Network security

How to Master E2E Network Security When Introducing 5G Core

It is becoming clear that 5G will enable many new use cases, including those that will make the critical role of mobile networks even more apparent. Service providers are increasingly asked to provide evidence of how security and privacy are managed in their networks to gain acceptance and trust.

5G networks will serve as the foundation for these new use cases and services, and since these different use cases may share resources in the mobile network, a cyberattack against one could affect many others. The more society depends on digitized services, the more likely cyber threats against these services will increase, making security a critical factor for the success of 5G businesses.

Four layers of 5G security

To understand how security is structured, we divide it into four layers, from bottom to top, we have:

  • Security standards for i/f and security architecture
  • Product Development Security
  • End-to-end architecture (E2E) security deployment
  • Security Management and Operations

Figure 1: Security layers in 5G

Standardization

We have many new standards that serve as the foundation for 5G security from organizations such as 3GPP, the Internet Engineering Taskforce (IETF), the European Telecommunications Standards Institute (ETSI ISG NFV), and the National Standards Institute and Technology, USA (NIST). They defined the interfaces and security architecture of mobile networks. Due to all the different technology areas that make up 5G, there is no single standard for 5G security.

Along with standards, there are also new regulations related to 5G security. In general, these regulatory requirements aim to increase the basic security of products and services and to protect networks against attacks. The EU toolbox is an example.

Secured products

As a 5G system will be built on a largely virtualized cloud platform with many different network functions and 3PP applications, and many different vendors will be involved. When developing these products, vendors should not only consider 3GPP and other standardized interfaces, but should also build security into the products during the development process.

Ericsson has systematically developed a state-of-the-art model, called the Security Reliability Model (SRM), to integrate security and privacy considerations into all phases of product development.

Mobile networks and 5G serve as the backbone of modern society. Therefore, security assurance is a means of ensuring that network equipment meets security requirements and is implemented in accordance with secure development and product lifecycle processes.

Security in the 5G core

As an example of new security products in 5G, Ericsson recently launched an integrated Packet Core firewall as a unique CNF (Cloud Native Network Function) as part of the Ericsson Packet Core Gateway User Plan. Today, this is solved with different multi-vendor hardware nodes, which increases latency, has hardware dependencies, and is more complex to orchestrate. A single CNF solution means it scales concurrently with the UP, addressing the specific requirements of 5G use cases, including edge, deep-edge, and small-scale deployments.

Secure deployment and operations

Mobile Network Security Management Architecture

Figure 2: Mobile network security management architecture

As stated above, security in a 5G system involves much more than specific products inserted in different places. This requires the ability to bypass and manage security across the entire network architecture, especially given the large number of multi-vendor solutions. As 5G networks will also be very dynamic, threat detection and mitigation must also be carried out very quickly.

There are no telecom-specific security frameworks, and as a result many communications service providers are turning to generic cybersecurity frameworks – for example, the NIST Cybersecurity Framework and Internet Security Center controls (CIS) – when designing approaches and processes around security operations. . However, ETSI has defined NFV security lifecycle management, which describes the three main stages of the VNF security lifecycle: security planning, security enforcement, and security monitoring.

The journey to intelligent security management

Communication service providers today have varying levels of maturity in their security operations, and many have static manual processes in their telecommunications network security operations.

Ericsson has defined a three-step approach to achieve a high level of intelligent security management.

  1. Dynamic: Introducing automated security policy configuration and compliance monitoring
  2. Cognitive: Automated detection of threats and vulnerabilities assisted by ML/AI
  3. Intelligent: Repeatable, Adaptive and Holistic Security Management with Threat Intelligence. This provides end-to-end visibility into business-related security risks, and actions can be directed through automated workflows to mitigate risks faster.

Security Management Solutions

Ericsson has worked for many years to develop a management solution for the entire telecommunications network across all network layers and domains, including multi-vendor products.

Ericsson Security Manager is a scalable security management automation solution that implements building blocks for all necessary functions: risk orchestration, protection, detection and response. It adheres to the principles of the NIST Cybersecurity Framework. It transforms data collected from managed context into powerful security intelligence, identifying relevant threats and vulnerabilities. Active response also enables shortened incident containment through a high degree of automation as closed-loop, expert-assisted response mechanisms.

Security as a source of revenue for service providers

Figure 3: Security as a source of revenue for service providers

Security as a source of revenue for service providers

The rise of new business contexts built on top of the 5G network platform will leverage the increasingly dynamic and distributed nature of the 5G network architecture. This makes network and service security management an increasing challenge as the network threat surface increases and new threat vectors are introduced. Communications service providers must manage the security and privacy of their networks and services in a more complex business environment. It also opens up new business opportunities, as communications service providers can manage security for the specific needs of many businesses in the future.

For more details, please read our recent document “Mastering Comprehensive 5G Network Security – A Guide to Protecting Your Network When Introducing Cloud-Native 5G Core”

Want to know more about the guide series?

Visit the Cloud Native 5G Core Guide page

Your guide to building a cloud-native 5g heart

Please read previous articles in the series: ​

Building a Native 5G Core in the Cloud: The Guide Series

Your guide to building cloud-native infrastructure for 5G

Your guide to efficiently upgrading to 5G Core

Your guide to enabling voice services in 5G networks

Your Guide to 5G Network Automation and Zero Touch

Your guide to transforming network operations on the way to 5G

Want to know more about security?

Integrated Ericsson Packet Core firewall

5G Security WP: A Guide to 5G Network Security

Ericsson Safety Reliability Model (SRM)

The role of security standards in 5G

5G security: how to enable a reliable 5G system

5G network security is national security

Ericsson Technology Review: End-to-End Security Management for IoT

Learn more about network automation


Source link