Gsma Fs.38 Jun 2026

GSMA FS.38 is a critical Official Document titled . Developed by the GSMA's Fraud and Security Group (FASG) , it provides a framework for securing Session Initiation Protocol (SIP) communications across fixed, mobile, and converged networks. Overview of GSMA FS.38

Focuses on protecting network infrastructure, such as Session Border Controllers (SBCs) and core network nodes, from unauthorized access and denial-of-service (DoS) attacks.

I notice “gsma fs.38” doesn’t correspond to a known public GSMA document, standard, or widely recognized reference as of my current knowledge.

The FS.38 guide advocates for a holistic security posture, recommending that operators go beyond basic SBC protection and actively use technologies such as dedicated SIP firewalls. A SIP firewall can perform critical functions that an SBC may not, such as correlating incoming messages with data from other signaling protocols, actively querying external platforms for context, and creating tailored, dynamic security policies. gsma fs.38

While guidelines like FS.38 exist, the rapid deployment of new technologies often leads to security gaps. For instance, VoLTE remains vulnerable to various threats in its open, all-IP architecture, underscoring that the adoption of standards is the first step, but continuous vigilance and assessment are required. FS.38 provides the essential blueprint for operators to audit, secure, and monitor their SIP infrastructure, making it a cornerstone of any robust security strategy for 4G, 5G, and future networks.

Provides the foundational IT/network security hygiene used across the whole operator environment. VoLTE/VoWiFi Threat Intelligence

: It suggests deploying signaling firewalls that can perform deep packet inspection (DPI) of SIP headers and SDP payloads to detect anomalies. GSMA FS

: Facilitates secure communication and collaboration between different providers, essential for a global telecommunications ecosystem. Future-Proofing

GSMA FS.38 sets a new standard for Session Initiation Protocol (SIP) security, advocating for a comprehensive, defense-in-depth approach rather than relying solely on session border controllers. The document emphasizes infrastructure protection, realistic encryption strategies, and the integration of security across the entire ecosystem to mitigate threats in 5G networks. Read the full analysis at

The guideline segments testing and hardening recommendations across four distinct architectural domains: 1. SIP Endpoints I notice “gsma fs

Against this backdrop, the GSMA Fraud and Security Group (FASG) shifted its focus to SIP, a protocol with a vast attack surface that is used across access networks, core networks, and interconnects. While existing standards from the IETF, 3GPP, and ETSI cover various security aspects of SIP, there was no single, overarching document addressing real-world attacks and comprehensive countermeasures. FS.38 was created to fill this critical gap. The 230+ page guide outlines potential security, privacy, and fraud attacks based on SIP against mobile, fixed, and converged networks, and it provides practical defensive strategies for network operators.

If you provide more context (e.g., topic area, organization, or purpose), I’d be happy to help produce the text you need.

GSMA FS.38 represents a significant step forward in the quest for secure mobile authentication. By providing a standardized, robust framework for authentication, FS.38 has the potential to revolutionize the way we interact with mobile devices and sensitive services. As the mobile ecosystem continues to evolve, the importance of FS.38 will only grow, driving innovation, trust, and security in the digital age.

This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later. Cybersecurity document library - GSMA Security

GSMA FS.38 provides a practical, interoperable framework for sharing fraud and security events across the mobile ecosystem. When implemented with appropriate governance, privacy safeguards, and operational controls, it can materially reduce fraud impact while preserving necessary protections for subscribers and operators.