders from the mobile ecosystem are encouraged to join WARP to collectively address the critical security issues faced by the industry, its partners and its customers.

GSMA’s Fraud and Security Group acts as a centre of expertise to drive the industry’s management of fraud and security matters. The group seeks to maintain or increase the protection of mobile operator technology and infrastructure, and customer identity, security and privacy, so that the industry’s reputation stays strong and mobile operators remain trusted partners in the ecosystem.

Debate

How secure are mobile voice and data technologies and what is being done to mitigate the risks?
Do emerging technologies and services create new opportunities for criminals?
What will the 5G security landscape look like?


Industry Position

The protection and privacy of customer communications is at the forefront of operators’ concerns.

The protection and privacy of customer communications is at the forefront of operators’ concerns.

The mobile industry makes every reasonable effort to protect the privacy and integrity of customer and network communications. The barriers to compromising mobile security are high and research into possible vulnerabilities has generally been technically quite complex.

While no security technology is guaranteed to be unbreakable, practical attacks on mobile services are rare, as they tend to require considerable resources, including specialised equipment, computer processing power and a high level of technical expertise beyond the capability of most people.

Reports of eavesdropping are not uncommon, but such attacks have not taken place on a wide scale, and UMTS and LTE networks are considerably better protected against eavesdropping risks than GSM networks. Moreover, 5G technology boasts a host of new security capabilities that further enhance protection levels.

The GSMA supports global security standards for emerging services and acknowledges the role that SIM-based secure elements have played in protecting users and mobile services because the SIM card has proven itself to be resilient to attack. The Embedded Universal Integrated Circuit Card (UICC) approach that has been defined by GSMA, and is being rolled out by industry, inherits the best security properties from the SIM and is designed to build on the protection levels achieved in the past.

The GSMA constantly monitors the activities of hacker groups, as well as researchers, innovators and a range of industry stakeholders, to improve the security of communications networks. Our ability to learn and adapt can be seen in the security improvements implemented from one generation of mobile technology to the next.

Resources

GSMA Security Accreditation Scheme website
GSMA Security Advice for Mobile Phone Users website
GSMA Coordinated Vulnerability Disclosure website
GSMA Warning Advice and Reporting Point Website