Testing

Category: Featured

  • Key is to ask the ‘right questions’

    Key is to ask the ‘right questions’

    “In school, we’re rewarded for having the answer, not for asking a good question”

    This quote from Richard Saul Wurman rightly describes how a normal human mind, as part of it’s social development process, adapts to the guidelines of “finding the answers”, rather than exploring the possibilities of asking the “right questions”.

    And this mindset also reflects in our place of work. We are humanly tailored to explore satisfaction in having answers to all the questions. And in the process of being ‘answer ready’, we tend to become left brain heavy than the right. We become target driven and focus less and less on fresh set of questions which could challenge us further to drive improvement and innovation.

    Fraud Management ‘function’ is no different. Being a ‘revenue protection’ function in a large ‘organization’ it is expected to act similar to a small, but important organ in human body.
    Like hormone levels of an organ, health of an FM function is also measured in terms of subjective financial targets – either monthly, quarterly or yearly. And the corrective action starts when the achievements are found to be ‘less than optimum’.

    But, as an experienced doctor would say – It’s the lifestyle you need to keep in check and not hormone levels to remain healthy!
    Constant self-assessing questions such as – “Am I eating right ?”, “Am I sleeping right ?”, “Am I sitting right ?”, “Am I exercising right ?” etc. go a long way in guaranteeing you a healthy life. Periodic check-ups then becomes a method to confirm your good health rather than just means to detect illness or deficiencies.

    Keeping healthy is a continuous process – be it human body or fraud management. It is actually a practice, than just a function.
    And to setup a continuously improving fraud practice in your organization it is essential to keep asking relevant & timely questions across the following 8 pillars of this practice:

    • Influence
    • Organization
    • People
    • Process
    • Tools
    • Knowledge Management
    • Coverage
    • Continuous Improvement

    While the questions could be an organization, risk or region specific, I personally always start with the following:

    Influence:

    • Is our FM function on a driver seat or secondary role and working as a support function ?
    • How should we enhance the influence of our FM function ?
    • How do we keep showcasing enhanced value from FM function ?
    • How do we extend our internal & external interfacing and make the existing interfacing stronger ?

    Organization:

    • How do we ensure fraud awareness keeps pace with the upgrading business dynamics ?
    • How do we enhance internal & external collaboration with FM function ?
    • How do we get higher return of investment from FM function ?
    • How to further reduce the fraud impact on the bottom line ?
    • How to make our fraud management practice more proactive ?

    People:

    • Is resource acquisition better or resource development ?
    • How do we safeguard ourselves from attrition ?
    • Is our team structure agile enough while following industry standards ?
    • Do we have all the required roles and are the responsibilities clearly defined ?
    • Are we right, under or over staffed ?

    Process:

    • Are my processes effective and easily exercisable ?
    • Are my processes future ready ?
    • Are my processes agile enough to adapt to any changes with acceptable TAT ?
    • Are we adopting and implementing industry best practices ?
    • What parts of my processes can be automated ?

    Tools:

    • Is the Fraud Management tool adapted to my business environment ?
    • How do I ensure that the FM tool is fed accurate, complete and timely data ?
    • Are my fraud controls effective & efficient ? How do I reduce false positives ?
    • How do I ensure 100% automated fraud risk coverage ?
    • What capabilities do we need to acquire on tool front to be future ready ?
    • Are we ready against enormous data surge likely to be seen over next few years ? How do we benefit from it ?
    • Are we constantly learning from the industry in terms of fraud detection & prevention methods ?

    Knowledge Management:

    • Is there sufficient attention on upgrading to the required skill sets ?
    • How do we enhance resource competency & knowledge against current & future services ?
    • Is our team keeping pace with constant fraud mutations ?
    • Is our team using the tools effectively & efficiently ?
    • Is our team knowledgeable and comfortable with processes ?
    • What are the top 5 areas of learning for the whole fraud function ?

    Coverage:

    • Are we aware of all the fraud risks we are exposed to ? What is our current coverage levels ?
    • Do we know the gaps in terms of fraud risks coverage ? How can we improve ?
    • What is our strategy to become compliant to fraud risks introduced by new products and services ?
    • Are we ready for fast converging cross industry environment and the risks it introduces ?
    • What is our stand on customer and partner only risks ? How relevant they are for our business ? Is our current stand obsolete ?

    Continuous Improvement:

    • What is our performance management strategy ?
    • Do we have effective KPIs ? Are these business relevant ?
    • How can we improve the fraud function’s effectiveness & maturity continuously ?
    • What metrics should I use to measure health of the overall FM function ?
    • Are we conducting sufficient & periodic RCA & decision analysis ?
    • How do we gather accumulated wisdom & actionable intelligence for improvement ?

    Each of these questions can be a healthy point of discussion within your organization.
    While these may give you a first hand view of health of your current fraud practice, more importantly, it may also open doors for a much detailed open table introspective sessions, enabling you to come up with much better & effective questions.

    Remember, the key to remain healthy is to keep asking the ‘right’ questions.

    As Albert Einstein rightly said – “If I had an hour to solve a problem and my life depended on the solution, I would spend the first 55 minutes determining the proper question to ask, for once I know the proper question, I could solve the problem in less than five minutes.”

  • The threat of Signaling!

    The threat of Signaling!

    Signaling level risks, specially fraudulent accesses from connected SS7 networks, is one area which is making a lot of noise in the assurance and security functions of Telecom organizations today.
    The focus on the matter is such that most of the industry conferences talking about the current and next gen threats have a lot of matter being presented and shared on this topic – both from the operators and vendors alike.

    What is it ?
    The signaling level risks generally refer to SS7 (2G/3G) and Diameter (4G) level vulnerabilities (inherent or configuration based) which exposes operators to hacks/frauds through signaling control commands specially in roaming and interconnect scenarios. The scenario becomes more risky considering a normally configured SS7 infrastructure of an operator is accessible to any other operator in this world, either directly or through certain number of hops.
    Now, just consider a situation where a rogue operator exists or a group of hackers with a malicious intent have got access to SS7 signaling of any less-secure operator in this world.
    The losses due to signaling risks, while are still quite speculative, are expected to run in billions every year. Artificial inflation of traffic (specially A2P & P2A SMSes), Spamming, Spoofing, Refiling, profile modification, unlawful tracking, unethical disruptive activities from competition etc. are examples of some risks which have been found to be existing NOW with an estimated 100% infection rate.

    Why is it happening ?
    The SS7 signaling based vulnerabilities have been existing since very long, but have become part of news headlines recently due to certain revelations made by famous ethical hackers at certain high profile security conferences.
    Some industry pundits make a point, which most of my industry connections agree with, is that these risks exist mostly due to the fact that operators tend to create unreliable partnerships and configure unregulated access (like open GT access, acceptance of any signaling command etc.) which enables malicious parties to connect to operators networks and conduct fraudulent activities very easily.
    There have also been discussions around existence of services exploiting these signaling level vulnerabilities being offered in the grey markets through rougue hacking communities for a price.

    Can you eradicate these risks ?
    Ideal Solution: Operators need to sanitize their access configuration on SS7. Rethink, Reidentify, Reevaluate and Reconfigure the access levels.
    But this is really difficult or maybe nearly impossible to achieve due to some practical issues on the ground, such as:

    • Most of the SS7 networks were configured long time back – There is an expertise issue operators are facing wrt SS7 networks now which limits their capability in terms of reconfiguration of SS7 based networks
    • It is a time consuming activity, which, would also lead to a lot of efforts on re-testing connectivity with all the partners, attracting a lot of investment
    • It may lead to reconfiguration of the signaling level configuration at the network level, and in certain instances, would require network downtime – A complete NO-NO for a lot of players out there. Situation becomes even more problematic for countries where Telecom Networks are considered a National Infrastructure.
    • Lastly, not every operator will take up this activity for many different reasons including the reasons like operators not participating in the awareness meetings/conferences being organized around the world or even like some rogue operators participating in malicious activities deliberately.

    The problem becomes much more trickier from the fact that even one infected, unsecure or rogue operator in the world will continue to pose a threat to everyone else. And sanitizing each operator against these threats is a feat which is very unlikely to be achieved.

    It is now unanimously being accepted that SS7 signal based networks are here to stay (atleast 10 years in developed markets and 20-25 in developing or lesser developed countries) and even their vulnerabilities, which are expected to grow by huge amounts considering the limelight it has received recently.

    The bigger problem which has started giving sleepless nights to the fraud & security functions in operators moving towards 4G and setting up their networks over diameter protocol (provides 4G signaling framework) does not have native security standards inbuilt, but requires security mechanisms to be implemented on top, a practice always found susceptible to gaps). Also, the access methods are similar to SS7, so it exposes 4G networks to similar signaling risks as SS7.

    What can be done now ?
    For now, an approach of detection would be ideal until the industry identifies a way to plug these vulnerabilities around the world, which is definitely a few years away with a lot of research hours of investment.
    An approach of detecting malicious signaling requests in your network still has few complexities to manage:

    • High false positive rates – A lot of signaling requests appearing to be malicious come out as configuration issues from the partners. Hence, domain expertise is essential to filter out ‘needle from the haystack’.
    • Sheer size of signaling data to be analyzed – big data support is required.
    • Skill set – This activity will surely require a knowledge upscaling and may be difficult for the traditional teams like fraud and risk management to absorb. Even teams like security, with less focus on fraud domain know how, is expected to find it difficult to add this activity in their set of responsibilities.

    I feel industry partnerships with vendors, possessing both the domain knowledge, right skill set and technology built on big data platform is the way to go.

    These partnerships, considering no-one has a complete answer to this rampant problem of signaling vulnerabilities as of now, need to be built on solid vendor capabilities, while being both liberal and experimental to give room for exploration.

  • Factors Complicating Assurance in 4G Environments

    Factors Complicating Assurance in 4G Environments

    GSMA has a vision for 2020 for Telecommunications Industry around connected living which focuses on main pillars which are expected to drive the industry forward, namely – Network 2020, Personal Data, Internet of Things and Digital Commerce.

    As per my view, the single most important take away from that vision is the rise of Telco 2.0.

    Telco 2.0 are those telecom operators which are expected to expand transformationally by taking risks to chase higher rewards in both known and as yet unknown new parts of the value chain. These are expected to be the most advanced & disruptive Telecom Operators.

    Telco-2.0

    The most important enabler of these, so called, Telco 2.0 operators would be the ‘platform’ which would allow them to explore & experiment with those unknowns and expand services while ensuring higher customer experience which will help them achieve that visionary status.

    One of such platforms is 4G, which riding on the inability of 3G-3.5G networks in delivering the required quality of service, has shown tremendous adoption rate within operators over the years.

    What has made 4G enabled networks so popular is its proven capability as an ideal platform for cross domain services convergence & all access technologies.

    A comparison between 4G LTE & HSPA (~3G) based network and service delivery capabilities can be seen below:

    consumer-content

    The bitmap above also provides a crude reasoning around lower adoption rate of certain services which were also rolled out over 3G enabled networks, but did not meet the consumer expectations around quality, reliability and price.

    4G based networks provide the ability to the operators to become the ‘Real’ converged service providers, which until 3G was more theory than practicality. Operators are now becoming OTT service providers including communication, social media, social network, content, advertisement etc., connected living enablers, enterprise enablers etc. which was, until now, being offered mostly by 3rd parties.

    With operator owning the converged service offerings (or at-least controlling some part of the service delivery like quality etc.), the increase in traffic over its pipes has shown potential of increase in direct revenues, that too proportionately.

    Factors influencing complexity in 4G environment

    Yes. 4G is great! But, not without the share of complexities it injects in the area of assurance (RA & Fraud) operations.

    The following variables are identified to be the main influencers with respect to complexity and uncertainty in 4G environments:

    New Network Elements

    4G introduces new set of network elements and O/BSS systems generally being customized in terms of design or implementation as per the operator raising concerns around interfacing, data availability or quality. This also points to increase in complexity & volume of RA & FM activities to be performed due to increased data sources and controls.

    Also, a lot of components in 4G implementations are still not COTS and provide different logging & access levels which raising concerns around capability around identification of internal frauds and external access attempts/brute force attacks.

    Parallel Networks

    Traditional networks including certain components adopted from 2G, 3G environment and running in parallel to enable backward compatibility and interconnection leads to further increase in risk, complexity and number of controls to be managed.

    Non Standard Implementations

    Some areas of 4G network, O/BSS systems and interface partnerships (operator, content providers etc.) are being implemented in customized non-standard fashion to enable interconnections (including roaming approach) and support complex products and service offerings (like VoLTE or VoLTE roaming etc.). The situation is more of an experiment and working towards developing a standard rather than following one.

    Lack of reference 4G RA & FM practices combined with custom implementations, RA & FM activities are expected to be driven by non standard data sets and frequencies until stability/maturity.

    Initially in 4G space, RA & FM practices may be exposed to the scenario of ‘Incident induced learning’ or ‘reactive RA & FM’.

    Higher Convergence

    Higher convergence of ‘core’ telecom operator provided services introduces more ‘direct’ risks to the operator and an increased need to manage RA & fraud risks introduced by the new services, which in an earlier setting, was a headache of the third party service provider.

    New Pricing Models

    Conversion to charging policies from minutes to bytes (sessions) and bytes to service subscription & access mixed with complex bundling packs & rate plans is expected to change the traditional mindset of conducting RA & FM, especially around charging, discounting, billing & invoicing.

    Disruptive roaming charging policies are also expected to be introduced which will change the perspective further.

    For session based charging policy, verification of policy implementation is also expected to impose its own set of challenges.

    Complex service offerings

    Telecom operators are going beyond their traditional service offerings (Apart from voice and data – TV / content / cloud etc.) and venturing into the modern areas revenue generation such as content, advertisements, connected living etc.

    Rich content (VoD, music, messgaging, magazines etc.) management & delivery to become the fulcrum 4G revenues. Also, with various channels of content delivery at hand, advertisement revenues will also play an important role for mature 4G operators

    But, service based subscriptions, validity & dynamic delivery along with innovative & complex content and partner agreements are expected to complicate the RA & FM activities like never before.

    Increase in transaction volumes

    4G subscriptions is expected to increase 3.5 folds to 1.3 billion and data traffic by 6 folds to 17 Exabytes by Dec 2018. Operators will be dealing with many fold increase in data per unit of earned Revenue.

    Considering revenues are tied to data sessions, transaction volume mgmt. for the purpose of RA & FM is expected to introduce a big challenges and would require advance data treatment, management & analysis techniques (e.g. Big data).

    Responsiveness & Scalability is expected to be one of the main talking points with respect to volume management

    Rapid Product & Services Launch

    New product, package and service launch across the breath of 4G enabled service platforms are expected to see a considerable rise in throughput due to shortened development, delivery & release cycle.

    The agility of RA & FM departments in terms of proactive assessment and risk readiness is expected to keep pace with the higher number of products, services and packages being launched at the breakneck speed across the breath of business offerings

    Margin Management & Revenue Enhancement

    With increased competition, Revenues are expected to be driven by high volumes and low margins and not high margins. Product performance measurement in terms of adoption and revenue generation against target will have to be carried out at much higher frequency.

    With RA having and access to all cost items, charging, payins/payouts, usage records, quality parameters and first visibility to trends and anomalies, margin management and revenue enhancement activities are expected to take center stage

    Skill set and technology within the team will have to be enhanced or absorbed to enable and handle increased cross functional interfacing , analytics and product management

    Lack of Skill Set

    Lack of mature reference 4G implementations is also expected to lead to lack of required skill set which is needed to manage and continuously improve the RA & FM operations. There will be focus on more laborious, reactive & risk prone approach of skill ‘creation’ rather than ‘absorption’

    Updated Network Access Authentication Methods

    Operators need risk readiness against newer authentication methods which are different for different services – ISIM, USIM, Single Sign On etc. Considering device authentication & security is in the hands of the manufacturer or the OS provider,  any security flaw is a direct risk to the subscriber base of the operator

    Also, 3rd party firmwares & apps are readily available for the assistance of hackers. This situation increases the device or OS takeover further.

    Increased UE & CPE Types

    Exponential increase in multi vendor UE & CPE types has increased user exposure to IP frauds like takeovers (Accounts or UE) enhanced by ‘easy’ service access methods such as ‘single sign on’ for single or multiple services.

    While user equipments are highly exposed to malicious Apps, URLs, Malwares etc., readily available custom firmware for Customer Premise Equipment are found to expose them to the same level of risks.

    To top it off, high profile sensitive customer information hacking cases by external sources are on the rise both against individual subscriber and enterprise networks, calling for much more robust, secure and continuously improving infrastructure and detection capabilities.

    Power user exploits

    Power users or technology aware users are expected to exploit any loopholes in the implementation of service access, newer pricing models etc. through the use of various complex techniques such as URL masking etc. to bypass charging and gain free access to services

    Spoofing or device configuration updates like MAC Address may also gain popularity to help divert charging to someone else in absence of adequate authentication and multi level device binding mechanisms

     

    Movement to 4G or a higher capability environment is inevitable.

    I believe, if traditional approach to manage RA & FM operations is continued as it is even for 4G environments, these functions are expected to attract steep investments to manage complexity factors mentioned above (including increase in network elements & O/BSS systems, data streams, data loads, controls, resourcing, technology requirements etc.).

    There is an immediate need of shifting from current mindset and adopting “Smart” & “Agile” RA & FM practices across the operational spectrum (of people, process, measurement, organization & technology) to contain costs and risks much more efficiently.

    Taking a cue from Game of Thrones – “Winter is coming! and this one will be long. God help us all if we’re not ready!”