The identity shape of a telecoms operator
Telecoms identity is defined by the network it runs and the customers it serves:
- The network elements are administered constantly. Routers, switches, the OSS and BSS, the core — thousands of devices and systems, administered by engineers whose access is the keys to the network. Much of the network already relies on central AAA and remote administrative protocols, which makes identity and privileged-access control a natural enforcement point.
- The blast radius is national. A compromised administrative credential in a telecoms core doesn’t affect one company; it affects everyone who depends on the network. Operators are critical infrastructure by definition.
- Sensitive functions carry their own rules. Subscriber data, call records and lawful-intercept systems are among the most sensitive an operator holds, and access to them is scrutinised accordingly.
- Many operators are also providers. MVNOs, business customers and hosted services mean an operator often runs identity and security for others — a multi-tenant problem on top of its own.
A compromised administrative credential in a telecoms core doesn’t affect one company. It affects everyone who depends on the network.
Where the exposure concentrates
Telecoms risk concentrates on privileged administrative access to the network. Engineer accounts with broad reach into network elements, whose compromise is a national-scale event. Standing access to the core that accumulated and was never reviewed. Vendor and integrator access to network equipment, granted at commissioning and rarely revisited. And, for operators serving business customers, the challenge of keeping each customer’s identity data separate from the rest in a way that can be described to an auditor.
What the regulations ask for
No product confers compliance. But telecoms carries specific duties around access to critical network functions, and these are the ones that land on privileged access and its audit trail.
| Framework | What it expects of privileged access |
|---|---|
| NIS2 | Telecoms providers are essential entities, with strong multi-factor authentication, strict access control and incident detection expected across the network and its supporting systems |
| ISO/IEC 27001:2022 | Access control, authentication and privileged-access management across a large, critical estate |
| National telecoms security frameworks | Many jurisdictions impose specific access-control and supplier-security duties on operators; privileged access and its audit are central to them |
Where to start
1. Network device authentication
Put MFA on the network-device authentication paths Mirket can directly control. RADIUS-capable routers, switches, firewalls and network systems can use Mirket MFA without redesigning the device authentication model — which is the widest coverage of the estate for the least disruption.
2. PAM for core administration
Privileged access management injects credentials so engineers never hold them, and records every session to the OSS, BSS and core as video and searchable text.
Mirket PAM controls SSH, RDP, browser-based administration and RemoteApp or published desktop applications. That breadth matters here more than in most sectors, because a network element CLI, an OSS console and a management application are three different access paths to the same estate — and command policy can extend beyond SSH into supported browser CLI and RemoteApp command interfaces.
The rule isn’t which protocol an engineer connected with. It’s whether the session has a command line in it.
3. Access for the change window
Engineers should have access to the required network element for the change window — not simply because they belong to the operations team. Just-in-time access makes reaching a network element something that is requested for a stated window, approved by somebody else, and closed on the clock, with one identifier tying the request to the session recording.
4. Vendor and integrator access
Give equipment vendors and integrators access to the network elements they support through scoped, recorded sessions instead of broad standing access. Third-party and vendor access removes the VPN account that was issued at commissioning and never reviewed.
5. Detect the compromised or misused engineer account
Identity threat detection reads administrative behaviour against each account’s own baseline, so an engineer account authenticating or behaving outside its established pattern is visible even when the credential itself is valid.
6. If you deliver managed services, run them from one console
For operators providing managed identity or security services, Mirket’s multi-tenant platform keeps customer environments isolated while the operations team manages them from one console. Licences are drawn from a shared pool and billed monthly on usage, and remote support into a customer tenant is a switch that tenant controls.
What changes
| Today | With Mirket |
|---|---|
| Network-device authentication relies on static credentials | Supported network authentication paths gain MFA |
| Engineers hold privileged credentials for core systems | Credentials are vaulted and injected into authorised sessions |
| Network administration leaves incomplete evidence | Sessions are recorded and searchable |
| Engineers retain standing access outside change windows | PAM access can be approved for a defined window and expire |
| Vendor access is broad and difficult to review | Vendors receive scoped and recorded access to specific systems |
| CLI control ends once the session starts | Command policy can control supported SSH, browser CLI and RemoteApp command interfaces |
| A compromised engineer identity still looks legitimate | Behaviour is evaluated against the identity’s baseline |
| Managed customer environments create separate consoles | Multi-tenant operations run from one management plane with tenant isolation |
Related
Solutions — Session Control & Command Policy · Just-in-Time Access · VPN & Firewall MFA · Third-Party & Vendor Access · MSSP & Multi-Tenant
Products — Privileged Access Management · Multi-Factor Authentication · Identity Threat Detection & Response