5G brings promise – and risk. Why security is critical as we build out the mobile networks of the future

By Jason S. Boswell, Vice President and Head of End-to-End Security, Ericsson North America

At a Congressional hearing in early November, Jen Easterly, Director of the Cybersecurity and Infrastructure Security Agency (CISA) told legislators that the increase in physical threats and ransomware attacks on the country’s critical infrastructure represents a threat to the American way of life itself.

This threat can only be met through collaborative engagement between industry leaders and government officials. At Ericsson, network security has been integral to our technology leadership, and we play a role by contributing to numerous security communities and standards bodies and leading dedicated security organizations and task groups. There are three key principles that come up consistently when we discuss how to best protect our nation’s critical infrastructure from cyberattacks. We must protect the integrity of the supply chain. We must secure network communication itself, end to end. And finally, we must ensure the resilience of the network.

Cyber issues are only going to intensify as critical industries like utilities, healthcare, manufacturing, public safety and more undergo digitalization through the latest generation of cellular technology in 5G. We need to view the country’s information communication technology (ICT) infrastructure itself as something that needs to be as well protected as nuclear power plants and oil and gas pipelines, a fact the SolarWinds and Colonial Pipeline incidents made clear. While modernization brings many benefits, it also increases vulnerability by bringing more information into the cloud and creating immense networks of connected devices, all of which increase the potential attack surface for malicious actors.

To keep America safe, our mission starts in the very networks themselves. Ericsson understands that network security is a key component of national security and is working closely with U.S. government agencies and industry groups to ensure that the latest generation of cellular networks are more secure than ever. We put security first through every step of the process, from our involvement in the development of the 5G standards to our active participation in government task forces working to safeguard networks against future threats.

In order to increase our protection of critical infrastructure and keep pace with evolving cyberattacks, government officials and all of us in the tech and communications industries must focus on three key things:

Uphold the integrity of the supply chain.

Communications infrastructure is complicated, both in the way it’s assembled and how it’s produced. As the industry trends toward multi-vendor hardware solutions and more open, virtualized software, clear line of sight into the supply chain is an important part of keeping the country’s 5G networks secure. A supply chain is only a strong as its weakest link, and as cyber criminals evolve, they will seek out vulnerabilities in ICT infrastructure they can use to attack everything from power plants to the banking system.

Ericsson’s $100 million 5G smart factory in Lewisville, Texas represents the company’s commitment to building the 5G networks that much of the country’s critical infrastructure will depend on. A secure supply chain must be built on trustworthiness, transparency and traceability, and 5G is no exception. For example, well before the SolarWinds or Colonial Pipeline cyberattacks over the past year prompted broad scrutiny of software assurance, all of Ericsson’s software was scanned, verified, cryptographically signed and centrally distributed; this guarantees that integrity is built in from the start. We have since encouraged similar best practices for securely using proprietary, third-party and open source software in development projects.

Ericsson recognizes the importance of protecting the U.S. supply chain and is working across government and industry groups to analyze and implement President Biden’s Executive Order designed to protect America’s supply chain from cyberattacks and other threats. Ericsson has provided significant input and leadership on software assurance, network security and supply chain risk management through many collaborative efforts between government and industry. In order to develop and harmonize best practices for the sourcing of trustworthy equipment to build both public and private 5G networks in the U.S., supply chain issues and their importance to allies of the U.S., in relation to trade, technology leadership and information sharing, should also be considered.

Secure the networks themselves, end to end.

5G represents a new era of network security and is significantly improved from previous mobile generations like 3G or 4G/LTE, with security built into the standards themselves. 3GPP is the industry body that sets standards for mobile communications, and in 5G, these include new advancements for security like enhanced subscriber privacy, greater interface protection, integrity protection of user traffic and improved authentication.

It is time for us to assume that “the bad guys are already in the house,” and adapt our defenses accordingly. While most traditional security measures focus on external threats, the zero trust model enhances security by both blocking unauthorized access to network resources and preventing internal lateral movement by an inside attacker. The heightened security features of 5G will enable the deployment of this “Zero Trust Architecture” (ZTA) across future networks.

Another emerging technology in the build out of 5G is the idea of Open RAN networks, where multiple vendors at the edges of the network come together in an interoperable, virtualized and disaggregated network, building upon 3GPP’s existing open and interoperable systems. While these disaggregated open networks will be a part of ramping up 5G build outs in the U.S., and security is improving, there are lingering concerns in the coming years due to inherent expansion of the threat surface. These issues are being actively addressed in the O-RAN Alliance, with contributions from Ericsson and other participants.

Ensure the resilience of the network. 

Beyond securing individual communications, the network itself must be resilient and reliable. This is more important than ever as 5G begins to enable a new economy based on the superior speed, low latency and end-to-end security it brings.

When fully deployed, 5G will be “virtualized,” meaning that many of the core network functions will happen within a cloud environment, offering improved resiliency and scalability. This will also allow for the implementation of new security solutions such as “network slicing” (dedicated sections of network architecture for different network or security functions) and automated, AI-enabled security that maximizes availability and performance.

Furthering that effort, Ericsson co-chaired the National Security Telecommunications Advisory Committee (NSTAC)’s Report to the President on Communications Resiliency, a year-long effort which recommended numerous ways that U.S. ICT infrastructure needs to be improved and protected over the next ten years.

Why does Ericsson see government collaboration as a priority? We recognize that joint effort is essential to the success of 5G and have committed significant resources to ensure that networks are secure, resilient and based on the highest standards of product integrity. We know that this is a bigger issue than just Ericsson’s equipment, and the ICT industry has shown, again and again, that it deserves to be viewed as critical infrastructure. Ericsson’s core values center around connecting people and ubiquitous, secure connectivity for all – that starts with having a trustworthy, reliable system that the public can depend on.

The content is paid for and supplied by the advertiser. The Washington Post newsroom was not involved in the creation of this content.

Content From