Telecom Network Security Guide: Signalling, Core Networks and Operator Credentials

Telecom networks still trust signalling messages and management credentials far more than their exposure justifies, and attackers have shown they can live inside a carrier core for years. SS7 and Diameter interconnects let any party with signalling access query or reroute subscribers, routers and switches run on shared secrets that are rarely rotated, and lawful intercept systems concentrate some of the most sensitive data a state holds. This guide covers signalling security for SS7, Diameter and GTP, signalling firewalls, SIM swap and number port-out controls, protection of lawful intercept and core management planes, and the lessons of the Salt Typhoon intrusions. It is written for operator security and network teams, MVNOs, IoT connectivity providers and enterprises that depend on carrier services.

Key takeaways

• Signalling is an attack surface, not plumbing. SS7, Diameter and GTP were designed for a closed club of operators; anyone who obtains interconnect access can attempt location tracking, interception and fraud, so every message from outside the home network needs screening.
• Signalling firewalls need continuous tuning. GSMA guidance (FS.11, FS.19, FS.20, FS.21) gives the baseline, but rules decay as roaming partners, test traffic and attack methods change.
• Network device credentials are the real crown jewels. Salt Typhoon mostly used valid logins, then harvested SNMP community strings, TACACS+ and RADIUS shared secrets and local accounts with weak password types.
• Customer account changes are security events. SIM changes and port-outs move a phone number, and with it any SMS one-time codes, to whoever convinces the agent or portal.
• Lawful intercept and the management plane need their own isolation. Out-of-band management, a separate AAA service with phishing-resistant MFA and centrally held configurations are the controls the December 2024 joint guidance put first.

The telecom attack surface: signalling, core and management

The GSMA security document set maps onto the first two planes: FS.07 analyses SS7 and SIGTRAN security, FS.11 covers SS7 interconnect monitoring and firewall rules, FS.19 describes Diameter attacks and countermeasures for LTE and 5G interconnection, FS.20 covers GTP attacks carried over GRX, IPX or the internet, FS.37 addresses GTP-U user-plane attacks, and FS.21 takes a risk-based approach including packet categorisation, protocol correlation and firewall implementation. These documents are available to GSMA members only, so this guide describes them at a high level. ENISA's 2018 study of interconnect signalling security assessed the area as carrying a medium to high level of risk, and nothing since has made the underlying trust model safer.

SS7, Diameter and GTP: what goes wrong

The common weakness across all three protocols is that a node accepts a message because it arrives over the interconnect and carries a plausible address, not because the sender is entitled to ask.

• SS7 (2G and 3G): MAP operations such as subscriber information queries, routing information requests for SMS and location updates are needed for roaming, but can reveal a subscriber's serving cell or let a third party register a fake serving node and receive SMS. Global Titles are the SS7 addresses that identify nodes; when they are leased or sub-allocated to third parties, the operator whose numbers they use loses sight of who is sending traffic.
• Diameter (4G and non-standalone 5G): Diameter replaced many MAP functions for LTE roaming (for example on the S6a interface between MME and HSS). It adds hop-by-hop transport security options, but in practice relies on the IPX and on origin host and realm checks, which can be spoofed. A Diameter Edge Agent concentrates interconnect traffic and is the natural enforcement point.
• GTP (data roaming): GTP-C (UDP 2123) sets up and manages data sessions and GTP-U (UDP 2152) carries user traffic. Exposed or poorly filtered GTP endpoints allow session hijack attempts, subscriber data leakage and denial of service against packet gateways.
• 5G standalone: the Security Edge Protection Proxy (SEPP) protects the N32 interface between operators with TLS and application-layer security, which closes many legacy gaps. It does not remove risk while SS7 and Diameter remain in service for fallback, roaming and SMS, which will be the case for years in most networks.

The UK regulator Ofcom has acted on one of the structural causes. Following its April 2025 decision, new Global Title leasing was banned immediately and existing leasing arrangements had to end by 22 April 2026, with two specific uses allowed to continue until 22 October 2026. Ofcom described the risks as interception of messages and calls, disruption of network operations and tracking the location of users on other networks. Operators elsewhere can apply the same principle contractually: no third party should originate signalling under your Global Titles.

Signalling firewalls and interconnect monitoring

A signalling firewall inspects SS7, Diameter and GTP traffic at the network edge and blocks or flags messages by category. GSMA guidance groups messages broadly into those that should never arrive from an external network, those that should only arrive for the operator's own subscribers who are roaming, and those that can only be judged by correlating with other information such as the subscriber's last known location. The third group is where most of the engineering effort and most of the false positives sit.

• Deploy in monitor mode first: run new rules in detection only for a defined period, review hits with the roaming team, then move to blocking by category, starting with messages that are never legitimate.
• Clean up the configuration: triage legacy, misconfigured and test partner entries into allowed or blocked; unmanaged exceptions are where attacks hide.
• Review on a cadence: GSMA material frames this as continuous work, not a one-off compliance exercise. A quarterly rule and partner review is a reasonable minimum, with shorter cycles for 5G and critical services.
• Protect SMS specifically: SMS home routing means routing information requests for SMS are answered by a proxy rather than revealing the subscriber's real identifiers and serving node.

Hardening the core and management plane

The December 2024 joint guidance from CISA, NSA, FBI and partner agencies in Australia, Canada and New Zealand, "Enhanced Visibility and Hardening Guidance for Communications Infrastructure", was published in response to the Salt Typhoon intrusions and remains the most practical baseline for carrier router and switch estates.

Edge and network appliances are a recurring entry point across sectors. See the Edge Device Security Guide and the Network Segmentation Guide.

Operator credentials: where identity fits

Carrier networks run on machine credentials. Every router holds SNMP community strings or SNMPv3 users, TACACS+ or RADIUS shared secrets, local emergency accounts, SSH host and user keys, API tokens for orchestration and element managers, and certificates for Diameter and SEPP peers. Cisco Talos's analysis of Salt Typhoon, summarised on our Salt Typhoon telecom intrusions page, found that in all but one investigated case the attackers entered with legitimate victim credentials, then captured SNMP, TACACS and RADIUS traffic to obtain shared secrets, exfiltrated device configurations over TFTP and FTP, and abused local accounts whose weak password types can be decrypted offline.

• Inventory machine credentials per device: community strings, AAA shared secrets, local accounts and their password type, SSH authorised keys and peer certificates. Treat each as a non-human identity with an owner and rotation date. See the Telecoms Identity Security Guide.
• Rotate on a schedule and after any incident: shared secrets that are common across thousands of devices mean one stolen configuration exposes the estate. Unique secrets per device or per region limit the blast radius.
• Separate administrator identity from corporate identity: the joint guidance recommends an AAA service with MFA separate from the corporate identity store, so a compromised office directory does not hand over the network.
• Alert on identity changes on devices: new local accounts, changed AAA server addresses, new SSH authorised keys and changed SNMP strings were all Salt Typhoon persistence methods.

SIM swap and number port-out fraud controls

A SIM change or a number port-out moves control of a phone number. For customers, that means losing calls and, more seriously, SMS one-time codes for banking, email and enterprise accounts. These requests are processed by care agents, retail staff and self-service portals, so the controls are a mix of authentication policy, process and monitoring.

• Strong authentication before the change: do not rely on biographical details, account numbers, recent payment amounts or call details that a fraudster can obtain. Use authentication in the existing customer app, a one-time code to the current device, or in-person photo ID checks.
• Customer-set locks: offer a port-out or SIM change lock that the customer must remove through a strongly authenticated channel.
• Notification to the old channel: notify the customer on the existing number and address of record, never only on the new contact details.
• Agent controls: agents should not see account data before the customer is authenticated, override rights should be limited and logged, and fraud-specific training should be mandatory.

In the United States, the FCC's 2023 rules added CPNI and number-porting requirements. The current eCFR text of 47 CFR 64.2010(h) requires secure authentication before a SIM change and annual review of methods, and 47 CFR 52.37 requires secure authentication and staff training for port-out requests; both sections state that compliance with some parts is not required until a compliance date is announced, so check the current status before relying on them. For enterprise-side defences, see the SIM Swap Fraud Guide and the MFA Fatigue and Bypass Guide.

Protecting lawful intercept systems

Lawful intercept (LI) platforms receive warrants or court orders, provision intercepts on network elements and deliver content and metadata to law enforcement. A compromise exposes who is under investigation as well as the intercepted data. The FBI and CISA stated in November 2024 that PRC-affiliated actors had stolen customer call records, accessed private communications of a limited number of people mainly involved in government or political activity, and copied certain information subject to US law enforcement requests made under court orders.

• Isolate the LI environment: dedicated network segments, separate administrative accounts and workstations, and no shared AAA with general network operations.
• Minimise standing access: few named administrators, just-in-time elevation and dual control for provisioning changes.
• Log everything about intercept provisioning: who activated or changed an intercept, on which element, and whether it matched an authorised order; reconcile active intercepts against the order register regularly.

Regulation and assurance

Detection and measurement

• Signalling telemetry: firewall hits by message category, source Global Title or realm and partner; location query rates per subscriber; correlation failures (impossible travel between serving networks).
• Device and AAA telemetry: AAA logs centralised over an encrypted channel; alerts on configuration changes outside change management, new local accounts, changed AAA server addresses, new SSH keys, SSH on non-standard ports and new GRE or other tunnels.
• Customer account events: SIM change and port-out volumes per channel, per store and per agent, and the share preceded by a failed authentication attempt.

Metrics that show the programme is working:

1. Percentage of interconnect links (SS7, Diameter, GTP) passing through a signalling firewall in blocking mode.
2. Days since the last signalling rule and roaming partner review.
3. Percentage of network devices with unique AAA secrets and SNMPv3 only, and median age of shared secrets.
4. Percentage of devices whose running configuration matches the central golden configuration.
5. SIM change and port-out fraud rate per 100,000 requests, and percentage of requests authenticated without knowledge-based questions.
6. Percentage of active lawful intercepts reconciled to an authorised order in the last cycle.

Implementation roadmap

1. Map exposure (weeks 1 to 4): list every interconnect link and partner, every Global Title and Diameter realm you own, every management interface reachable outside the out-of-band network, and every machine credential class on devices.
2. Close the obvious gaps (months 1 to 3): disable Smart Install, Telnet, HTTP management and SNMP v1/v2c; move passwords to Type 8; restrict VTY access; ensure all interconnect links pass the signalling firewall, even in monitor mode.
3. Rebuild management identity (months 2 to 6): deploy a separate AAA service with phishing-resistant MFA, rotate AAA and SNMP secrets to unique values, cut local accounts to emergency use with post-use rotation.
4. Move signalling to blocking (months 3 to 9): promote rule categories from monitor to block in order of confidence, with roaming team sign-off and a documented rollback (switch the category back to monitor) if partner traffic breaks.
5. Harden customer channels (in parallel): remove knowledge-based authentication for SIM change and port-out, add locks and notifications, and pilot in one region or channel before full rollout.
6. Assure and repeat: quarterly signalling reviews, configuration drift reports, intercept reconciliation and an annual red team or signalling penetration test by an authorised provider.

Decision guidance

• Large mobile network operators: need an in-line signalling firewall on all SS7, Diameter and GTP links, a SEPP for 5G standalone roaming, a dedicated signalling security team and their own threat intelligence.
• Smaller operators and MVNOs: often rely on a host network or IPX provider for signalling protection. Make the scope of that protection a contractual term and ask for regular reports, rather than assuming it exists.
• Enterprises consuming carrier services: you cannot fix signalling, but you can stop depending on it. Move away from SMS for authentication, use carrier account PINs and port locks for corporate numbers, and treat carrier-managed routers on your premises as third-party devices.

Common failure patterns

• Firewall in permanent monitor mode: rules deployed for compliance but never moved to blocking, so attacks are logged and allowed.
• One shared secret for the whole estate: a single TACACS+ key or SNMP community across thousands of devices, so one stolen configuration file unlocks everything, as the Salt Typhoon telecom intrusions showed.
• Old protocols left on: Smart Install, Telnet and SNMP v2c enabled years after they were needed. Talos found one Salt Typhoon case that likely used CVE-2018-0171 in Cisco Smart Install.
• Device as source of truth: no central golden configuration, so attacker changes to ACLs, AAA servers and local accounts persist unnoticed for years.
• Care agents as the weakest authentication factor: SIM changes approved on the strength of a date of birth and address, defeating the customer's MFA.

Framework mapping

Practitioner checklist

• Confirm every SS7, Diameter and GTP interconnect link passes through a signalling firewall, and record which categories are in blocking mode.
• Review roaming partner and Global Title allow lists at least quarterly and remove test and legacy entries.
• Disable Smart Install, Telnet, HTTP management, TFTP and SNMP v1/v2c across the router and switch estate.
• Move device administration to an out-of-band network with a separate AAA service and phishing-resistant MFA.
• Replace shared AAA and SNMP secrets with unique, rotated values and remove Type 5 and Type 7 passwords.
• Hold golden configurations centrally and alert on drift, new local accounts, changed AAA servers and new SSH keys.
• Remove knowledge-based authentication from SIM change and port-out flows and offer customer locks with notification to the old channel.
• Isolate lawful intercept systems and reconcile active intercepts against authorised orders every cycle.

Standards and references

• CISA, NSA, FBI and partners: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• GSMA: Interworking Security (FS.07, FS.11, FS.19, FS.20, FS.21, FS.37)
• ENISA: Signalling Security in Telecom SS7/Diameter/5G
• NIST: SP 800-187 Guide to LTE Security
• Ofcom: Global Titles and Mobile Network Security
• eCFR: 47 CFR Part 64 Subpart U, Customer Proprietary Network Information
• Federal Register: FCC Order on Reconsideration rescinding the CALEA Declaratory Ruling
• UK Legislation: Telecommunications (Security) Act 2021

Related NHI Mgmt Group resources: Telecoms Identity Security Guide · Salt Typhoon Threat Actor Profile · SIM Swap Fraud Guide · Edge Device Security Guide · OT Security Guide