PTA issues ‘Telecom Security Guidelines’

All telecommunication and Internet operators and service providers should develop and practice a communication plan for dealing with network security events, Pakistan Telecommunication Authority (PTA) said on Wednesday.

Stakeholders including network operators, service providers and equipment suppliers of telecommunication and Internet services should have the capabilities to analyze the source of malicious information traffic and its possible whereabouts of emergence.

With the development of telecommunication and information space across the world new types of security threats have emerged. Criminals are using telephone, Internet and mobile networks for committing various kinds of crimes categorized under electronic crimes.

It is imperative that the distributed information through communication systems and networks should be made attack resistant, by a combination of technical, organizational and legal measures.

In this regard, PTA’s expert group on Information and Computer Technologies (ICT) security in coordination with ICT Industry has issued ‘Telecom Security Guidelines’.

According to the guidelines, the active ICT security management could prevent damage and minimize the threat of massive financial damage of commercial and home users.

There, the communications plan should identify key players and include as a minimum contact names, business telephone numbers, residence telephone numbers, pager numbers, fax numbers, cell phone numbers, home addresses, Internet addresses, permanent bridge numbers, etc. Notification plans should be developed prior to an event/incident happening where necessary.

The plan should also include alternate communications channels such as alpha pagers, Internet, satellite phones, VOIP, private lines, blackberries, etc. The standard of procedures can and should be part of the overall business continuity/recovery plan. Where possible, the procedures should be exercised periodically revised as needed. Procedures should cover likely threats to those elements infrastructure, which are critical to service delivery/business continuity.

Telecommunication equipment suppliers should establish and use metrics to identify key areas and measure progress in improving quality, reliability, and security, the guidelines further stated.

Service providers should consider appropriate means for providing their customers with information about their traffic policies so that users should be informed when planning and utilizing their applications.

Equipment suppliers should work to establish operational standards and practices that support broadband capabilities and interoperability such as video, voice data and wireless.

Service providers should, for easy communication with subscribers and other operators and providers, use specific role-based accounts ([email protected], [email protected]) versus general accounts ([email protected]), which will help improve organisational response time and also reduce the impact of Spam.

Network operators and service providers should, where appropriate, design networks to minimize the impact of a single point of failure (SPOF). Network monitoring and operators should monitor the network to enable quick response to network issues.

Routing resiliency network operators should use virtual interfaces (router loopback address) for routing protocols and network management to maintain connectivity to the network element in the presence of physical interface outages.

Route aggregation network operators should aggregate routes where appropriate (singly-homed downstream networks) in order to minimise the size of the global routing table. Classless Inter-Domain Routing (CIDR) use network operators and service providers should enable CIDR by implementing classless route prefixes on routing elements.

Route flapping network operators should manage the volatility of route advertisements in order to maintain stable IP service and transport. Procedures and systems to manage and control route flapping at the network edge should be implemented.

Route policy network operators should have a route policy that is available, as appropriate. A consistent route policy facilitates network stability and inter-network troubleshooting.

Route database network operators should operate a route database. The database should provide the routing advertisement source from the network operator’s perspective. The database should be accessible by peers, customers and other users. The access can be via a web interface similar to the looking glass server’s or just telnet access. The database is informational only and cannot be used to effect or impact the actual routing table. The need to provide security and isolation to such a database is high.

Route registry database network operators and service providers should operate a route registry database of all the routes advertised by their network with the source of that advertisement. This database might be used as the source for interface configurations as well as troubleshooting problems. If an entity decides to operate a central route registry for a region or globally, the individual service provider database can communicate with that central repository forming a robust and efficient hierarchical system.

Source: DAILY TIMES

You can download the Guidlines from HERE

NOTE: If you happen to read this PDF, just observe the date MAY 06,2009 on the headlines. Isn’t it too early to publish this document?