--- title: How the NIST Cybersecurity Framework Supports Fighting Telecom - ECG description: The NIST Cybersecurity Framework is Powerful thinking tool for fighting Telecom Fraud This article provides a guide you can use to lead a one-hour discussi image: https://www.ecg.co/hubfs/Imported_Blog_Media/regular_nick-fewings-rEqx_Q2-g2s-unsplash-1.jpg --- [![ECG](https://www.ecg.co/hubfs/lp/cloud-migration/logo-vector.svg)](https://www.ecg.co) - Who We Are Company [**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers) Industries We Serve [**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers) - Technologies **Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect **Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling **Unified Communications & Collaboration** UC capabilities & platform expertise **Platform Reliability & Security** Infrastructure, capture & network fundamentals ### Carrier & Trunking Services Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording. [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) ### Compliance & Call Authentication Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling. [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) ### Unified Communications & Collaboration Modern UC capabilities backed by deep, hands-on expertise across every major voice platform. [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) ### Platform Reliability & Security The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day. [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) - How We Do It Services [**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering) - Resources #### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator) #### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library) #### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog) - [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) Who We Are [About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers) Industries We Serve [Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers) Technologies Carrier & Trunking Services [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) Compliance & Call Authentication [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) Unified Communications & Collaboration [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) Platform Reliability & Security [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) How We Do It Services [Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) Resources [Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog) [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) # How the NIST Cybersecurity Framework Supports Fighting Telecom Fraud By: Mark Lindsey 3 min read Jun 10, 2020 ## The NIST Cybersecurity Framework is Powerful thinking tool for fighting Telecom Fraud This article provides a guide you can use to lead a one-hour discussion to improve your ability to fight fraud in a Voice network. ## What is the NIST CyberSecurity Framework (CSF)? The CSF was developed by the US Federal Government to assist the government and private enterprise in developing their cybersecurity maturity. Many organizations use it as part of a thorough audit and assessment process to identify weak spots and prepare reports for their customers and partners. Just because you *can* use the CSF as part of a large process, don't miss the usefulness as part of a quick, tactical conversation on specific types of vulnerabilities. As reported in February 2019 by [Cloud Age Solutions, telecom fraud costs Service Providers billions of dollars per year -- between 1% and 2% of total revenue](https://cloudagesolutions.com/2020/02/25/protect-your-profits-with-these-voice-fraud-mitigation-best-practices/). That makes fraud -- especially on VoIP systems -- a major business issue. Fraud is also a Cybersecurity issue; unfortunately, cybersecurity in the Voice space is remarkably weak: hence the $28 billion in loss each year. ## Applying the Framework The remainder of this article shows how you can leverage the CSF to target the specific, costly problem of telecom fraud. You can use these questions to drive your discussion and planning to have a discipline and effective approach.   ![](https://www.ecg.co/hubfs/Imported_Blog_Media/content_framework_functions_wheel-1-1.png) ## ID: Identify. - What are the services through which calls can be made? Including: - UCaaS - Hosted PBX - SIP Phones - SIP Trunking - Dial-in Voice portals - Outdial from meet-me conferencing - APIs, typically used for click-to-dial applications or Screen-Pops - Call Forwarding / Redirection / Call Transfer - Laws: What laws affect us here? - Commonly, Rural Call Completion (RCC) rules can restrict your ability to block calls to certain high-cost destinations. [Contact an attorney for exact details.](http://www.commlawgroup.com) - Equipment and Services: What are the devices in our infrastructure that are involved in routing the fraudulent calls when they're made?  - Session Border Controllers - Application Servers - PSTN Gateways ## PR: Protect *In general, it's best to protect against toll fraud to prevent it from happening in the first place -- and to minimize te dollars lost when it does happen. Much of the discussion about toll fraud focuses on this element, with good reason.*  - What are the systems in place to protect our system against unauthorized use through the services we offer (UCaaS, SIP Trunking, Voice Portals, APIs, etc.) - How are our SIP phones and others protected against spoofing (e.g., by stealing SIP credentials)? - How are our web or app login portals protected? - Do our customers know their responsibilities toward protection against fraud? - How do we deactivate service for customers who cancel their service? - How do we train & equip our personnel to ensure they don't assist bad actors in committing fraud (so called Social Engineering)? - Are we applying all the best practices of cybersecurity -- including network segmentation, software updates, malware detection? ## DE: Detect *Even with great protections in place, you need a backstop of detection. And detection must keep evolving with the attackers.* - Do we know what normal calling volumes look like to high cost destinations, and are we able to detect when volumes are improper? - Are able to detect fraud events when the occur automatically? - Are we testing our fraud-detection system to ensure it still functions properly? - When a vendor detects fraud, who will they contact? - Are we regularly improving our fraud detection processes to ensure they are keeping up with the attackers? ## RS: Respond *Few organizations plan and discuss in advance what should happen when fraud is detected. But appropriate response -- including the mitigation -- can make a great difference in the dollars lost.* - Who is responsible for being aware of fraud incidents? - What kind of reporting or communication should be happening when fraud occurs? (Is there any possibility that different departments are withholding information from one another?) - **Analysis: Are we analyzing how the fraud incident occurred and distributing what's discovered?** - Are we actively improving after problems occur in an organized, disciplined way? - **Mitigation: How do we stop the fraud event while it's ongoing?** - Are we reviewing the improvements through a change management process so that we're confident the changes are helpful and effective? - Are there any scenarios where we need to contact others - like law enforcement or the FCC? ## RC: Recover - What's our process after a fraud incident occurs? - With whom do we need to communicate after a fraud incident?   [nist](https://www.ecg.co/blog/tag/nist) [fraud](https://www.ecg.co/blog/tag/fraud) [cybersecurity](https://www.ecg.co/blog/tag/cybersecurity) ## Similar posts [![FraudStopper Frequently Asked Questions](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/16-fraudstopper-frequently-asked-questions) ### [FraudStopper Frequently Asked Questions](https://www.ecg.co/blog/16-fraudstopper-frequently-asked-questions) [![SIP and Fragments: Together Forever?](https://www.ecg.co/hubfs/Imported_Blog_Media/regular_26664897842_9f2f1b18db_o-1.jpg)](https://www.ecg.co/blog/125-sip-and-fragments-together-forever) ### [SIP and Fragments: Together Forever?](https://www.ecg.co/blog/125-sip-and-fragments-together-forever) [![VoIP Fraud Could Kill Your Company — FraudStopper Kills the Fraud](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/15-voip-fraud-could-kill-your-company-fraudstopper-kills-the-fraud) ### [VoIP Fraud Could Kill Your Company — FraudStopper Kills the Fraud](https://www.ecg.co/blog/15-voip-fraud-could-kill-your-company-fraudstopper-kills-the-fraud) ## Need Help With Your Network or AI Project? Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies. [Let's Talk](https://www.ecg.co/contact) [![ecg-logo-white](https://www.ecg.co/hubfs/ecg-site/global/ecg-logo-white.svg "ecg-logo-white")](https://www.ecg.co/) 505 North Toombs St. Suite A Valdosta, Georgia 31601 USA #### Headquarters - 1.866.324.0700 US Toll-free - 1.229.244.2099 International - 1.229.244.2399 Fax - [info@e-c-group.com](mailto:info@e-c-group.com) #### Services - [Overview](https://www.ecg.co/services) - [Network Operations](https://www.ecg.co/services/network-operations) - [Custom AI Development](https://www.ecg.co/services/custom-ai-development) - [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support) - [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) - [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) #### Company - [About](https://www.ecg.co/about) - [Careers](https://www.ecg.co/careers) - [Blog](https://www.ecg.co/blog) - [Resources](https://www.ecg.co/resource-library) - [Events](https://www.ecg.co/events) © ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mark Lindsey", "url" : "https://www.ecg.co/blog/author/mark-lindsey" }, "dateModified" : "2025-03-31T08:30:16.599Z", "datePublished" : "2020-06-10T04:00:00.000Z", "headline" : "How the NIST Cybersecurity Framework Supports Fighting Telecom - ECG", "image" : [ "https://www.ecg.co/hubfs/Imported_Blog_Media/regular_nick-fewings-rEqx_Q2-g2s-unsplash-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.ecg.co/blog/145-how-the-nist-cybersecurity-framework-supports-fighting-telecom-fraud", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg" }, "name" : "ECG, Inc" } } ```