Why 5G security operations needs its own discipline

Enterprise IT vs Telecom SOC

Enterprise IT security operations and telecom security operations share fundamentals (SIEM, alerting, hunting, incident response) but differ in important specifics. Enterprise IT typically defends against attacks targeting workstations, servers, applications, and IT-side infrastructure. The protocols are familiar — TCP/IP, HTTP, SQL, Windows authentication. Threat models are well-understood and threat intel is widely shared. Telecom SOC defends a live mobile network — protocols are 5G NR, NGAP, NAS, SBI, GTP, PFCP, Diameter, sometimes SS7. Threat models include attacks specific to mobile…