| # | Control | Description | |---|---|---| | 8 | | The device must uniquely authenticate to the network and any application server. Use of GSMA’s IoT SAFE (SIM Applet for Secure End-2-End Communication) is recommended. | | 9 | Resilience Against Input Attacks | Input validation to prevent buffer overflows, injection attacks, or malformed packet crashes. | | 10 | Wireless Interface Security | For Bluetooth, Wi-Fi, or LoRa interfaces, implement least-privilege pairing and disable insecure legacy modes (e.g., WPA2-PSK with weak passphrases). | | 11 | Privacy Controls | Minimize data collection. Ensure user consent is obtained. Use anonymization or pseudonymization where personally identifiable information (PII) is transmitted. |
By aligning security controls with the risk class, FS.38 provides a pragmatic path for manufacturers. A Class A temperature logger does not require the same hardware crypto-accelerator as a Class C connected vehicle. This risk-based stratification ensures that security is proportional to cost—a critical factor in IoT’s price-sensitive markets. gsma fs.38
The framework provides guidelines on securing the servers responsible for configuring and provisioning user devices (such as IP phones or softphones). | # | Control | Description | |---|---|---|
For organizations looking to validate their security posture, FS.38 sets high standards for and Performance Testing . | | 10 | Wireless Interface Security |
: FS.38 is typically a "Members Only" document. You can check for updates or related public summaries on the GSMA Interworking Security page.
SIP messages frequently contain experimental headers, routing history, and user identity metrics. If an operator fails to sanitize these fields at the network boundary, bad actors can map the internal network topology or harvest (such as device specifications, operating system versions, and locations). 3. Toll Fraud and CLI Spoofing