The joint guidance on communications infrastructure, published on 4 December 2024, asks defenders to see their network devices better: watch configuration changes, store configs centrally, monitor flows, centralise logs, and keep a device and firmware inventory. The steps suit any organisation with on-premises network gear.
Context
CISA, the NSA, the FBI and the cyber agencies of Australia, Canada and New Zealand issued the guide after warning that PRC-affiliated actors had compromised networks of major global telecommunications providers in a broad espionage campaign. The agencies state that the observed activity exploited existing weaknesses, not novel techniques. So patching and basic hygiene can reduce the risk.
The guide is written for network engineers, and it says it may also apply to organisations with on-premises enterprise equipment.
The visibility checklist
- Watch configuration changes. Monitor and investigate changes made outside change management, and alert on unauthorised ones. If a device changes and no ticket exists, someone should ask why.
- Keep configurations in one place. Store device configurations centrally rather than letting each device be its own source of truth. Then a drift from the known good copy is easy to see.
- Monitor flows at key points. Deploy network flow monitoring at key ingress and egress points.
- Centralise logging. Collect logs in one place, encrypt the transport, keep off-site copies, and consider a SIEM.
- Baseline normal behaviour. You cannot spot odd traffic if you never wrote down what normal looks like.
- Keep an inventory. Maintain an up to date list of devices and their firmware versions.
Why central configs matter more than they sound
A router or switch that holds the only copy of its own settings can be changed quietly, and nobody has a reference to compare against. A central, versioned copy turns "something feels off" into a diff. It also speeds recovery, since you can restore a known good state.
A realistic first month
Week one: build the inventory, even if it is a spreadsheet. List model, firmware, location, and who owns it. Devices nobody owns are the first finding.
Week two: pick one place to store configurations and pull every device into it. Set a schedule.
Week three: turn on centralised logging for the most exposed devices first, such as edge routers and VPN gateways.
Week four: pick a few alerts you will actually answer, such as a config change with no change ticket. Fewer alerts that people read beat many that nobody does.
Where software inventory helps
Network firmware is software with its own vulnerabilities, and the guide asks for firmware inventories. If you also run applications on the same infrastructure, the same discipline applies to their dependencies. Safeguard provides asset discovery and SBOM and dependency scanning for that application side, and a free scan is available at gold.safeguard.sh/scan. It does not replace network device monitoring.
Quick check
Is this guidance only for telecom providers?
No. It targets network engineers and defenders, and the agencies say it may also apply to organisations with on-premises enterprise equipment.
Did the attackers use new techniques?
The agencies say the observed activity exploited existing weaknesses, not novel techniques.
Sources
Last reviewed: 19 October 2026.
