Managed SOC for Indonesian telecommunications operators

A telecom operator does not choose when it gets attacked. The core network carries calls and data overnight, subscriber databases never close, and Kominfo expects the operator to notice a security incident and start reporting it. A security operations centre is the function that watches for those incidents around the clock. Most operators cannot staff one to cover every layer on their own, and that is where a managed SOC fits.

This page is about running that SOC for an Indonesian telecom operator specifically: the threats that reach signalling and subscriber systems, the Kominfo and UU PDP rules that set the pace, and what we actually monitor. For how a SOC works in general terms, see our SOC-as-a-Service service page.

Why telecom operators need a managed SOC

A telecom network is attacked because it sits at the centre of everyone else's authentication. The threat profile that reaches an operator is more specific than the generic list, and it shapes what the SOC has to watch for.

There is a wider reason this matters. Banks, e-commerce, and government services in Indonesia lean on SMS one-time passwords to authenticate users, which puts the telecom network at the base of the national authentication chain. When signalling or a subscriber SIM is abused, the damage lands in someone else's account, so the operator's monitoring is doing work for the whole ecosystem, not only its own systems.

On top of the threats, the regulator sets the pace. PP 71/2019 and Perpres 82/2022 govern electronic system operation, Kominfo PSE registration, information security management, and incident reporting, with data localisation for strategic systems. Kominfo now requires telcos to run annual security assessments and keep an incident response plan, alongside its telecom-specific rules on lawful interception, subscriber data protection, and network resilience for critical infrastructure. UU PDP adds a 72-hour breach-notification duty when subscriber personal data is involved. A managed SOC is the operational layer that makes the monitoring, detection, and reporting parts of those rules real rather than written policy.

The table below maps the monitoring-related obligations to what the SOC actually does. Governance, the asset register, and data mapping are separate control domains, not the SOC.

How we deliver it for telecom operators

A telecom SOC is defined by what it can see. Endpoint telemetry alone is not enough when the value sits in the signalling and subscriber layers, so we collect and correlate logs from across the network estate rather than a single layer.

The point of pulling these together is correlation. A single signalling query may look routine on its own, but read alongside an unusual SIM change and outbound traffic to an unfamiliar destination, it becomes an incident worth escalating. Our analysts are based in Indonesia and work telecom use cases, so triage is tuned to signalling and subscriber-fraud patterns rather than a generic ruleset. The service runs in four continuous phases.

The reason we correlate signalling and subscriber logs rather than watching endpoints alone is that telecom fraud rarely touches an endpoint at all. If you are weighing this against a broader detection-and-response product, our page on managed XDR sets out where that fits, and our comparison of SOC-as-a-Service versus an MSSP explains the difference between an outsourced SOC and a general managed-security contract.

What the numbers say about the sector

More than 350 million mobile connections means a subscriber database is one of the largest concentrations of personal data in the country, and any weakness in it is a weakness at national scale. The alleged 2022 IndiHome leak, reported to involve 26.7 million subscribers and denied by Telkom, is the case most operators point to internally when subscriber-data security comes up, whatever the eventual finding on the specific incident. The short UU PDP notification clock is why continuous monitoring is treated as a baseline control rather than an upgrade. A breach involving subscriber personal data also carries UU PDP penalties, covered in full on our page about the cost of UU PDP non-compliance.

If you want to understand what a managed SOC would cover for your network and how it maps to your Kominfo and UU PDP obligations, our team can set out a concrete first step.