Industry · Telecoms
Keep self-care, top-ups and APIs working under constant bot pressure
I assess the edge, APIs and apps your subscribers use every day, find where bots and abuse get through, and show which fixes cut the most risk first.
- Top priorityEdge & WAAPLogin, OTP and top-up endpoints face bots and floods at subscriber scale.
- Top priorityAPI securitySelf-care and partner APIs can reveal subscriber data from a phone number.
- ElevatedVulnerabilities & exposure
- ElevatedMonitoring & visibility
- ElevatedMobile apps
- BaselineGovernance & maturity
In short
Application security for telecom operators covers the self-care portal and app, top-up and bundle APIs (application programming interfaces), partner and reseller channels, and the long tail of campaign sites. I assess bot and DDoS (distributed denial-of-service) readiness at the edge, authorisation on subscriber APIs, and the forgotten applications still live on your domains. You get a ranked plan; delivery is scoped separately if needed.
Where I usually start
- WAAP & API protection assessment
- Exposure management (CTEM) assessment
- Application architecture review
The pressure
What telecoms security teams are up against.
- Bots at subscriber scaleLarge subscriber bases mean login, OTP and top-up endpoints draw constant automated abuse.
- Sprawling domainsYears of campaigns, agencies and acquisitions leave sites and APIs that nobody remembers owning.
- The number is the keyA phone number receives bank and wallet OTPs, so subscriber accounts are worth taking over.
- Availability is the productAn outage of self-care or top-up during a launch or holiday is visible to every customer at once.
Attack scenarios
The attacks I test your defences against.
Each scenario maps to one of the six areas, so you can see which layer should have stopped it.
Try the attack simulator- Scenario 01Account takeover for data bundlesBots try leaked passwords on self-care logins, then redeem bundles and loyalty points from hijacked accounts.Edge & WAAP
- Scenario 02Subscriber lookup by phone numberA self-care API returns name, ID number and plan details for any phone number passed to it.API security
- Scenario 03Modified self-care appA tampered build skips client-side checks and calls bundle APIs directly to claim offers it should not get.Mobile apps
- Scenario 04Forgotten campaign micrositeA promotion site an agency built years ago is still live on the main domain, unpatched and unowned.Vulnerabilities & exposure
Recommended
Where I would start with you.
Three engagements that fit this sector best. Each ends in a prioritised plan; delivery is your call.
- 01WAAP & API protection assessmentTests bot, DDoS and API controls against the traffic your self-care channels actually receive.2–4 weeksFixed feeSee the service
- 02Exposure management (CTEM) assessmentFinds forgotten sites and APIs on your domains and ranks them by what an attacker could reach.2–4 weeksFixed feeSee the service
- 03Application architecture reviewA deep review of the self-care platform, or a new digital service, before it carries real load.1–3 weeksFixed feeSee the service
Rules you work under
The frameworks I map findings to.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- Parliament of Sri LankaPersonal Data Protection Act, No. 9 of 2022Subscriber identity, location and usage data held by self-care apps and APIs falls under this Act.
- PCI Security Standards CouncilPayment Card Industry Data Security Standard (PCI DSS) v4.0.1Card top-ups and bill payments in apps and portals bring those payment flows into scope.
- National Cybersecurity Authority, Saudi ArabiaEssential Cybersecurity Controls (ECC)Applies to Saudi government bodies and critical infrastructure operators, and includes web application security controls.
- ISO and IECISO/IEC 27001:2022Widely used by operators. Secure development and security testing of applications sit inside its control set.
Proof
Programmes I have led, and why they transfer.
My delivery work so far has been in banking and a global group. The controls, failure modes and lessons carry straight across to telecoms.
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
- T1bank vulnerability programmeTier-1 bank scanning upgraded and extended to web applicationsBanking · A Tier-1 Sri Lankan commercial bankTenable Security CenterRead the case
- RASPin-app protection liveIn-app runtime protection live in a customer banking appBanking · A leading private bank’s mobile appZimperiumRead the case
Where I work with telecoms teams
Why are telecom self-care apps a target for attackers?
A subscriber account holds more than airtime. It can redeem bundles and loyalty points, reveal personal details, and the number behind it receives one-time passwords for banks and wallets. That makes self-care logins worth attacking at scale with bots. Weak authorisation on self-care APIs (application programming interfaces) can also expose subscriber details to anyone who passes in a phone number.
How do you find forgotten applications on a telecom estate?
I combine DNS (Domain Name System) records, certificate transparency logs, cloud and CDN (content delivery network) settings, scanner data and WAF (web application firewall) traffic into one list of what is actually exposed, then match it against owners. Campaign microsites, old partner integrations and test environments are the usual surprises. Each one is retired, put behind the edge or given an owner.
Can a WAAP stop bot attacks on login and top-up pages?
A WAAP (web application and API protection) platform with bot management helps, but only once it is tuned to your traffic. Telecom logins see many real users behind shared mobile network addresses, so simple rate limits per IP (internet protocol) address block customers. Behavioural and device signals work better. I check whether bot controls actually enforce on login, OTP (one-time password) and top-up flows, rather than only monitoring.
Do telecom operators need mobile app protection?
For apps that handle top-ups, bundles, payments or wallet features, yes. Runtime protection detects rooted phones, hooking tools and modified copies of the app. It does not replace authorisation on the server, because attackers can call the APIs (application programming interfaces) directly. I usually assess the app and its APIs together, so protection effort goes where money and data actually move.
How long does a telecom application security assessment take?
An assessment of WAAP (web application and API protection) and bot controls typically takes two to four weeks, depending on how many domains, apps and partner integrations are in scope. A review of a single platform takes one to three weeks. Ravindu Fernando, a Colombo-based application security consultant, agrees the scope and a fixed fee before work starts, after a free first call.