Securing 5G for 2023 and beyond

By Anand Oswal, Senior Vice President and GM at cyber security leader Palo Alto Networks

While mobile technology has been around for decades, the current generation, 5G, is increasingly being recognized for the exciting new benefits it brings to enterprises, SMBs, and public sector organizations. Specifically, when properly secured, 5G capabilities such as ultra-high speeds, high availability, massive network capacity, and ultra-low latency will support breakthroughs in digital transformation for new use cases such as private networks, network slice, and multi-access edge computing (MEC).

Organizations are drawn to 5G because of these new levels of reliability, performance, and connectivity. However, as 5G becomes how enterprises get work done, it places a greater emphasis on securing networks at all layers of the Open Systems Interconnection (OSI) model. For network operators, service providers, and equipment and solution providers, it’s no longer enough to secure voice and data across Layer 3 (network layer) and Layer 4 (transport layer) of the pipe. We must secure up to and including Layer 7 (the application layer) to ensure that business continues on in this 24/7 environment. 5G is designed to go places. Security needs to keep up.

As this technology becomes pervasive across the globe, PwC has forecast that the global economic impact of 5G will exceed $1.3 trillion by 2030.1 As organizations move to the next generation of connectivity, they will also need to confront potential new security risks. It’s critical for any organization moving to 5G to integrate security as part of the deployment from the outset—understanding that 5G networks are the business today and not simply an enabler.

Why protecting 5G is hard

5G is a major transformational technology that enables digital transformation of entire industry sectors and underpins entire economies. The proliferation of devices, the vast increase in intelligence at the network edge, and the aggregation of critical functionality at the network core bring challenges that together contribute to a perfect storm of security risk in 5G deployments.

Security for previous generations of mobile technology was not focused on detecting and preventing attacks on all layers, all locations/interfaces, all attack vectors, and all software lifecycle stages. Because 5G finds its way into mission-critical applications that affect every aspect of public and private life, it’s imperative to make sure that 5G deployments are protected by pervasive security that looks at all layers of the attack surface and provides controls to help mitigate risks. Enterprise-grade security enables organizations to take a Zero Trust approach to their 5G networks, including applying security on every level—down to the identification of every device, subscriber, and network slice.

Where are the emerging threats from 5G coming from?

Threats against 5G are likely to come from a few different vectors as attackers look to find the weakest link to gain access. 5G infrastructure involves multiple components, each of which represents an area where there is potential risk:

1. Virtualized infrastructure: 5G services will run on virtual machines (VMs) as well as Kubernetes-based container infrastructure in the cloud and in data centers. Threats against virtualization include denial-of-service attacks as well as misconfigurations, among others. There is also a risk of side-channel attacks, whereby an attacker is able to gain access to one piece of a virtualized infrastructure stack and then move laterally to exploit other connected elements.
2. Network and management interfaces: At the network layer, there is a risk from attacks against signaling and data interfaces. Attacks against these interfaces can include address spoofing, message tampering, and potential meddler-in-the-middle eavesdropping attacks.
3. Application and service threats: There are also risks from specific threats for applications and services. This includes advanced malware, command-and-control botnets, code injection, and application vulnerabilities.
4. Radio rogues. 5G is a wireless protocol and there is risk from rogue base stations in the radio access network (RAN) that can be used to attack the network.

As for emerging threats, we see the dataplane as a potential battlefield. In the past, much of the security focus has centered on the signaling plane. However, given the expanded attack surface, it is becoming easier for adversaries to exploit vulnerabilities, API manipulation, and access controls, among others, on the dataplane, as well.

How leaders can improve 5G security

While there are emerging threats that organizations will face with 5G, there are also steps that can be taken to mitigate the risk.

1. Adopt Zero Trust: With a Zero Trust architecture, there is no notion of implied trust for the growing volume of devices and use cases on 5G. Instead, all devices and users are continuously validated in an approach that enforces least privilege across all the layers of the 5G stack.
2. Embrace automation and AI: The complexity of 5G deployments and the massive device connectivity will require faster and more repeatable approaches to deploying security. 5G security will be best served with an AI-powered approach that can identify devices and enable automated policy-driven approaches to reducing risk.
3. Take a platform approach: 5G is one part of a larger stack that organizations will deploy to enable applications. It’s critical to take a unified approach to security that considers all attack vectors. A platform approach should also provide granular application identification policies and protection against advanced threats wherever they come from.

Designing our safe and secure journeys together

5G represents a paradigm shift as organizations expand connectivity options to enable new capabilities. It also expands the attack surface with new interfaces and side-channel attack threats against virtualized network infrastructure. It’s critical to consider the risks as part of a 5G initiative and integrate security as part of the deployment from the outset.

As organizations move to the next generation of connectivity, security can’t be an afterthought. It’s imperative to build security into 5G networks from the ground up. 5G security should be deployable on any cloud platform—private or public, across multicloud and multivendor environments, as well as on the service provider’s 5G core network or at the MEC.

Advances like 5G can help us all go to places we’ve only dreamed of, but only if we work together to build in the safety and cybersecurity that will support that ride. Let’s prepare for the journey together.

1. “Health and social care to gain the most from 5G productivity and efficiency gains, which will add US$1.3 trillion to global GDP by 2030,” PwC Global, February 2, 2021

About Anand Oswal:

Anand Oswal serves as senior vice president and GM at cyber security leader Palo Alto Networks. Prior to this Anand, was senior vice president of engineering for Cisco’s Intent-Based Networking Group. At Cisco he was responsible for building the complete set of platforms and solutions for the Cisco enterprise networking portfolio. The portfolio spans enterprise products across routing, access switching, IoT connectivity, wireless, and network and cloud services deployed for customers worldwide.

Anand is a dynamic leader, building strong, diverse, and motivated teams that continually excel through a relentless focus on execution. He holds more than 50 U.S. patents and is focused on innovation and inspiring his team to build awesome products and solutions.