5G can reduce – but also create – security risk

In this interview with Help Net Security, Anubhav Arora, VP of Security Engineering at Cradlepoint, talks about the most common 5G security misconceptions, how to make sure the network is safe, but also how 5G can benefit businesses.

As 5G connections are rapidly spreading, more and more questions and misconceptions are arising. What are the most common ones and how can they affect security teams?

5G is a comparatively new technology and many cybersecurity teams have not had the time to evaluate how to mitigate its specific vulnerabilities, such as the implementation of network slicing, SIM hijacking, and user location information exposure. Additionally, there’s a common misconception among security teams that 5G is only a data transport technology.

However, this view doesn’t consider the significant difference between 5G and other transport protocols, including how 5G can create or reduce risk. 5G is an inherently secure next generation technology that uses cloud native service-based architectures, tenets of zero trust architecture, and significant improvements in confidentiality / privacy of data. However, in the broader ecosystem that 5G enables, there are added components in end to end solutions and hence there is a need for further consideration of supply chain and API security.

How can 5G technology benefit organizations?

With 5G rollouts well underway and the enterprise already enjoying the benefits of the technology, it is becoming increasingly clear that the fifth generation of wireless is essential for our modern, digital ecosystem. From powering remote work to enabling edge computing to supporting immersive customer experiences, 5G is the underpinning of connectivity across various industries in our world.

5G meets the business imperatives of availability, interoperability, security, and manageability, all of which are necessary as the enterprise continues to invest in advanced technologies, gather more data, and employ workers remotely across the globe. Ultimately, businesses that invest in 5G now are investing in business agility, or the ability to design, create, and deliver higher quality solutions to customers – whether they be businesses or consumers – faster than ever. At the very least, 5G for business will enable wireless networks to compete with broadband connections for the first time in history.

What are the threats associated with 5G technology?

In recent years, there has been an increase in technology specialization among IT and cybersecurity teams. This has reduced the understanding of how new and advanced technologies work together— leading to a number of tools in a single environment and limited understanding of new risks that may be looming as a result of the influx of tech.

This is particularly true as 5G rollouts continue. 5G will continue to solve high-value problems for organizations, and so the implementation of the technology will increase. As a result, new vulnerabilities will continue to be found as 5G and other technologies— particularly IoT—are implemented together in a single ecosystem. Cybersecurity teams will have to understand their full technology ecosystem to prevent blind spots in security assessments.

What are the methods threat actors can use to exploit 5G and IoT technology?

Threat actors can capitalize on vulnerabilities using 5G network connections for lateral movement or as a proxy for initial access into victim organizations.

5G is used as connectivity for a multitude of IoT use cases including IoT management and control platforms accessed with 5G. Since IoT devices and platforms have significantly more diversity and expanded attack surface, the risk of compromise on that front is high. It is important that in such cases the functionality of other business critical applications, the 5G network itself, are safeguarded by using zero trust architecture-based choices to create these networks and their interactions. Network slicing and its use in creating end to end segmentation can be an effective defense against attacks as well as limiting the blast radius and impact of an attack.

What can organizations do to secure their 5G and IoT technology?

To ensure secure 5G and IoT technology, organizations must first adopt and develop a robust Zero Trust Architecture based framework. ZTNA plays a significant role in effectively securing the increasing attack surface of the WAN edge. In combining both 5G solutions with a ZTNA strategy—a 5G zero trust strategy—business users and their devices are continuously monitored and validated during their session without needing to repeatedly sign in.

Adding on to this, organizations must first always vet, assess and evaluate the vendor that is deploying their product. Having a security-first mindset is imperative. Ask how DevSecOps is implemented, what security features are native to the product, and if those features integrate well with your organization’s existing technology ecosystem. This would include a built-in next-generation firewall, robust network slicing management, network segmentation, intrusion detection and response, and user access policies as well as analytics.

Lastly, having a cybersecurity and IT team that understand that new vulnerabilities will always be introduced as new technologies are brought on board. Flaws aren’t always introduced by 5G but can be developed through other technologies that are impacting your network. As with any technology, if the surrounding environment includes insecure implementations, that puts all technologies it interacts with at risk.

Could you explain 5G network slicing and why is this a concern for organizations?

5G network slicing allows carriers to provide tailored network services for each organization’s unique needs for specific applications and/or use cases. The network slice itself is a separated, self-contained, and independent part of the network, targeting different services with various requirements on speed, latency, reliability and security.

This virtual segmentation enables companies to select the right level of security—paid for by the slice—for any specific use case desired. For example, IoT devices in a specific network segment or VLAN can be routed on their own slice – this enables segmentation by design as well as use case specific security and quality of experience.

5G network slicing can help improve the overall availability of the use case but is limited to providing confidentiality and integrity protections within the 5G network boundaries. Soon we would be able to use slicing for end-to-end segmentation, enterprise policy-based access, security inspection and QoE. Even then, confidentiality and integrity of the data remains the primary responsibility of the enterprise. Should an organization not have proper security practices or strategies in play, doors can be left open for advanced threat actors to compromise data.