Written by Syed Jawad Imam Jafri, Cyber Security and Privacy officer (CSPO), Huawei South Africa.
5G is becoming a reality and the lifecycle for 5G is going to be lasting for a while. Based on successful experience for 4G security, controlling 5G security risks is achieved through joint efforts of all industries.
To control risks in the 5G lifecycle, we need to continuously enhance security solution capabilities through technological innovation and build secure systems and networks through standards and ecosystem cooperation:
Equipment vendors: They integrate security technologies and manufacture secure products in compliance with standards and industry best practices, participate in the development of industry security standards, and work with customers and other stakeholders to help operators ensure security operations and cyber resilience.
Operators: They are responsible for the networks’ security operations and cyber resilience. Through security planning, design, and deployment, they build a comprehensive 5G network protection system with defence in depth. Operators can prevent external attacks with firewalls and security gateways. For internal threats, operators can manage, monitor, and audit all vendors and partners to verify security within and between their NEs.
Industry and government regulators: As an industry, we all need to work together on unified standards. In terms of technologies, we need to continuously contextualise 5G security risks and enhance protocol-based security. In terms of security assurance, we need to standardise cyber security requirements and ensure that these standards are applicable to and verifiable for all vendors and operators.
Security is part of cellular networks definition for 5G. Compared to previous wireless technologies, 5G standards include more security features to tackle potential security challenges and lead to security enhancements in the future 5G lifecycle. Governments can be part of these efforts in controlling risks to operate 5G services in line with country regulations.
A recommended win-win strategy to address 5G security challenges is to deliver a plan described as follows:
a) Formulation of laws and regulations, involving cross-discussion with all public and private partners, to guarantee a consistent security framework. Governments should take a key role here to define the requirements of their respective countries in terms of security, and their regulators should encourage the development of new technologies with risk control mechanisms to address both their economic objectives and security needs.
This can be achieved through collaboration with all stakeholders, based on a common goal to define global standards. Governments play an important role in encouraging technological innovation (in 5G in the context of this document), allowing more suppliers that meet security specifications to participate in national 5G construction and development, and defining security standards, assurance mechanisms, and certification programs.
These measures will improve national 5G network construction and operation efficiency, reduce costs, and stimulate positive social and economic development.
b) Governments can implement specific policies to obtain oversight on the security level of each network operating in the country. Specifically, they supervise rogue base stations and radio interference that affect normal 5G communications and impose the necessary penalties for violations.
Operators are responsible for the cyber security of the network infrastructure and manage risks in accordance with international standards and national security regulations.
Regulatory requirements for operators shall be transparent, fair, and consistent, and unified cyber security requirements shall be applied to all suppliers, to ensure security throughout the network.
c) NESAS jointly defined by GSMA and 3GPP provides authoritative, unified, and open security assessment standards for the communications industry, helping governments, regulators, and operators monitor and manage local cyber security risks more efficiently.
More and more governments and regulators are working closely with relevant industries and partners to develop a unified set of rules for 5G security. Operators can implement 5G security policies and mechanisms based on these rules.
The support from equipment vendors and relevant vertical industries is also important.
Huawei calls on the industry to work together to share responsibilities, unify standards, formulate clear regulatory measures, and build a secure, reliable, open, and transparent 5G security ecosystem that benefits everyone and is widely recognised by stakeholders.
[Image – CC 0 Pixabay]
