3 ms·

> Since the early 2000s at least, most billing has been outsourced. This works by sending all Call Detail Records (CDRs) to a third party, often from Israel or

> Since the early 2000s at least, most billing has been outsourced. This works by sending all Call Detail Records (CDRs) to a third party, often from Israel or China. This is quite misleadingly written: telcos are not shipping reams of CDRs to some cubicle farm in Haifa or Chongqing. Yes, almost every telco outsources its billing software to other companies, notably Amdocs (founded in Israel, now HQ's in the US). However, billing info is some of the most sensitive data a telco has for both privacy and commercial reasons, so that software always runs in a closed environment from where it cannot dial home. Historically that's been on-prem, it's slowly moving to the Cloud but even there it's going to be firewalled off very carefully.

waheoo 6y ago
Oh yea, super secure, their outsourced security team is all over it.
sgt101 6y ago
There's a big gap between what happens in the larger telcos that run infrastructure, and the white label operators.
- tguvot 6y ago
  White label operators can't usually afford Amdocs solution from one side. From the other side, Amdocs doesn't have a server farm in Israel to do CDR processing :) Everything happens either on client premises (and Amdocs can deliver end-to-end solution, including buildout of complete datacenter if it required by client) or "in the cloud"
Thr0wawayDocs 6y ago
Let's not oversell the fact that Amdocs' official HQ is in the US: It's an Israeli company through and through. It did more development in the US back in 2001 than it does now: Today, their US footprint is mostly customer sites. And you will find people brought in from Israel everywhere. It's always been bad enough that managers that don't speak Hebrew knew they were always at a disadvantage. Your best bet for saying it's not an Israeli company is to say that a whole lot of R&D is being done in other countries with cheaper labor. While it's true that the installations are on-prem (having been to quite a few of those), Amdocs business model isn't about dropping code and going away: They are so embedded with your typical deployment that there's plenty of opportunity to exfiltrate data. Sending every CDR to Haifa? Probably not: The Sysadmins on your typical large telco are iffy, but not that iffy. And carefully firewalled? The talent was never great, and the security practices were never all that serious: I've been handed production shells that I had no business having, because it was convenient at the time. Once again, I'd say that the best argument to claim that there's no data exfiltration is that the people writing the code aren't good enough to do this under the customer's nose.
- tguvot 6y ago
  I was involved in some RF*s on Amdocs side for a bunch of telecoms in USA, Europe and Asia a few years ago. Security requirements were very long and rather reasonable, to a point that it was pain in the ass to follow all of it. Part of what we had to submit was deployment architecture that included security architecture that was reviewed by security teams. We also had some meetings with security teams which were more like serious interrogations (they just could go with waterboarding to speed up things). We even had as result of those discussion to alter somewhat product architecture (not "lets stick in tls". actual changes in how system works and interacts) in order to enable more secure deployment and operations. But those were Tier 1 telecoms. Smaller one probably less strict but I don't know as I didn't deal with them

waheoo 6y ago

Oh yea, super secure, their outsourced security team is all over it.

sgt101 6y ago

There's a big gap between what happens in the larger telcos that run infrastructure, and the white label operators.

tguvot 6y ago
White label operators can't usually afford Amdocs solution from one side. From the other side, Amdocs doesn't have a server farm in Israel to do CDR processing :) Everything happens either on client premises (and Amdocs can deliver end-to-end solution, including buildout of complete datacenter if it required by client) or "in the cloud"

Thr0wawayDocs 6y ago

Let's not oversell the fact that Amdocs' official HQ is in the US: It's an Israeli company through and through. It did more development in the US back in 2001 than it does now: Today, their US footprint is mostly customer sites. And you will find people brought in from Israel everywhere. It's always been bad enough that managers that don't speak Hebrew knew they were always at a disadvantage. Your best bet for saying it's not an Israeli company is to say that a whole lot of R&D is being done in other countries with cheaper labor. While it's true that the installations are on-prem (having been to quite a few of those), Amdocs business model isn't about dropping code and going away: They are so embedded with your typical deployment that there's plenty of opportunity to exfiltrate data. Sending every CDR to Haifa? Probably not: The Sysadmins on your typical large telco are iffy, but not that iffy. And carefully firewalled? The talent was never great, and the security practices were never all that serious: I've been handed production shells that I had no business having, because it was convenient at the time. Once again, I'd say that the best argument to claim that there's no data exfiltration is that the people writing the code aren't good enough to do this under the customer's nose.

tguvot 6y ago
I was involved in some RF*s on Amdocs side for a bunch of telecoms in USA, Europe and Asia a few years ago. Security requirements were very long and rather reasonable, to a point that it was pain in the ass to follow all of it. Part of what we had to submit was deployment architecture that included security architecture that was reviewed by security teams. We also had some meetings with security teams which were more like serious interrogations (they just could go with waterboarding to speed up things). We even had as result of those discussion to alter somewhat product architecture (not "lets stick in tls". actual changes in how system works and interacts) in order to enable more secure deployment and operations. But those were Tier 1 telecoms. Smaller one probably less strict but I don't know as I didn't deal with them