How Does Security Work for OTT Services?

TL;DR

OTT security depends more on the network layer where a service operates than on whether its ecosystem is considered open or closed. Telecom operators primarily detect and manage attacks at the network layer, while OTT providers defend the application layer, where business models, customer information, advertisements, credentials, and content create distinct security risks.

Transcript

Hello everyone. My name is Daksha Pathak, and I'd like to welcome you to my talk on Over-the-Top Security or OTT Security. Over-the-Top Services is a rapidly growing space, with global OTT revenues forecasted at three hundred and thirty-three billion dollars by twenty-twenty five. OTT services have already disrupted the music industry, the voice te... Read More

Key Insights

• OTT cybersecurity is critical to revenue retention, profitability, and business survival because providers compete not only through content and services, but also through user experience, price, business model, and security.
• Rapid OTT growth is attributed to low barriers to business entry and extremely low startup costs, enabling many providers to offer media, communications, social networking, productivity tools, technology services, and other applications.
• Advertising-supported OTT services exchange free access for advertisement viewing or personal information, creating information assets that can attract ad fraud, customer-attention hijacking, and attempts to capture subscriber information.
• A walled garden is a closed ecosystem whose infrastructure, applications, and operations are closely controlled by its operator, with isolation and control over connected devices contributing to its implied security.
• The distinction between open and closed platforms is debatable because telecom operators connect through partnerships and interexchange points, while separate OTT applications such as Skype and WhatsApp cannot directly complete calls between their platforms.
• Telecom and OTT services share three fundamental building blocks: a network layer containing access and core networks, a control layer covering identity, access, and management, and an application layer.
• OTT providers predominantly operate at the application layer, with their control plane tied to application parameters, and they have no control or visibility into network policies, IP flows, or the underlying network layer.
• Attack detection and defense occur at different operational layers, with telecom operators handling attacks at the network layer and OTT providers managing them at the application layer through appropriate architectures, protocols, DRM implementations, and attack countermeasures.

Questions & Answers

Q: Why is cybersecurity important for OTT services?

Cybersecurity is important for OTT services because it is more than a feature that distinguishes one provider from another. It directly affects revenue retention, profitability, and the survival of the business. OTT providers compete across content, products, services, user experience, pricing, and business models, while holding information assets that can attract fraud, hijacking, and other attacks.

Q: What security risks affect advertising-supported OTT services?

Advertising-supported OTT services provide content or services without direct payment in exchange for users watching advertisements or providing personal information to advertisers. Because this model has the most subscribers, it combines valuable advertisements with extensive customer information and attention. These assets make the model susceptible to ad fraud, customer-attention hijacking, and attempts to capture or misuse subscriber information.

Q: What is a walled garden in telecommunications security?

A walled garden is a closed ecosystem in which infrastructure, applications, and operations are closely controlled by the ecosystem operator. Telecom environments have historically been described this way because isolation and control over devices connecting at the network edge can support security. However, telecom operators also connect with partners through peering points, network-to-network interfaces, and interexchange points.

Q: Are OTT platforms always more open than telecom networks?

OTT platforms are not necessarily more open than telecom networks. Telecom operators have long formed partnerships and connected through peering points, network-to-network interfaces, and interexchange points to create global services. Meanwhile, users of separate OTT applications, such as Skype and WhatsApp, cannot complete a call across those platforms because both participants must register for and use the same service.

Q: What network layers do telecom and OTT services share?

Telecom and OTT services have the same fundamental building blocks. The network layer contains access and core networks. The control layer includes identity and access functions together with a management plane. The application layer delivers applications and services. The principal difference is where each provider operates and connects its control and management capabilities, which shapes its visibility and defensive responsibilities.

Q: How do telecom operators and OTT providers divide security responsibilities?

Telecom operators primarily conduct business in the network layer, with control-plane and management parameters closely connected to that layer. OTT providers predominantly operate in the application layer, with controls tied to application parameters. Consequently, telecom operators detect, manage, and deflect attacks at the network layer, while OTT providers address attacks and defensive tactics at the application layer.

Q: Why can OTT providers not manage network-layer attacks directly?

OTT providers cannot manage network-layer attacks directly because they have no control or visibility within the underlying network layer. They cannot set network policies or analyze and manage IP flows. Those capabilities remain with the telecom operator. OTT providers instead manage the security controls and attacks visible at the application layer, where their services and control-plane parameters primarily operate.

Q: What topics should an OTT security assessment cover?

An OTT security assessment should examine the service architecture, ecosystem, information assets, and expanded attack surface. It should also consider security architectures, protocols, transmission quirks, and proper DRM implementations. Important targeted attacks include credential stuffing and ad fraud, particularly in media and technology services. The assessment should align defenses with the network or application layer where responsibility and visibility reside.

Summary & Key Takeaways

• OTT services span media, communications, social networking, productivity tools, technology services, and other everyday applications. Their rapid growth is attributed to low barriers to entry and low startup costs, creating competition across content, services, user experience, pricing, business models, and cybersecurity. Security therefore affects revenue retention, profitability, and business survival.

• Common OTT business models expose different information assets and risks. Advertising-supported services exchange free access for advertisement viewing or personal information and attract ad fraud, customer-attention hijacking, and information theft. Transaction-based and subscription-based services introduce their own assets and exposures, making the business model an important part of evaluating an OTT service's attack surface.

• Telecom operators and OTT providers share network, control, and application layers, but they operate primarily at different levels. Telecom operators focus on network infrastructure and related controls, while OTT providers focus on applications and lack network-layer visibility. Effective security analysis should therefore emphasize operational layers, architectures, protocols, DRM, credential stuffing, and ad fraud.