CTIA, Wireless Carriers Say They're Adopting CSRIC Diameter Recommendations

Sprint, which is being bought by T-Mobile, didn't file. “As the wireless sector races to Standalone 5G, it is important to mitigate legacy risks, especially during the transition,” CTIA said: CSRIC’s recommendations “are a vital part of providers’ security efforts.” Stand-alone 5G won’t use diameter but instead hypertext transfer protocol secure (HTTPS) versions 2 and 3 to carry signaling information, the group said. Diameter security hasn’t been a problem, CTIA said: “CTIA and its members are still seeing few, if any, attacks ... [and] they typically occur overseas, which is a testament to the effectiveness of U.S. providers’ efforts.” While non-stand-alone deployments “will continue to rely on Diameter protocol, 5G security enhancements will result in a more secure user plane,” the group said. Verizon said it implemented most of the CSRIC best practices and continues to “refine our Diameter-related security practices.” Work continues, Verizon said, with “substantial cross-carrier collaboration and information sharing.” T-Mobile “implemented the carrier-specific recommendations that are applicable to its business and network architecture.” AT&T “shares the Commission’s interest in protecting Diameter from malicious actors and stands ready to work cooperatively, including providing more detailed information in an appropriate, confidential manner,” the carrier said.