Saudi's stc, Nokia join forces to raise security awareness in telecom industry

Saudi Arabia - 5G is more than a radio access technology. It is a new architecture with far greater agility in all domains. The capacity, latency, agility, reliability, and speeds offered by this technology makes it applicable to Communication Service Providers and all industry verticals. The future vision for 5G and IoT is not just about connecting individual devices; it is an enabling technology in the 4th Industrial revolution that will deliver societal change.

5G will underpin several critical use cases, from industrial automation, through public safety service to support utilities or connected cars. The understanding of critical infrastructure has evolved in recent years to encompass government networks and data centers, the infrastructure used by providers of basic products and services such as energy, food, raw materials, railways, airports, telecoms, banks, internet exchanges, water utilities, and hospitals. And finally, infrastructure that is critical for high-value enterprises or of key strategic importance for the nation’s economy.

Experts from both stc and Nokia joined forces and authored a paper in an attempt to raise security awareness in telecom industry, provide an overview of 5G security implications, and demystify some of the common topics around the subject.

Saudi Arabia is leading in the adoption of 5G technology with coverage planned for almost the entire Kingdom, paving the way to becoming one of the world’s leading Digital Economies.

“stc’s 5G deployments were carefully designed with security at the core, with the goal of enabling Saudi national digital transformation via secure infrastructure, without which, no digital economy can survive in today’s cyber reality. We believe that enriching the industry with what we have learned is vital to the Cybersecurity knowledge library,” explained Eng. Yasser N. Alswailem, vice president of cybersecurity at stc.

“Active cooperation between involved stakeholders is vital at national, regional, and international levels to implement resilient and secure digital infrastructure. Our collaboration with stc on this important topic gave us the opportunity to share together our respective views about 5G security implications regarding the assets that need to be protected, the threats and risks that we need to protect against, and most importantly, the most common mitigation steps to minimize those risks,” said Khalid Hussain, country senior officer and stc business group head at Nokia.

What is at stake?

Any network security event can have massive implications, especially in 5G because of a broader range of use cases, including mission-critical and public safety services. Imagine a production halt in a smart factory because of network snag or malware bringing down the autonomous vehicle at a standstill. Adopting measures to protect the network needs to be part of network architecture and design.

Right from loss of availability of the communications services, leak of confidential information of the users to loss of network integrity are some of the impacts of security incidents in any network.

The loss of integrity is the third and high-level information security threat. It compromises the integrity of the network and can be used for data leaks or misuse of confidential information and even impacting the availability of the network services.

There are several ways in which high-level attack vectors can harm the network. Radio interface jamming or flooding attacks, types of Denial of Service (DoS) attacks and exploiting flaws in design, implementation or configuration of the network are common ways of network attacks.

Malicious elements can also create and exploit a backdoor within a network. Any flaw or gap in the operational procedure can also add to network vulnerability. It is crucial to remember that while these methods can be used to attack any type of network, the damage of such attacks on the 5G network is much more severe.

What do we need to protect?

Ensuring security for 5G demands a fundamentally different approach. The 5G networks are complex, combining both physical and virtual infrastructure. Further, tighter integration of telecom and IT infrastructure, services, and operations in a 5G network demands a holistic look at 5G security than ever before.

Many traditional network elements of 4G are replaced in 5G by Virtual Network Functions (VNFs) and cloud architectures. 5G delivers the whole network as a Service (NaaS), which is enabled by service-oriented architecture, VNFs, cloud core, and dynamic network orchestration/slicing. 5G network elements, therefore, need to be protected against security incidents at both physical and logical layers.

It must be understood that the criticality of networks and specific network elements should be evaluated based on (potentially disrupted) applications underpinned by those networks. Even a short failure in connectivity in a limited geographic area or an impact on latency requirements for a critical service could result in a deadly consequence (consider disruptions of connected car services). As such, undisrupted access to connectivity becomes as crucial as access to electricity.

Apart from the infrastructure, it needs to be stressed that any compromise of the management systems can also potentially have a massive impact on the overall network. With control over the management systems, attackers with appropriate privileges can shut down the network or access sensitive data.

Protecting against threats

“It is extremely important to be mindful of the cybersecurity risks and to take all appropriate steps to minimize such risks relying on standardized security features and additional solutions available on the market,” emphasized eng. Eng. Alswailem of stc.

More broadly and depending on the overall network architecture, a combination of three different mitigation scenarios and frameworks are required. The first is 3GPP-specified security architecture which includes an access-agnostic authentication framework and enhanced subscription privacy and user plane protection, among other features.

In the second category of network security not specified by 3GPP, it is imperative to adopt a holistic, automated security management and orchestration approach. Lastly, robust implementation of the virtualization layer and the overall cloud platform software, among other measures, will help in enhancing the security of the 5G network.

Operators and vendors of the mobile networks industry defined the Security Assurance Methodology (SECAM) in 3GPP standards organization. On this basis, NESAS was developed within the GSMA. Some national cybersecurity authorities are involved in the process as well. NESAS is the most suitably global security assurance scheme, and adopting it brings benefits for operators through the reduced effort for tender with security by default and measurable security.

NESAS also brings uniform security requirements for vendors for network equipment and demonstration of commitment to secure product development and maintenance. Finally, governments benefit from a developed scheme, supported by the industry, introducing basic cybersecurity “hygiene.”

“Globally or at least regionally accepted certification schemes are preferred. This will promote innovation and reduce overhead. The GSMA NESAS (Network Equipment Security Assurance Scheme) is a promising scheme that has the potential to become one such global certification scheme using 3GPP standards,” said Brahim Ghribi, head of government and policy affairs for the MEA region at Nokia.

As we have embarked on our global journey in Industry 4.0, 5G is the key enabling technology for the future, and along with cloud, AI, and robotics, it will make it possible to interconnect the physical, virtual and biological worlds. These are exciting times, and with this opportunity ahead of us, we must ensure we can keep pace (literally) and leverage the full benefits of 5G, he added.

Network paradigms are shifting, and the 5G network heterogeneous architecture will comprise of multiple access and infrastructure (physical and virtual) technologies that will require special attention from a cybersecurity perspective.