Telecommunication operators know that they need to follow the cloud ecosystem in adopting cloud APIs if they want to further monetize their network investments, but API and cloud security remain significant barriers toward that greater level of adoption.

The move toward telecom operators adopting APIs is based on a multi-billion-dollar opportunity. IDC predicts the worldwide telecom and network API market will be generating north of $6 billion in revenues per year by 2028. However, the firm has noted that the current lack of moving “the revenue needle” is beginning to show.

John Byrne, research VP for IDC’s Communications Service Provider Operations and Monetization practice, said during a recent webinar that early telecom efforts to dip their toes into the API revenue stream have been lackluster.

“What we haven’t seen so much is use cases and proofs of concept around the API sets that can provide more value like quality on demand, which is kind of the big driver here, but we haven’t seen a whole lot,” Byrne said.

Byrne did point to one “interesting use case” that involved U.S.-based carriers AT&T, Verizon, and T-Mobile US completing a test of an industry led cross-carrier API interoperability service targeted at helping operators derive more revenues from their data-rich 5G network architectures. That effort involved work with a drone manufacturer to use open APIs to support drone flight and management.

“Which is obviously something where you can’t afford to lose your connectivity,” Byrne said of the test. “And the concept was, can we all agree on the same standards and ensure that if my network is going out then I automatically go to my competitor’s network.”

Those recent carrier efforts have been based around the Open Gateway initiative that was launched last year by industry trade group GSMA. That initiative is targeted at standardizing network APIs that the telecom industry can offer to the developer and Application community to simplify revenue-generating interactions.

The Open Gateway initiative also builds on the open source Camara project GSMA launched in early 2022 with the Linux Foundation.

Markus Kümmerle, who works at Deutsche Telekom (DT) and on the Camara project, explained during a recent Senza Fili-hosted webinar that operator hesitation toward API adoption is based on a legacy mindset.

“It's new for the telco industry because for a long time the networks were seen as a black box and nobody wanted to touch it for security reasons,” Kümmerle said. “This has changed now because we see the urgentness of today's business cases to optimize and to use the information, which we have in the networks, and also the operators now are looking for additional means of revenue, so it's a win-win for both sides.”

Cloud API Security risks and regulations

However, API Security risks remain a significant hurdle.

The Cloud security alliance (CSA) recently ranked “insecure interfaces and APIs” as the third-most significant cybersecurity threat risk for 2024.

Recon Analytics Director Daryl Schoolar during the Senza Fili webinar said that his research on the matter has shown operators were somewhat averse to greater API adoption due to security concerns.

“We ask those that do have a strategy, and they say one of their biggest concerns after monetization is security, so it shows up everywhere,” Schoolar said, adding that the security concern is multifaceted.

“They're concerned about if there's an app and the app is highly adopted, it's going to become a target for nefarious people to use to try to hack to find information off the network. So the more successful it is, the bigger the risk,” Schoolar said. “They're also concerned about if they share their data with the app developer to make sure that data stays with the app developer and that app developer somehow the data doesn't get out from the app developer.”

Schoolar also pointed to concerns over stored data in the cloud, something that has become an increasingly point of contention for operators.

One of the most public points of concern was AT&T’s recent admission of customer data being accessed while stored in a third-party cloud provider’s facilities.

Rethink Research also recently chided Verizon subsidiary TracFone, which had to cough up $16 million in fines following a Federal Communications Commission (FCC) investigation into the carrier’s data protection and cybersecurity practices. Results of that investigation found that the data breaches involved exploitation of APIs.

“Verizon is making a habit of embarrassing security lapses that undermine its credentials as a provider of services in the area,” Rethink Research wrote. “This is reminiscent of the recent CrowdStrike debacle affecting Windows updates, which although not directly security related, raised the question of whether the vendor could be trusted as custodian of a customer’s network.”

Rethink did note that the Verizon/TracFone issue was a “small beer by comparison” to the CrowdStrike issue, “but it highlighted risks associated with network APIs.” The analyst firm also explained that the TracFone breach involved traditional network APIs and not once tied to the Open API initiative.

“Open APIs do not directly expand the threat surface in the jargon of the trade, but in practice may attract more attacks by making it easier for operators to exposure capabilities of their networks,” Rethink Research wrote, noting that many of these past issues were due to legacy practices.

“These APIs were largely developed on a piecemeal basis by, or for, a specific [mobile network operator] leading to duplication of effort and high integration complexity for developers seeking to deploy an application globally,” the firm added. “This complexity and cost-imposed friction precluded development of global API-based services for roaming users.”

Kümmerle said that DT is well aware of these concerns as well as how the multinational carrier deals with differing country regulations tied to security.

“It's a very big topic to follow the legal standards, and unfortunately they are different from country to country, and these laws are also not very clear. They open a lot of gray zones, so that's a difficult part of it,” Kümmerle said. “In the moment, we are very careful, so if there is a question … we rather tend to get the user consent so that we don't have an issue either.”