The technological change and increasing digitalization lead to new complexities and attack surfaces relating to cyber attacks. Conventional security solutions such as antivirus software & firewalls are suitable to defend basic malware that is known & documented but insufficient in order to prevent today’s highly sophisticated, dynamic & targeted cyber attacks.
Analytical tools in the Cyber Defense Center detect attacks much more quickly than earlier resources were able to. The new tools scan both the company's infrastructure and the relevant public discussion on Twitter. Real-time analyses make it possible to initiate countermeasures quickly especially in case of attacks.
Social News Reader: Twitter feeds often report about new security leaks before any official agencies have been able to issue any warnings. With its Social News Reader, Deutsche Telekom scans tweets for relevant key words. The results are displayed in graphic form.
The security dashboard: Some 180 "honeypot" sensors in the Internet simulate vulnerabilities in cyberspace. The security dashboard shows the types of attacks that are taking place, the frequency with which they are occurring and the countries where they are originating. The 180 honeypots register about one million attacks per day.
Check for vulnerabilities: Deutsche Telekom operates more than 5,000 Web portals. All of its portals are automatically checked, on a weekly basis, for any vulnerabilities. When a vulnerability is discovered, the company's Cyber Emergency Response Team (CERT) responds immediately.
Security vulnerabilities, affecting all types of computers, become known on an ongoing basis, and manufacturers respond by issuing software updates. In server environments, such updates often have to be executed manually. The CERT informs system administrators regarding new updates and monitors their installation.
Security-relevant servers within the corporate network log all of their activities and any external requests they receive. Deutsche Telekom analyzes such log data for any anomalies, and is thereby able to detect hacker attacks very promptly. When certain specific behavior patterns are detected, a "hunter team" takes over and wards off any threats.
Honeypot: The company has more than 180 of these decoy traps online, which attract attacks by simulating security vulnerabilities. Able to simulate highly specific types of system weaknesses, such as smartphones with security flaws, they can reveal the ins and outs of attackers' strategies for exploiting vulnerabilities.
In order to deal with such cyber attacks, Deutsche Telekom and its Cyber Defense Center changed the focus from mere prevention measures to a holistic management approach. This approach combines prevention, detection and reaction capabilities while constantly developing highly specialized analysis methods being adapted to the changing cyber environment.
"The things you do to protect yourself against cyber attacks are sort of like the things you do to drive safely: make sure your "car" is up to date on its safety inspections, and keep your eyes on the "road" and on the "traffic situation". In addition to emphasizing such good preventive strategies, we also give high priority to smart analysis," notes Thomas Tschersich, Head of Group Security at Deutsche Telekom.
The Cyber Defense Center/CERT (CDC) of Deutsche Telekom operates international Cyber Security Incident Management for the entire Deutsche Telekom Group and provides services for customers.
The main objective is safeguarding and expanding the security procedures for our internal infrastructure as well as for our customers.
In addition, the Deutsche Telekom Cyber Defense Center/CERT is the international point of contact for issues surrounding Internet security and Internet crime, in cooperation with following organizations:
- Federal Office for Information Security (BSI)
- Federal Office for the Protection of the Constitution (BfV)
- European Union Agency for Network and Information Security (ENISA)
- European Union (EC)
- Federal Criminal Police Office (BKA)
- GSM Association (GSMA)
- European Telecommunications Informatics Services (ETIS)
- Forum for Incident Response and Security Teams (FIRST)
- Cyber Security Sharing and Analytics (CSSA)