## 5 Countermeasures against 3/4G Security Threats  
The mobile communication industry has been getting a rise during the last three years. Hence, the security issues in mobile communications have become increasingly more important in 2013 [26]. Therefore, not only mobile operators but also mobile device users should be careful when using services over a mobile network. We focused especially on the mobile operators' security vulnerabilities when they don't protect their customers and networks against cyber threats. So, we will mention only the countermeasures that could be taken on the mobile operator's side. Security countermeasures against the security threats on the 3G border and core network devices could be summarized as follows:  
1. Stateful IP packet filtering could be applied on the Internet border of the mobile network. This task could be achieved by an Internet router with firewall feature with both TCP and UDP stateful packet filtering functionality. A second option is to use a firewall device between the GGSN and the Internet router. The packet filtering device must be stateful for TCP and UDP, and drop all unnecessary traffic from the Internet to the mobile operator or to the customers. The drawback of the stateful firewall solution is the limitations in a firewall's session state table;
2. Carrier-grade Network Address Translation (NAT [27], CGN [28]) is used both to mitigate IPv4 exhaustion and to block unnecessary traffic from the Internet. But when a CGN is used, it is not possible to allow the traffic from the Internet to the subscribers, which is a drawback in using the CGN;
3. Configuration should be done against IP address spoofing [29] on the IP packet filter device or the Internet router;
4. The flooding and the DoS/DDoS type of attacks are the most dangerous and effective ways to destroy target devices. They could be performed individually or organized, e.g., using a botnet [30, 31]. A high number of connection requests could put most stateful firewalls out of service due to limitations in their state tables. Therefore, a DoS/DDoS protection service or product should be used against attacks coming from the Internet. Generally, it is recommended that DDoS protection is placed in the ISP's side [32];
5. Mobile to mobile traffic could cause spreading of worms and viruses. This can be dangerous for both mobile devices and mobile operators, especially when worms/viruses act in an organized manner forming a botnet. Therefore, mobile to mobile traffic should be filtered by the GGSN or an IP filtering device;
6. Malware [33] or botnet members can generate flooding traffic to their victims such as mobile devices or operators, causing service interruptions on core network devices. Hence, rate limiting [34] should be applied to mobile user traffic on the GGSN or an IP packet filtering device should be used to avoid this threat;
* Directed broadcast [35] traffic must be denied on the GGSN to protect against DDoS attacks;
* RA and LA scope optimization should be done according to the best practices to decrease paging effects;
* Parameter optimization on RNC and SGSN should be done according to the best practices to decrease the PS paging effect;
* Mobile operators could locate the GTP aware firewall products between the SGSN and the GGSN to block attacks coming through the GTP protocol;
* The PS and the CS paging control channels should be isolated to prevent the CS paging from being overloaded by the PS paging channel under attack. Hence, at least voice communication service would not be affected in the case of an attack against the PS paging channel. A pictorial summary of all the countermeasures to be taken on the mobile operator's side can be seen in Figure 15. The advantages and disadvantages of using the above mentioned countermeasures are listed in the Table 1.