Vendors and operators frequently claim that 5G is more secure than previous generations of wireless technology, but corroborating evidence of that is cluttered.
A medley of forces in and outside the traditional confines of mobile networks can bolster the security stature of 5G networks, but it’s not a foregone conclusion.
5G, in and of itself, does not help or hinder security so much as it opens more methods to improve security, said Dimitrios Pavlakis, digital security analyst at ABI Research. It all comes down to implementation at the edge and core of the network, he explained.
“Cellular communication is inherently insecure,” and that will remain true for 5G, just as it’s been for all previous generations, Pavlakis said. The attack surface is broad and targets vary. Attackers can track data traffic, location, user and device information; launch man-in-the-middle attacks through hacked stations; intercept user communications via rogue stations; and eavesdrop on peoples’ communications, he said.
5G isn’t a cure all, nor does it somehow build a fortress to blunt any nefarious attempts to do harm.
Security Evolves Amid 5G Advancements
“5G is not a revolutionary leap in security compared to previous generations, since saying this would infer that previous generations had inadequate security, which isn’t the case,” Mauricio Sanchez, research director at Dell’Oro Group, told SDxCentral. Security is, more specifically, evolving for the better in 5G, but industry wide it “remains to be seen whether network providers will implement the full suite of capabilities described by 5G specifications,” he explained.
Security will improve in 5G, according to Sanchez, on two fronts: the radio access network (RAN) and core, and the attributes that can be assembled to operate the network more securely.
On the network side, improved privacy, better transport security, more secure base station identification, revamped end-to-end service isolation architecture, IoT management, and new IP and cloud security standards will all factor positively into a network’s security posture. With respect to operations, 5G has also embraced the National Institute of Standards and Technology’s Cybersecurity Framework and better monitoring and trusted computing to ensure the integrity of boot, file, and code systems, he said.
“You still have to lay some foundation of education on what 5G does to improve the security posture of an organization, and to an extent also what are its limitations,” said Nick McQuire, VP of enterprise research at CCS Insight. While there’s been a lot of hype and vendor push aiming to position 5G as a mission-critical platform for businesses, those proclamations were premature, he said.
“There was nowhere near enough due diligence and discussion, and even vendor education on, you know, can we trust this platform?” McQuire said. “In the context of these types of applications, 5G is still a lab-based technology.”
Standards bodies, operators, and vendors have been more active in explaining the security benefits of 5G, but “it’s a fairly recent discussion point in the industry,” he said. Those activities and discussions haven’t changed the maturity of the technology, however.
This makes it important to distinguish between security frameworks that are being carried through from 4G LTE, particularly as it relates to 3GPP standards, and the capabilities that can be enabled based on 5G architecture and technology, McQuire explained.
“The real interesting security things are what potentially could be enabled down the road either by the operators themselves, by specific vendors, by enterprises that work with partners that actually implement private networks around 5G,” he said. “There are a number of different areas where I think we’re going to see some real interesting innovation coming around 5G that will actually make 5G more inherently secure than previous generations.”
The Role of Vendors, Operators, Software
It’s unclear whether RAN vendors, network operators, or software providers will supply those security enhancements en masse, but there’s a big opportunity for operators that are assembling managed network services and attaching security capabilities to those, according to McQuire.
“I do think the vendor ecosystem plays a role, and I do think the vendor ecosystem will compete on security for 5G for winning industrial markets,” he said. “Now, how they play to the telcos is a bit of a different play, but to the private industrial segment or the private enterprise market, I do think the vendor ecosystem will matter and I do think their security is going to play a role.”
Experimental activities have slowed amid the COVID-19 crises, but some sectors like manufacturing may also gravitate to 5G faster in a bid to rebuild and reengineer how their facilities are run, McQuire said. “Security isn’t a blanket, one-size-fits-all thing around 5G, it’s very much use case specific. So it’ll be certain use cases that will require deeper security and therefore companies will pay more attention to these capabilities than other use cases.”
Areas where 5G delivers genuine security improvements include better privacy protection, a new authentication framework, stronger encryption, and service-based architecture, according to Sanchez. More specifically, 5G adds the ability to encrypt the subscriber ID; the use of different credential classes, including certificates, pre-shared keys, and passwords; and support for 256-bit encryption, he said.
“4G is the last mobile network generation to employ a traditional point-to-point network function architecture. 5G took inspiration from contemporary data center web application and network design that rely on a service-based architecture,” Sanchez said. That allows 5G operators to use the same mature libraries, development tools, and security mechanisms used by cloud service providers, he explained.
Use-Case Specific Benefits for Enterprise
Network slicing, a virtualized portion of a network that allows a company to operate and run workloads within a contained slice of a much greater network, is another area of innovation that will bolster security, according to McQuire. “That kind of contained network environment will bring some security benefits out of the gate” because it separates traffic from all of the other traffic hosted by an operator, he said.
That allows enterprises to do deeper packet inspections and more comprehensive analysis of the traffic flows. Moreover, because that data can highlight patterns, enterprises can also implement detection and response mechanisms associated with anything that occurs on that virtualized slice of the network, McQuire said.
“That contained slice virtualized network scenario is, to an extent, what enterprises have enjoyed on their MPLS or fixed LAN IP infrastructure, but they’ve just not had it on cellular in the past,” he said. “What 5G does is actually almost provide that last-mile level of control into the 5G cellular network that companies have been able to run their private fixed networks.”
In the near term that provides enterprises with visibility, control, traffic containment, detection, analytics, and response mechanisms, but it’s also another step down the path to automated and self-healing networks, McQuire said, adding that is still “quite a long way away.”
5G Security Posture Is a Team Sport
Meanwhile, recent advancements on open RAN and the widening adoption of virtualization, automation, and orchestration, are signs of progress and could improve security but “these efforts aren’t groundbreaking,” Sanchez said. “In some respects, the telco world is taking the pages out of the contemporary cloud data center play book … The telco community by nature has been pegged as extremely conservative and stodgy, so it’s great to see adoption of new lines of thinking and driving progress.”
Irrespective of these developments, it’s as important as ever for network operators and vendors to clarify what they can and can’t control with respect to security.
“We have to be careful not to be swept up by flowery promises that 5G will solve all security automagically. 5G definitely solves and improves a lot, but it’s not going to stop attacks from happening,” Sanchez said. “The overall security posture of a 5G network is going to be a team sport. It’s going to require effort from the network and its service provider owner as much as the applications, users and devices communicating over it.”
"really" - Google News
June 12, 2020 at 07:00PM
https://ift.tt/2Yqs97O
Is 5G Really More Secure? It's Complicated - SDxCentral
"really" - Google News
https://ift.tt/3b3YJ3H
https://ift.tt/35qAk7d
Bagikan Berita Ini
0 Response to "Is 5G Really More Secure? It's Complicated - SDxCentral"
Post a Comment