Rolling out 5G means a huge investment in structurally different network hardware that can support the velocity and volume 5G promises. Then, in addition to the significant expenditure, virtualisation of traditionally hardware-embedded network functions opens up new exploitation opportunities for malicious actors.
With 5G, the stakes are higher than ever, because 5G will soon become the backbone of critical national infrastructure. A ConsumerLab study of the information and communication technology (ICT) industry uncovered $31 trillion addressable consumer revenues that will flow over 5G networks by 2030. Service providers could secure $3.7 trillion of this, driven by 5G connectivity, which remains the biggest revenue driver.
It has already enabled latency-sensitive, mission-critical industrial control systems that run smart grids, smart cities and smart factories. Autonomous systems such as self-driving cars and automatic pilot avionics also rely on the speed, capacity and reliability of 5G networks. Any disruption to these systems and applications can quickly become fatal – yet security often takes a back seat when speed and volume are the driving forces.
Taking a fresh look at traditional cyber threats
5G differs significantly from its predecessors in that it centres on software-defined networking (SDN), network virtualisation and network functions virtualisation (NFV). Virtualised network core and Radio Access Networks (RAN) allow network slicing for segregation and optimal resource allocation for different types of devices and services. But on the downside, virtualised network segments are prone to software vulnerabilities that attackers can leverage to move beyond the virtualisation layer into the physical layer.
Despite the many benefits, there are some security risks associated with network slicing as well.
Multiple virtual networks and RAN partitions essentially create more entry points for malicious actors. An attacker can compromise a network slice to monopolise resources for compute-intensive activities such as crypto mining. Such attacks are not only expensive, but they can also cause insufficient resources for critical services running on other virtual partitions.
The increasing number of software components results in increasingly complex supply chains. Security flaws in the suppliers’ environments will have direct implications on the bottom lines of associated businesses.
Further, many latency-sensitive 5G applications such as autonomous vehicles, video surveillance and the Internet of Things (IoT) use Multi-access Edge Computing (MEC). Instead of being consolidated in the cloud, the data is stored, processed and analysed at the network edge, closer to the endpoints. While it enables real-time analytics and decision-making, it also expands the attack surface since critical data is distributed across an array of systems.
Of course, the same lightning-fast speeds and low latency that enable real-time machine-to-machine communications can also allow attackers to enact extremely fast and powerful distributed denial-of-service (DDoS) attacks. Industrial IoT such as crop sensors, medical robots, waste management sensors and smart water meters can become a target to cause wide-scale disruptions and chaos. And when attackers target the availability or integrity of 5G-connected cyber-physical systems such as robotic telesurgery systems or autonomous vehicles, threats can quickly escalate and become lethal.
Being prepared means half the battle is won
Governments and organisations alike are eager to roll out 5G technologies. 5G will surely become the new standard of broadband cellular networks within the next few years. But the sheer volume and velocity of 5G networks combined with the complex infrastructure and heavy reliance on software create a perfect landscape for threat actors.
While the government can dictate standards and regulations for secure 5G infrastructure, individual organisations will also be held liable for potential data breaches – so they should raise their security bars before threats become incidents.
Given the high stakes, security should be at the forefront of 5G rollout plans. Before organisations adopt 5G, their organisational processes must adapt accordingly. Here’s how companies can prepare in advance for the inevitable 5G revolution:
- Conduct risk assessments to identify 5G usage and risks factors across the organisation.
- Update business continuity plans accordingly.
- Carefully review contractual agreements and establish service-level agreements with 5G operators.
- Evaluate vendors’ security standards and development processes across the supply chain.
- Bring security controls closer to the edge where data is being stored and processed; consider adopting a secure access service edge (SASE) model.
It’s going to be a bumpy ride
Despite doing everything right, companies must acknowledge that mistakes will inevitably happen. Often, bad actors are the first to find security flaws in new technologies. But being prepared can mitigate the impact of potential attacks. It can allow companies to identify and contain security incidents with minimal monetary and reputational damage. It may take years before cybersecurity stakeholders can truly get ahead of the 5G threat landscape. Until then, let’s hope that the underlying vulnerabilities don’t cause any irreparable loss.