Cybersecurity Applications in Telecom Real-World Examples

-- Stores or agents with unusually many SIM replacements in 24 hours
SELECT store_id,
       agent_id,
       COUNT(*) AS swaps_24h
FROM sim_replacements
WHERE requested_at >= NOW() - INTERVAL '24 hours'
GROUP BY store_id, agent_id
HAVING COUNT(*) >= 15
ORDER BY swaps_24h DESC;

// KQL-style: SIM swap followed by password reset requests
SimChanges
| where TimeGenerated > ago(1d)
| join kind=inner (
    AccountEvents
    | where EventType == "PasswordResetRequest"
  ) on MSISDN
| where AccountEvents_TimeGenerated between (TimeGenerated .. (TimeGenerated + 2h))
| project MSISDN, SimChangeTime = TimeGenerated, ResetTime = AccountEvents_TimeGenerated

# Nginx: limit each client IP to 10 requests/second on a self-care API
limit_req_zone $binary_remote_addr zone=selfcare:10m rate=10r/s;

server {
    listen 443 ssl;
    server_name selfcare.example-telecom.in;

    location /api/ {
        limit_req zone=selfcare burst=20 nodelay;
        proxy_pass http://selfcare_backend;
    }
}

import pandas as pd

t = pd.read_csv("netflow_minute.csv", parse_dates=["minute"])
per_dst = t.groupby(["minute", "dst_ip"])["bytes"].sum().reset_index()
baseline = per_dst.groupby("dst_ip")["bytes"].median()

per_dst["ratio"] = per_dst.apply(lambda r: r["bytes"] / max(baseline[r["dst_ip"]], 1), axis=1)
spikes = per_dst[per_dst["ratio"] > 20]
print(spikes.sort_values("ratio", ascending=False).head(10))

-- Support view: masked mobile number and partial ID
CREATE VIEW support_subscriber_view AS
SELECT subscriber_id,
       LEFT(msisdn, 2) || 'XXXXXX' || RIGHT(msisdn, 2) AS msisdn_masked,
       'XXXX-XXXX-' || RIGHT(id_number, 4)              AS id_masked,
       plan_id,
       status
FROM subscribers;

GRANT SELECT ON support_subscriber_view TO support_role;
REVOKE SELECT ON subscribers FROM support_role;

-- Users who read an unusually high number of subscriber records today
SELECT db_user,
       COUNT(DISTINCT subscriber_id) AS records_read
FROM audit_subscriber_reads
WHERE read_at >= CURRENT_DATE
GROUP BY db_user
HAVING COUNT(DISTINCT subscriber_id) > 5000
ORDER BY records_read DESC;

Trigger: Customer reports losing signal + bank OTP misuse
1. Verify the customer through a secure channel
2. Check SIM change history for the number
3. Suspend the new SIM; restore to the verified customer
4. Inform the customer to contact their bank
5. Review the store/agent that processed the swap
6. Preserve logs for investigation
7. Update detection rules if a pattern is found

Trigger: Traffic to a service exceeds normal baseline
1. Confirm attack vs genuine spike (campaign, outage)
2. Identify target IPs, ports and traffic type
3. Enable scrubbing / upstream mitigation
4. Apply rate limits or WAF rules at the edge
5. Communicate status to service owners
6. Monitor until traffic returns to baseline
7. Write a post-incident review

Quarterly review — subscriber data
System:
Roles with access to unmasked data:
Users per role and justification:
Access removed this quarter:
Bulk access alerts and outcomes:
Sign-off: data owner + security