Telecom giants band together to form new ISAC

Teamwork makes the dream work, even for telecommunications titans that want to heighten their defenses in the evolving cybersecurity threat landscape.

Last month, eight telecommunications giants joined forces to form the Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC). Founding member companies include:

• AT&T
• T-Mobile
• Verizon
• Charter
• Comcast
• Cox
• Lumen Technologies
• Zayo

Long time in the making. Some may recall that the National Coordinating Center for Communications (a.k.a., the COMM-ISAC) has long served as a way for telecoms to communicate about threats. However, AT&T CISO Rich Baich told IT Brew that the organization—which operates under CISA—has a broad focus, driving a need for the new C2 ISAC that’s even more cybersecurity-focused.

“We wanted to have something that was dedicated to the cyber threat landscape environment,” Baich, an inaugural chairperson of the ISAC, said. “So, the establishment of [the C2 ISAC] was really to get us focused concurrently, and sharing information, and providing guidance to our members of the ISAC and the general community.”

Baich said the C2 ISAC, which is a private entity, will allow for real-time information sharing and “coordinated defense” from member organizations.

“We have collectively come together to say we believe there’s greater strength and collective defense than individuality of the defense,” he said.

At risk. The formation of C2 comes less than two years after Chinese state-sponsored threat actor Salt Typhoon infiltrated nine telecommunications providers in what has been described as the largest telecommunications attack in US history.

The communications sector continues to face significant threats. In January, the FCC issued a public notice urging providers to “implement cybersecurity best practices to protect their networks” from ransomware attacks.

“Over the past year, the Commission has become aware of ransomware incidents involving small-to-medium sized communications companies that disrupted service, exposed information, and locked providers out of critical files,” the agency wrote.

For these reasons, some industry professionals are enthused about the latest addition to the ISAC community. Glen Deskin, head of engineering for vertical solutions at Check Point Software, told IT Brew the introduction of C2 is an “exciting” move for the industry and will allow for more candid discussions among companies now that they have a private sector-led forum.

“This gives the telecom industry a little bit more ability to share the information without feeling restricted in any way,” Deskin said. “I think that has been the challenge up to this point, and it can only benefit the entire industry.”

Big plans ahead. The C2 ISAC is expected to begin its operations in June. Baich said the new organization will look for ways to expand its footprint, establish technology that will help it to achieve its mission, and work alongside the government “to streamline and improve information sharing and fit into the larger critical infrastructure strategy for the country.”

“We’ll try to probably publish some industry practices to be shared,” Baich said. “We’ll probably have some additional interactions with the supply chain…because obviously we’re very much into the collective defense standpoint [and] we’re only going to be as good as our suppliers.”