Some security risks are specific to 5G, while other risks accompany the infrastructure of most CSPs and they might remain during the transition to 5G. Risk factors are evaluated and prioritized based on their impact on three key aspects of information security:

  • Integrity

  • Availability

  • Confidentiality

Based on its findings, the NCSC considers the following functions to be critically sensitive. These functions require a high-level protection, and a compromise could undermine integrity, availability, or confidentiality.

  • Virtualization infrastructure

  • Controllers

  • Orchestrators

  • Internet gateways

  • Routing and switching of IP traffic at the core

  • Database functions

  • Authentication, access control, and other security functions

Solving the trade-off between security and performance

A conflict undermines the security of some telecom networks. Implementing a secure network can be expensive, and there can be a trade-off between security and performance:

"In the last couple of years, the operators’ commercial drivers have come into direct conflict with the NCSC’s security advice," NCSC Technical Director Ian Levy writes in a January 2020 blog post on the future of telecoms. "Those operators who chose to follow our advice and requests were putting themselves at a commercial disadvantage which is unsustainable. So, the government's decision to significantly uplift the baseline telecoms security and formalize the handling of high-risk vendors putting it all on a robust footing is welcome. It provides clarity for operators and transparency about what we expect for the security of national networks. Externalizing the security costs of particular choices (including vendor) help operators make better security risk management decisions." In the UK, for example, eschewing robust security in the name of enhancing performance will not be a choice; the NCSC’s telecom security framework will be underpinned by legislation.

Prioritizing performance and revenue over security increases risks and exposes more attack surfaces. The solution is to invest more in infrastructure that improves performance and scalability so that implementing security measures does not degrade network performance.

Some CSPs run their equipment at high levels of utilization across-the-board, causing challenges in applying patches and performing rolling upgrades. This can leave them vulnerable to cyber attacks that exploit known vulnerabilities. However, investing in infrastructure that enhances performance can address this problem.

Investing in infrastructure that improves performance and scalability is an effective way to addressing security risks without compromising network performance. This enables organizations to implement security measures without compromising network performance.

By striking a balance between performance, revenue, and security, organizations can build resilient and secure networks that can withstand cyber attacks and other threats.

Virtualization tier

Key risks to the virtualization plane include the following:

  • Attacks that let a hacker bypass a hypervisor’s enforced separation to control workloads running on the host or to move laterally to other hosts and applications

  • Successful exploitation of the virtualization’s fabric, orchestration system, or management functions enables an attacker to access the entire virtualization fabric, including all hosts and virtual workloads. This attack would keep the entire network at risk, affecting the availability and confidentiality of critical services.

Signaling plane and core network virtualization

The signaling plane is responsible for the exchange of control messages between different network elements, such as base stations and core network nodes, to set up and manage user sessions.

Vulnerabilities in the signaling plane related to the lack of proper authentication and encryption mechanisms, threats from insider attacks or new attack vectors, such as software bugs, misconfigurations can be exploited to gain unauthorized access to the network, compromise network elements, and launch distributed denial-of-service (DDoS) attacks.

Overall, the vulnerabilities in the signaling plane pose a significant risk to the availability, integrity, and confidentiality of 5G networks. To mitigate these risks, network operators need to implement robust security measures, such as end-to-end encryption, secure bootstrapping, network segmentation, access controls, and intrusion detection and prevention systems (IDPS). They also need to regularly audit their networks for security weaknesses and train their staff on cybersecurity best practices.

5G-specific threats and risk factors

The 5G PPP Security Working Group’s white paper on the 5G security landscape identifies several 5G-specific security risks and their associated requirements. In general, the service-oriented architecture of the 5G core network introduces a broader range of data and services than 4G, increasing the attack surface. The common web protocols and APIs of 5G networks introduce more attack vectors.

The working group identified that the following risks are relevant to the VMware Telco Cloud Platform. This preliminary list requires updates during the transition to 5G.

  • Unauthorized access or usage of assets

  • Identity theft

  • Identity cloning to gain access to sensitive resources

  • Fraudulent use of shared resources

  • Modification of subscriber credentials

  • Weak 5G network slicing isolation

  • Privacy Attacks using Side-channel Information

  • Traffic capturing rerouting because of recursive or additive virtualization

  • Lack of detection of alterations to the control plane or the user plane

  • Difficulties in managing vertical SLAs and regulatory compliance

In addition, a lack of common security standards across multiple domains can make the management complex and challenging. This also increases the risk of configuration errors or other changes that expose vulnerabilities or attack vectors.

Key security imperatives for reducing risk

These risks and attack vectors increases the key security risks which demand immediate attention. In general, securing the virtualization plane and its management components relies on the ability to do the following:

  • Keep the virtualization fabric and VMs up to date.

  • Maintain the fabric as a group and at scale.

  • Apply critical security patches quickly.

  • Implement mitigations that neutralize known attack vectors.

  • Control access to resources and the management layer by using the principles of least privilege and separation of duties.

  • Isolate hypervisors and VMs with security domains and pools that prevent movement.

  • Protect sensitive data through segmentation of workloads and storage.

  • Encrypt data in transit and at rest.

  • Architect the virtualized infrastructure by following best practices and patterns for automated provisioning, automated management, secure administration, and micro-segmentation.

  • Architect the management of the virtualization plane to isolate it from other systems and networks.

  • Strictly control access to and use of the virtualization plane’s management layer.

  • Monitor and audit the virtualization plane.

  • Track access and changes to the management layer.