5G Supplement - to the Guideline on Security Measures under the EECC

To the Guideline on Security Measures under the EECC nd 2 Edition JULY 2021 5G SUPPLEMENT

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. For more information, visit www.enisa.europa.eu.

CONTACT

For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

AUTHORS

Goran Milenkovic and Dr. Marnix Dekker, European Union Agency for Cybersecurity

ACKNOWLEDGEMENTS

We are grateful for the review and valuable input received from the experts in the ECASEC Expert Group (formerly known as Article 13a Expert Group), which comprises national telecom regulatory authorities (NRAs) from all EU and EFTA countries, and from the experts from national authorities in the NIS Cooperation group, and particularly those experts contributing to the NIS CG work stream on 5G cybersecurity. In the preparation of the report we have conducted an analysis of publically available information on security in 5G specifications in collaboration with Plum Consulting, under the tender ENISA S-COD-20-T14.

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged.

For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-456-5 - DOI: 10.2824/098554

5G SUPPLEMENT

TABLE OF CONTENTS

INTRODUCTION 5

1.1 OBJECTIVES AND SCOPE 5

1.2 POLICY CONTEXT 6

1.3 STRUCTURE OF THIS DOCUMENT 6

BACKGROUND: 5G RISKS AND MEASURES 7

2.1 COORDINATED EU APPROACH TO CYBERSECURITY OF 5G 7

2.2 TERMINOLOGY AND DEFINITIONS 7

2.3 5G ASSETS 8

2.4 5G RISKS 8

2.5 MITIGATING MEASURES IN THE 5G CYBERSECURITY TOOLBOX 10

2.6 TECHNICAL GUIDELINE ON SECURITY MEASURES UNDER THE EECC 12

5G TECHNOLOGY PROFILE 13

3.1 DOMAIN D1: GOVERNANCE AND RISK MANAGEMENT 14

3.2 DOMAIN D2: HUMAN RESOURCES SECURITY 15

3.3 DOMAIN D3: SECURITY OF SYSTEMS AND FACILITIES 16

3.4 DOMAIN D4: OPERATIONS MANAGEMENT 18

3.5 DOMAIN D5: INCIDENT MANAGEMENT 19

3.6 DOMAIN D6: BUSINESS CONTINUITY MANAGEMENT 19

3.7 DOMAIN D7: MONITORING, AUDITING AND TESTING 20

3.8 DOMAIN D8: THREAT AWARENESS 21

SECURITY OF SPECIFIC 5G TECHNOLOGIES 23

4.1 NETWORK VIRTUALISATION SECURITY 24

4.2 NETWORK SLICING SECURITY 26

4.3 EDGE COMPUTING SECURITY 26

5G SUPPLEMENT July 2021 ANNEX I: LIST OF ACRONYMS 29 ANNEX II: 3GPP SECURITY REFERENCE LIST 30 ANNEX III: TOOLBOX MAPPING 32 5G SUPPLEMENT

INTRODUCTION

This document contains a 5G technology profile which supplements the Guideline on Security Measures under the EECC , called the Guideline hereinafter. The 5G technology profile gives additional guidance to competent national authorities about how to ensure the security of 5G networks. This document was developed in close collaboration with experts from national telecom security authorities across the EU, i.e. the ECASEC Expert Group (formerly known as the Article 13a Expert Group), and with the members of the NIS CG work stream for 5G cybersecurity.

Figure 1: Structure of the ENISA Guideline on Security Measures under the EECC

Considering the dynamic nature of 5G technology and the related threat landscape, this document is meant to be updated as technology and risks evolve. ENISA may consider using an alternative electronic format for this supplementary guideline, to better support regular updates.

1.1 OBJECTIVES AND SCOPE

The objective of this document is to provide additional guidance for competent authorities on how to ensure that appropriate security measures are taken by providers of 5G networks and services. This supplement clarifies and refines the more generic security measures in the Guideline on Security Measures under the EECC specifically for 5G technology.

Considering the complexity of 5G technology and the variety of deployment and configuration options, both the risks and the necessary security measures will be very different for different deployments of 5G networks and services. This means that it is important to assess the setup and the security in depth, for each case, for example by performing audits on MNOs.

5G SUPPLEMENT 1.2 POLICY CONTEXT

The Guideline, and this supplement, is a guideline for national authorities with competence on Article 40 of the EECC.

The Guideline, and this supplement, also addresses Supporting action SA01 of the Union toolbox of mitigating measures for 5G. It also gives guidance to EU Member States about the technical security measures under the Toolbox, in particular TM01. References to other technical measures that may be fully or partially implemented through the implementation of the measures in the Guideline and this supplement are provided further in this supplement.

1.3 STRUCTURE OF THIS DOCUMENT

This document is structured as follows:

Section 2 contains the necessary background, i.e. a short introduction to cybersecurity of 5G networks, summarizing the outcomes of the coordinated EU approach for the cybersecurity of 5G networks, listing the critical assets, and key risks identified in the Union-wide risk assessment and summarizing what is in the EU toolbox on 5G cybersecurity.

Section 3 contains the 5G technology profile which provides supplementary guidance to national authorities on what are the appropriate security measures for 5G networks. The profile contains short general guidance and specific guidance for each of the 8 security domains in the Guideline.

Finally, in Section 4 we briefly discuss some specific technological aspects of 5G networks that are of particular interest from the cybersecurity point of view. For each of the key technologies we provide information or references to relevant industry standards and best practices that competent authorities may want to take in consideration.

1.4 VERSIONS AND CHANGES

ENISA updates the Guideline and this supplement periodically, when necessary, in agreement with the competent authorities.

This second version of the supplement constitutes a minor update to the initial version published on 10 December 2020. This update to the supplement has been done in parallel with th an update to the Guideline (now 4 edition).

Main changes in the second version of the supplement:

 Additional security check no. 26 added to Security Objective 14

 Amended evidence mapping in Table 13: ‘Additional guidance checklist for domain D6’

5G SUPPLEMENT

BACKGROUND: 5G RISKS AND MEASURES

2.1 COORDINATED EU APPROACH TO CYBERSECURITY OF 5G

The European Commission’s Recommendation on the cybersecurity of 5G networks (hereafter ‘The Recommendation’) published on 26 March, 2019, states that the cybersecurity of 5G networks is considered critical, to protect the EU’s economy and society and to ensure the technological sovereignty of the Union. The recommendations called on Member States to complete national risk assessments and review national measures, to work together at EU level on a coordinated risk assessment and to prepare a toolbox of possible mitigating measures.

Based on the individual national risk assessments, the Commission and the Member States, with the support of ENISA, developed a single EU Coordinated Risk Assessment on 3 Cybersecurity in 5G Networks (hereafter ‘Coordinated risk assessment’). This coordinated risk assessment identifies the main threats and threat actors, the most sensitive assets, the main vulnerabilities and the main risks. For ease of reference, we re-iterate the main assets, in section 2.2 and the main risks, in section 2.3.

2.2 TERMINOLOGY AND DEFINITIONS

Terminology and definitions used in this document follows the terminology and definitions in the Coordinated risk assessment, paragraphs 1.12 and 1.24. For ease of reference, we list them here.

Table 2: Definitions

Term Definition

5G Networks

Manufacturers of

connected devices

and related service

providers

5G SUPPLEMENT 2.3 5G ASSETS

Where references are made in this document to critical or sensitive network component or functions, the identification of these components or functions should be based on and consistent with the high-level categorisation of asset sensitivity defined in the Coordinated risk assessment, paragraph 2.21.

For ease of reference, we reproduce the table from the referenced paragraph 2.21 below.

Table 3: Assets (according to the Coordinated risk assessment)

Categories of elements Criticality Examples of key elements and functions

NFV management and network orchestration CRITICAL (MANO)

Management systems and

supporting services MODERATE/HIGH

(other than MANO)

Radio Access network HIGH Base stations

MODERATE/HIGH

Internetwork exchanges MODERATE/HIGH

Further details about the listed asset categories is available in paragraphs 2.22 - 2.27 of the Coordinated risk assessment.

Remark: The above list of assets is a generic, high-level list, looking at the overall elements of 5G architecture. When

identifying specific assets, MNOs are expected to follow the recommended approach from the Guideline and to perform their own analysis, specific for their particular setting and to determine which specific assets are in scope (see section 4.1 of the Guideline). With transition to 5G network and services, such asset lists are expected to be updated in order consider new assets introduced (as also recommended further in section 3) and should ideally be aligned with the above list of assets, in particular in terms of estimated asset criticality.

2.4 5G RISKS

Coordinated risk assessment identified several main risk categories illustrated by concrete risk scenarios, describing possible attacks paths that a threat actor can use to reach its target. For ease of reference, we list these risks in the table below, reproducing the text from the Coordinated risk assessment.

5G SUPPLEMENT

Table 4: Risks (according to the Coordinated risk assessment)

Risk group Individual risks/risk scenarios

I - Risk scenarios

related to insufficient

security measures

III - Risk scenarios

related to modus

operandi of main

threat actors

interdependencies that service.

between 5G

Remark: The above list of risks identified in the Coordinated risk assessment may be seen as a

generic, high-level list of risks that are believed to be relevant for MS across EU. In reality, MNOs are expected to follow the recommended approach from the Guideline and to perform their own risk assessment, specific for their particular setting and to determine which specific risks are relevant (see section 4.1 of the Guideline). With transition to 5G network and services, such risk assessment is expected to be updated in order consider specific 5G risks (as also recommended further in section 3) and should ideally be aligned with the above list of risks.

We refer the reader to the ENISA 5G threat landscape for a more detailed and more technical overview of threats for 5G networks.

5G SUPPLEMENT 2.5 MITIGATING MEASURES IN THE 5G CYBERSECURITY TOOLBOX

On 29 January 2020, the NIS Cooperation Group published the EU toolbox of risk mitigating measures (‘the Toolbox’) addressing the risks identified in the coordinated risk assessment. On the same date, the Commission adopted a Communication (Secure 5G deployment in the EU - Implementing the EU Toolbox) , in which it endorsed the Toolbox conclusions and underlined the importance of their effective and quick implementation and called on Member States to take concrete steps to implement them.

The Toolbox identifies two groups of measures MS can take: strategic and technical measures and it also identifies a number of supporting actions that may enable, assist in implementation or improve effectiveness of the strategic and technical measures.

Figure 2: Toolbox structure

We summarize the strategic and technical measures in the Toolbox in the tables below.

Table 5: List of strategic measures from the Toolbox

Strategic Measures

SM01 Strengthening the role of national authorities

SM02 Performing audits on operators and requiring information

Assessing the risk profile of suppliers and applying restrictions for suppliers

SM03

considered to be high risk Controlling the use of Managed Service Providers (MSPs) and equipment suppliers’

SM04

third line support

Ensuring the diversity of suppliers for individual MNOs through appropriate multi-

SM05

vendor strategies

SM06 Strengthening the resilience at national level

Identifying key assets and fostering a diverse and sustainable 5G ecosystem in the

SM07

EU

5G SUPPLEMENT

Table 6: List of technical measures from the Toolbox

Technical Measures

Ensuring the application of baseline security requirements (secure net. design and

TM01

architecture) Ensuring and evaluating the implementation of security measures in existing 5G

TM02

standards TM03 Ensuring strict access controls TM04 Increasing the security of virtualised network functions TM05 Ensuring secure 5G network management, operation and monitoring TM06 Reinforcing physical security TM07 Reinforcing software integrity, update and patch management Raising the security standards in suppliers’ processes through robust procurement

TM08

conditions Using EU certification for 5G net. components, customer equipment and/or suppliers’

TM09

processes TM10 Using EU certification for other non 5G-specific ICT products and services TM11 Reinforcing resilience and continuity plans

Table 7: List of supporting actions from the Toolbox

Supporting Actions

SA01 Reviewing or developing guidelines and best practices on network security SA02 Reinforcing testing and auditing capabilities at national and EU level SA03 Supporting and shaping 5G standardisation Developing guidance on the implementation of security measures in existing 5G

SA04

standards Ensuring the application of standard technical and organisational security measures

SA05

through specific EU-wide certification scheme Exchanging best practices on the implementation of strategic measures, in particular

SA06

national frameworks for assessing the risk profile of suppliers SA07 Improving coordination in incident response and crisis management Conducting audits of interdependencies between 5G networks and other critical

SA08

services SA09 Enhancing cooperation, coordination and information sharing mechanisms Ensuring 5G deployment projects supported with public funding take into account

SA10

cybersecurity risks

5G SUPPLEMENT 2.6 GUIDELINE ON SECURITY MEASURES UNDER THE EECC

The ENISA Guideline on Security Measures under the EECC , referred to as the Guideline, provides guidance to competent authorities about the technical details of implementing Articles 40 and 41 of the EECC. It gives guidance to authorities on how to ensure that providers assess risks and take appropriate security measures. It contains a list of 29 high-level security objectives, grouped in 8 domains. Per security objective it lists detailed security measures which could be taken by providers to reach the security objective. The measures are grouped in 3 levels of increasing sophistication. The overall structure of security objectives and security measures is depicted in the diagram below.

Figure 3: Overall structure of the security objectives and security measures

The Guideline is split in 8 security domains:

 D1: Governance and risk management  D2: Human resources security  D3: Security of systems and facilities  D4: Operations management  D5: Incident management  D6: Business continuity management  D7: Monitoring, auditing and testing  D8: Threat awareness

The Guideline is technology neutral and the security measures are applicable to different types of networks and services and different types of electronic communication providers.

5G SUPPLEMENT

5G TECHNOLOGY PROFILE

This section, the 5G technology profile, supplements the Guideline, which is generic and technology-agnostic, with additional and more specific guidance on 5G by clarifying and refining the security measures for 5G networks and services.

When supervising MNOs offering 5G networks, competent authorities should ask a number of high-level, general questions:

1. Does the MNO already have the general security measures in place, such as the security measures contained in the Guideline on Security Measures under the EECC?

2. Has the MNO updated the risk assessments, asset lists and operational procedures and has it reinforced general security measures accordingly, as required for the 5G network deployment and operation?

3. Is the MNO implementing specific security measures from the relevant 5G standards such as 3GPP , including the security-relevant optional controls, and does the same principle also apply to products and equipment that MNO is using in the network?

4. Has the MNO considered the key new technologies of specific relevance for 5G networks (such as virtualization, slicing, edge computing etc.) in the overall risk assessment and has it deployed adequate controls for mitigating related risks?

In the rest of this section we provide detailed guidance for competent authorities for each of the 8 security domains, as follows:

 For each of the domains we first list all the underlying security objectives;  We then highlight those objectives that may be considered of particular importance for 5G networks and services and we provide a brief rationale for their relevance;  For each of these highlighted objectives we also include a checklist containing additional elements that competent authorities may consider;  Finally, we include reference to related technical measures from the Toolbox .

Remark: Taking into account the type of service provided and perceived overall level of risk,

competent authorities may want to consider requesting the implementation of measure up to level 3, in particular for those security objectives identified (in the step #2 above) to be of particular importance. However, it is ultimately up to the competent authorities to choose the appropriate sophistication levels, taking in consideration also the guidance provided in section 4.2 of the Guideline (Remark on minimum security measures).

5G SUPPLEMENT 3.1 DOMAIN D1: GOVERNANCE AND RISK MANAGEMENT

Domain D1 (Governance and risk management) covers the following security objectives:

 SO 1: Information security policy  SO 2: Governance and risk management  SO 3: Security roles and responsibilities  SO 4: Security of third-party dependencies

This security domain is important to ensure that MNOs have appropriate measures and processes in place to manage information security risks continuously and adequately. It is of particular importance to ensure that the list of risks is reviewed and updated to consider key risks specific to 5G networks, especially those identified in the Coordinated risk assessment and that adequate technical measures are in place for mitigating supply-chain risks pertaining to 5G networks. Depending on the national approach in respect of assessment of high-risk supplier (as per the Toolbox measure SM03), this may also include requirements for MNOs to conduct an assessment of the risk profile of their key suppliers, say in relation to the last criteria mentioned in the Coordinated risk assessment: The overall quality of products and cybersecurity practices of the supplier, including the degree of control over its own supply chain and whether adequate prioritisation is given to security practices. Some of the guidance listed further in this section includes examples of checks that could be considered in this regard .

Competent authorities should pay close attention to objectives SO 2 (Governance and risk management) and SO 4 (Security of third-party dependencies), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM08 and, to some extent, TM09 and TM10.

Table 8: Additional guidance checklist for domain D1

# SO Checks to consider Ref.

5G SUPPLEMENT

# SO Checks to consider Ref.

When reviewing and refining requirements for MNOs related to procurement (in relation to the above highlighted security objective SO 4 - Security of third-party dependencies), competent authorities may also find useful to explore to technical reports and best practices related to security requirements for ICT procurement, such as the two ENISA reports listed below.

Document Year Description URL

3.2 DOMAIN D2: HUMAN RESOURCES SECURITY

Domain D2 (Human resources security) covers the following security objectives:

 SO 5: Background checks  SO 6: Security knowledge and training  SO 7: Personnel changes  SO 8: Handling violations

Many of the measures in this security domain refer to personnel, which, in this context, includes not only employees, but also contractors and third-party users. This could be of particular importance in the context of 5G networks, with increased reliance on sub-contractors, including those from third countries, for the purpose of managing critical network functions. Moreover, adequate knowledge of key personnel is relevant for addressing one of the important vulnerabilities identified in the coordinated EU risk assessment, which applies particularly to

5G SUPPLEMENT

MNOs: lack of specialised and trained personnel to secure, monitor and maintain 5G networks and services.

Competent authorities should pay close attention to objectives SO 5 (Background checks) and SO 6 (Security knowledge and training), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM05 and TM06.

Table 9: Additional guidance checklist for domain D2

# SO Checks to consider Ref.

3.3 DOMAIN D3: SECURITY OF SYSTEMS AND FACILITIES

Domain D3 (Security of systems and facilities) covers the following security objectives:

 SO 9: Physical and environmental security  SO 10: Security of supplies  SO 11: Access control to network and information systems  SO 12: Integrity of network and information systems  SO 13: Use of encryption  SO 14: Protection of security-critical data

These security objectives contain various controls for ensuring physical and logical security of networks and systems. For this reason the domain D3 plays perhaps a central role in ensuring technical protection of critical or sensitive network components or functions, since majority of technical risks identified in the Coordinated risk assessment and, subsequently, majority of related technical measures identified in the Toolbox, are related precisely to physical and logical security of 5G networks and related information systems and facilities.

Competent authorities should therefore pay close attention to objectives SO 9 (Physical and environmental security), SO 11 (Access control to network and information systems), SO 12 (Integrity of network and information systems), SO 13 (Use of encryption) and SO 14 (Protection of security-critical data under this domain), checking that measures under these objectives are implemented and considering some of the additional checks as suggested in the tables below. This addresses Toolbox measures TM03, TM06 and TM07 and is related to the Toolbox measures TM02 and TM04.

5G SUPPLEMENT

Table 10: Additional guidance checklist for domain D3

# SO Checks to consider Ref.

5G SUPPLEMENT

# SO Checks to consider Ref.

3.4 DOMAIN D4: OPERATIONS MANAGEMENT

Domain D4 (Operations management) covers the following security objectives:

 SO 15: Operational procedures  SO 16: Change management  SO 17: Asset management

Considering the technical complexity and increased softwarization of key elements of 5G network infrastructure, it is of particular importance that MNOs have good and up-to-date operational procedures in place, in particular related to asset management, to understand the critical assets, and to have solid change management mechanisms in place.

Competent authorities should therefore pay close attention to objectives SO 16 (Change management) and SO 17 (Asset management), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This address Toolbox measure TM07.

Table 11: Additional guidance checklist for domain D4

# SO Checks to consider Ref.

5G SUPPLEMENT

# SO Checks to consider Ref.

3.5 DOMAIN D5: INCIDENT MANAGEMENT

Domain D5 (Incident management) covers the following security objectives:

 SO 18: Incident management procedures  SO 19: Incident detection capability  SO 20: Incident reporting and communication

Technological complexity of new generation mobile networks, potential dependency on suppliers and/or managed service providers that provide equipment and/or services, sometimes using remote connections from third countries and the overall complexity of the threat landscape require mature incident management capabilities, including state of the art incident detection capabilities. Moreover, comprehensive and reliable reporting on incidents that had a significant impact on operations of 5G networks and services to relevant competent authorities is equally important.

Competent authorities should therefore pay close attention to objectives SO 19 (Incident detection capability) and SO 20 (Incident reporting and communication), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measure TM05.

Table 12: Additional guidance checklist for domain D5

# SO Checks to consider Ref.

3.6 DOMAIN D6: BUSINESS CONTINUITY MANAGEMENT

Domain D6 (Business continuity management) covers the following security objectives:

 SO 21: Service continuity strategy and contingency plans  SO 22: Disaster recovery capabilities

5G SUPPLEMENT

Implementation of measures under this domain ensures robust network resilience and adequate disaster recovery and business continuity capabilities. And while this may already be essential part of MNO’s operations, it is worth emphasizing its importance in the context of 5G networks, as indicated in both the Coordinated risk assessment and the Toolbox. In the Coordinated risk assessment, a massive failure of networks due to interruption of electricity supply or other support systems is explicitly highlighted as one of the 9 identified significant risks to 5G networks. Consequently, the Toolbox technical measure TM11 calls MNOs to further strengthen the corresponding resilience and continuity plans.

Competent authorities should pay close attention to objectives SO 21 (Service continuity strategy and contingency plans) and SO 22 (Disaster recovery capabilities), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox technical measure TM11.

Table 13: Additional guidance checklist for domain D6

# SO Checks to consider Ref.

3.7 DOMAIN D7: MONITORING, AUDITING AND TESTING

Domain D7, Monitoring, auditing and testing, covers the following security objectives:

 SO 23: Monitoring and logging policies  SO 24: Exercise contingency plans  SO 25: Network and information system testing  SO 26: Security assessments  SO 27: Compliance monitoring

In addition to having robust incident detection and management capabilities in place, as discussed earlier, having sophisticated monitoring and logging capabilities is of significant importance for detecting and analysing security incidents. This may particularly be relevant for the environments where remote access to critical or sensitive network components or functions is expected and especially when such access is to be established from third countries and/or from suppliers or service providers considered to be high-risk. Coordinated risk assessment, in particular, identifies lack of adequate monitoring practices in MNOs as one of the key vulnerabilities. Consequently, the need for strict monitoring and logging is emphasized in Toolbox technical measure TM05 as well as in the technical measure TM03.

At the same time, considering the increased virtualization and softwarization, the importance of testing and security assessments may be higher in 5G networks. Although not explicitly

5G SUPPLEMENT

mentioned in the Toolbox, this is implicitly related to some of the technical measures, in particular to the technical measure TM07 .

Finally, having the appropriate compliance monitoring in place ensures continuous compliance with relevant standards and in the context of 5G this could also ensure compliance with relevant 5G standards, such as 3GPP, as requested by the Toolbox (technical measure TM02).

Competent authorities should therefore pay close attention to objectives SO 23 (Monitoring

and logging policies), SO25 (Network and information system testing), SO 26 (Security

assessments) and SO 27 (Compliance monitoring), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM03, TM05 and TM07 and is related to the Toolbox measures TM02 and TM04.

Table 14: Additional guidance checklist for domain D7

# SO Checks to consider Ref.

3.8 DOMAIN D8: THREAT AWARENESS

Domain D8, Threat awareness, covers the following security objectives:

 SO 28: Threat intelligence  SO 29: Informing users about the threats

In the complex and evolving 5G threat landscape, it is necessary to ensure that MNOs operating 5G networks are aware of the current and emerging threats and that they take them in consideration when (re)assessing security risks. At the same time, user awareness about known threats and vulnerabilities, as recommended in the security objective SO29, may increase the overall security of 5G services provided to end-users.

Competent authorities may want to focus in particular on objectives SO 28 (Threat intelligence) and SO 29 (Informing users about the threats), checking that measures under

5G SUPPLEMENT

these objectives are implemented and considering additional checks as suggested in the table below. This addresses Toolbox measure TM05 and is related to the Toolbox supporting action SA09 and may contribute to the mitigation of the Risk 9 from the Coordinated risk assessment (listed in the Table 3 in this document).

Table 15: Additional guidance checklist for domain D8

# SO Checks to consider Ref.

5G SUPPLEMENT

SECURITY OF SPECIFIC 5G TECHNOLOGIES

5G introduces or utilises several new technologies, in different places of the network, such as:

 Network virtualization  Network slicing  Edge computing

Number of security risks related to the utilisation of the above listed technologies in MNO’s 5G networks can be addressed by deploying general network security and information security management controls, such as those related to access control (including robust authentication and authorization mechanisms), DDoS prevention, reinforced physical security (including at remote locations) or security incident and event monitoring. Therefore, it is important that competent authorities ensure implementation and audit of relevant measures from the corresponding Guideline security objectives, taking in consideration additional guidance provided in this supplement, where applicable. However, there are some specific vulnerabilities related to these technologies, which MNOs would have to take in consideration when doing a risk assessment. Consequently, the identified risks need to be addressed adequately, which in some cases may require implementation of additional security controls. In this section, we provide further high-level information about some of these underlying technologies and we highlight the most relevant security aspects. We also include reference lists with pointers to the relevant industry standards and best practices for each of these technologies.

A more detailed technical information about the listed technologies and their security aspects, including the architecture, assets, security considerations and threats can be found it the comprehensive ENISA threat landscape for 5G Networks (hereinafter ‘ETL5G’). The new version of the report (currently in preparation) also brings analysis of vulnerabilities and identification of related security controls.

Table 16: ENISA Threat Landscape for 5G Networks

5G SUPPLEMENT 4.1 NETWORK VIRTUALISATION SECURITY

Network Function Virtualisation (NFV) technology is based on the virtualisation of network services traditionally run on proprietary dedicated equipment including routers, switches, access nodes, gateways and a variety of other hardware . The main benefits of the NFV technology are scalability and better utilisation of network resources; reduced power consumption and improved efficiency of space usage; and reduced operational and capital expenditures.

The main elements of the NFV architecture are:  Virtual Network Functions (VNFs);  NFV Infrastructure (NFVI); and  Management, Automation and Network Orchestration (MANO) layer.

The latter, MANO, is also identified as a critical asset in the EU coordinated risk assessment.

A more detailed technical information about the NFV architecture can be found in ETL5G. The same report also identifies the key virtualisation threats, being the following:  Abuse on Data Centres Interconnect (DCI) protocol  Abuse of cloud computational resources  Network virtualisation bypassing  Virtualised host abuse

The closely related technology is Software Defined Networks (SDN). It allows dynamic management of network resources by separating the network control plane from the data plane. This enables a directly programmable network control and an abstracted underlying infrastructure for applications and network services. A logically centralised control plane allows a network wide view of data plane network elements. This can then be exposed to the application layer to achieve simplified network management and improved agility. ETL5G identifies and explains number of control plane, data plane and API related vulnerabilities in SDN.

Another related concept of relevance is containerisation. Containerisation is essentially a simplified form of virtualisation, whereby instead of running an entire operating system virtually only the user-space elements of the host OS are separated from each other and the hosting operating system. This gives all the advantages of full virtualisation but without the overhead of running the full guest OS, thus leading to greater efficiencies, although it does require that each container presents the same OS version to all applications (i.e. identical instances of the host OS). The efficiency and reliability gains greatly increase the portability of such containers and the ability to move entire application stacks within a virtualised environment has been made of great use for application development. The table 16 (below) includes references to documents that cover security aspects of containerisation in more detail.

In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the chapter 3 of this supplement, competent authorities may also want to check that relevant network virtualisation security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices, in particular relevant ETSI NFV. We list the most relevant ETSI technical specifications and additional relevant technical reports and documents, including two ENISA publications on SDN and virtualization security in the following table.

5G SUPPLEMENT

Table 17: Virtualisation security reference list

Document Body Description URL

Technical specifications/standards

Technical reports and other documents

5G SUPPLEMENT 4.2 NETWORK SLICING SECURITY

Network slicing enables MNOs to allocate portions of their networks for specific users (to ensure isolation on a neutral host environment) and use cases, e.g. industry automation, connected cars or enterprise networks. The objective is to provide a set of optimised resources and network topology to satisfy the needs of use cases (for example, connectivity, speed, latency and capacity) and conform to a specific service level agreement. As NFV, MEC and SDN, the network slicing concept is also built on virtual networking architecture where multiple virtual networks are established using shared physical infrastructure. Using common network resources (e.g. storage and processors), network slices can be created to establish a logical and self-contained network configured and connected end-to-end.

A detailed technical information about the network slicing architecture can be found in ETL5G. The same report also identifies the key areas network slicing vulnerabilities (Security-as-a- Service, Resource isolation, Secure Management and Orchestration and Trust Model) and provides further explanations related to these vulnerabilities.

In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the section 3 of this supplement, competent authorities also may want to check that relevant network slicing security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices for securing network slicing. We list some of the relevant technical documents in the table below.

Table 18: Slicing security reference list

Document Body Description URL

Technical reports and other documents

4.3 EDGE COMPUTING SECURITY

Edge computing refers to a cloud-based IT service environment located at the edge of a network. Multi-access Edge Computing (MEC) is a technology aiming to satisfy the requirements of high-bandwidth and low-latency applications which operate at the edge of the network . MEC is based on the convergence of IT and telecommunications networking. Key benefits are reduced network congestion and improved performance for low latency applications. The ability of storing, processing and delivering content locally without requiring backhauling and centralised core network is the main feature of the technology.

Deployment of MEC technology as part of an NFV environment is envisaged. Therefore, security requirements of MEC enabled applications are expected to be addressed within the

5G SUPPLEMENT

NFV security framework. Security fundamentals including data encryption, network visibility, automated monitoring and access control based on the principle of least privilege and supported by intrusion prevention and detection are all applicable to the MEC platform. Threats include infrastructure attacks related to wireless technology vulnerabilities (e.g. denial of service attacks to consume the bandwidth and computing resources at the edge or man in the middle attacks to inject or eavesdrop traffic from the edge), virtualisation attacks (e.g. denial of service and man in the middle attacks by rogue virtual machines) and privacy leakage (e.g. unauthorised access to information storage in the edge cloud).

A more detailed technical information about the MEC architecture can be found it ETL5G. The same report also identifies and described the key MEC threats (e.g. a false or rogue MEC gateway, edge node overload and abuse of edge open APIs) as well as the key areas of vulnerabilities (vulnerabilities related to virtualization and containerization, physical security, APIs and regulatory issues) and provides further explanations related to these vulnerabilities.

In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the chapter 3 of this supplement, competent authorities may want to check that relevant edge computing security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices, in particular relevant technical specifications and reports from ETSI, as a leading organization in standardization of MEC technology . We list some of the most relevant technical specifications and additional relevant technical reports and documents in the table below.

Table 19: MEC security reference list

Document Body Description URL

Technical specifications/standards

Technical reports and other documents

5G SUPPLEMENT

Additionally, competent authorities may also find useful to take note of the following additional security aspects related to MEC :

 MEC device clusters may be more susceptible to physical theft and infiltration as they are likely to be located in physically less secure locations. Similarly, software tampering of the MEC platform should be prevented. To achieve this, platform security, platform management security, data storage and transmission security need to be enhanced as well as introducing trusted computing technologies.  An increased number of entry points in the MEC environment (e.g. IoT use case) implies challenging attack surface and complex certificate management as the absence or weakness of security measures in MEC devices can be exploited and create vulnerabilities for the whole network. Ensuring real-time network visibility is one of the key considerations.  Robust authentication and authorisation procedures need to be in place for the MEC platform which is located much closer to access network than the core network. The key issue is how to establish a uniform level of security policies for all MEC elements to minimise the risks.  In terms of network resilience, the introduction of the MEC platform should not affect network availability. This means that MEC solution vendors should offer the level of resilience to meet high-availability requirements of network operators. An appropriate failsafe mechanism should be in place to prevent the MEC platform failure from adversely affecting the normal operation of the network.

5G SUPPLEMENT ANNEX I: LIST OF ACRONYMS

Acronym Meaning

5G SUPPLEMENT ANNEX II: 3GPP SECURITY REFERENCE LIST

The reference list in the table below contains references to 3GPP technical specification TS 33.501, which defines the 5G security architecture, as well as to a series of technical specification documents from the SCAS (Security Assurance Specifications) that contain relevant test cases for assessment of compliance with security requirements.

In addition, the table contains an additional list of 3GPP specs of relevance for NSA (nonstandalone) 5G deployments options. Further technical details about different implementation options/migration paths can be found in ETL5G . This includes the description of the main elements of a NSA architecture, as well as identification and analysis of specific risks (such as those related to legacy technologies, roaming risks or a failure to meet general security assurance requirements).

Table 20: 3GPP Security Specifications Reference List

Standard / Body Description URL specs/ doc

5G SUPPLEMENT 5G SUPPLEMENT ANNEX III: TOOLBOX MAPPING

The table below shows a mapping between the (supplemented) Guideline security domains and related technical measures form the Toolbox that are being addressed through the implementation of related measures and supplementary guidance or are related to them .

Table 21: Toolbox Mapping

D1: D2: D3: D4: D5: D6: D7: D8:

TM01         5G SUPPLEMENT -EN -759 -20 -01 TP ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

ISBN: 978-92-9204-456-5 DOI: 10.2824/098554 33