Telco Security Alliance members AT&T, Singtel, and Telefónica are now sharing threat intelligence using AT&T Alien Labs Open Threat Exchange platform.

AT&T joined the group, which claims to be the first global security alliance between telecom operators, last year. Etisalat, Singtel, SoftBank, and Telefónica launched it in 2018. Softbank is not participating in threat intelligence sharing. And Etisalat will start sharing threat information in the future, said Karl Sigler, senior security research manager at Trustwave, which is the Singtel’s cybersecurity arm. Etisalat is “just ramping up their threat intelligence platform,” he added.

The three operators began sharing threat intelligence in January. AT&T, Singtel, and Telefónica collect information on billions of security incidents, indicators of compromise, and global attack campaigns daily from their customers’ products, IT environments, and individual endpoints. This anonymized data from their security operations centers and investigations is then pooled, using AT&T’s OTX platform. AT&T acquired this platform when it bought Alien Vault in 2018.

By pooling all of this information, telco customers receive more insight on new malware campaigns, for example, and gain a more global view of threats that that may impact their operations, the members say.

“For any threat-sharing program like this, it gives us a wider vision,” Sigler said. A single operator or internet service provider only sees a fraction of the threat landscape, he explained. “By collaborating with other people’s footprints and their vision as well, we get a wider vision of sharing. In addition to a wider vision, it gives us a deeper vision and gives us a contextual vision of that information coming in.”

From Trustwave’s perspective, “we are already getting a lot of information that we didn’t have before, and that goes directly into our products and how we analyze threats for our managed service customers,” he added.

In the future, the alliance enables more opportunities for telcos to collaborate on specific threats, said Jaime Blasco, assistant VP of product development at AT&T Cybersecurity. “We may find common threat actors or malware families that are affecting our customers, and we might say let’s focus on this particular threat and let’s put together a particular team to do this.”