Skip to content

Securing modern telco networks#

AusNOG 2026 digest Program Core pick 3–4 September 2026

Slides Recording

Patrick Ohearn - AARNet Pty Ltd

Play the recording: Securing modern telco networks

  • Why: A practitioner's prioritized view of what actually matters in SP security right now — fundamentals, PQC, routing security, and the AI vulnerability-discovery wave — directly in the PM's network security core.
  • What: A survey of telco security practice, organized by layer: fundamentals (backups, SSO/RBAC, MFA on external paths, segmentation, per-device credentials, never sharing auth between corporate and telco domains, JIT access, one-time break-glass creds, jumphost controls); NOS hygiene (consistent config/software deployment, vendor hardening guides, disable telnet, CoPP/RE filters, alert on reboots and firmware/software changes, investigate all coredumps); supply chain (signed package updates, trusted computing, vetted suppliers, less second-hand gear, secure shipping); hardware (SecureBoot, physical security, real-time inventory change logging, passive asset monitoring, cameras); OSS/BSS (billing is a prime target, CDRs and metadata are espionage targets, JIT for external vendors/contractors, audit SaaS access). Notable current items: frontier-lab security models (Cisco, Juniper/HPE, Nokia working with frontier labs) have surfaced ~10,000 high/critical vulnerabilities; patch velocity is rising to fortnightly NOS updates; transport encryption should be pushed at L1 (OTNSec, WDM encryption) through L4; PQC is coming sooner than expected and impacts SecureBoot/package signing (potentially requiring new hardware) more than transport; routing security = RPKI, route filtering, BGP enforce-first-AS, OTC (RFC 9234), and ASPA (draft — APNIC support as of July 2026). Core message: fundamentals matter most; vendor QA is lagging; make encryption a purchase criterion.
  • How: A field-informed checklist rather than a single mechanism, closing with industry collaboration (peer telcos, ASD/Home Affairs, conference lists).
  • Where applicable: Broadly applicable to any SP/telco; the regulation references (SOCI/TSRMP, CI Fortify) are Australian-specific, but the technical content is general.