Telecom Security Realities from 2025 and Lessons for 2026

Telecom security rarely stands still. Each year brings new technologies, new attack paths, and new operational realities. Yet 2025 was not defined by dramatic new exploits or spectacular network failures. Instead, it became a year that highlighted how persistent, patient and methodical modern telecom attackers have become.

The recent SecurityGen Year-End Telecom Security Webinar offered a detailed look back at what the industry experienced during 2025. The session pulled together research findings, real world incidents and practical lessons from across multiple domains, including legacy signalling, eSIM ecosystems, VoLTE vulnerabilities and the emerging world of satellite-based mobile connectivity.

For anyone working in mobile networks, the message was clear. The threats are evolving, but many of the core problems remain stubbornly familiar.

A Year of Stealth Rather Than Spectacle

One of the most important themes from the webinar was that 2025 did not bring a wave of highly visible disruptive telecom attacks. Instead, it was characterised by quiet, low profile intrusions that often went undetected for long periods.

Operators around the world reported that attackers increasingly favoured living-off-the-land techniques. Rather than deploying noisy malware, intruders looked for ways to gain legitimate access to core systems and remain hidden. Lawful interception platforms, subscriber databases such as HLR and HSS, and internal management platforms were all targeted.

The primary objective in many cases was intelligence collection. Attackers were interested in call data, subscriber information and network topology rather than immediate disruption. This shift in motivation makes detection far more difficult, as there are often few obvious signs of compromise.

At the same time, automation has become a defining feature on both sides of the security battle. Operators are investing heavily in AI and machine learning to identify abnormal behaviour. Attackers are doing exactly the same, using automation to scale phishing campaigns and to accelerate exploit development.

Despite all this technology, basic security discipline continues to be a major challenge. A significant proportion of incidents still originate from human error, poor operational practices or simple failure to apply patches. The industry continues to invest billions in cybersecurity, but much of that effort is consumed by reporting and compliance activities rather than direct threat mitigation.

eSIM Security Comes into Sharp Focus

The transition from physical SIM cards to eSIM and remote provisioning is one of the most significant structural changes in the mobile industry. It offers clear benefits in terms of flexibility and user experience. However, the webinar highlighted that it also introduces entirely new security concerns.

Traditional SIM security models relied heavily on physical control. Fraudsters needed access to large numbers of real SIM cards to operate at scale. With eSIM, many of those physical constraints disappear. Remote provisioning expands the number of parties involved in the connectivity chain, including resellers and intermediaries who may not always operate under strict regulatory oversight.

During 2025 several major SIM farm operations were dismantled by law enforcement. These infrastructures contained tens of thousands of active SIM cards and were used for large scale fraud, smishing campaigns and automated account creation. While such operations existed long before eSIM, the technology has the potential to make them even easier to deploy and manage.

Research discussed in the session pointed to additional concerns. Analysis of travel eSIM services revealed issues such as cross-border routing of management traffic, excessive levels of control granted to resellers, and lifecycle management weaknesses that could potentially be abused by attackers. In some cases, resellers were found to have capabilities similar to full mobile operators, but without equivalent governance or transparency.

The conclusion was not that eSIM is inherently insecure. The technology itself uses strong encryption and robust mechanisms. The problem lies in the wider ecosystem of trust boundaries, partners and processes that surround it. Securing eSIM therefore requires cooperation between operators, vendors, regulators and service providers.

SS7 Remains a Persistent Weak Point

Few topics in telecom security generate as much ongoing concern as SS7. Despite being a technology from a previous era, it remains deeply embedded in global mobile infrastructure. The webinar dedicated significant attention to why SS7 continues to be exploited in 2025 and why it is likely to remain a problem for many years to come.

Throughout the year, media reports and research papers continued to demonstrate practical abuses of SS7 signalling. Attackers probed networks, attempted to bypass signalling firewalls and looked for new ways to manipulate protocol behaviour. Techniques such as parameter manipulation and protocol parsing tricks were highlighted as methods that can sometimes evade existing protections.

One particularly interesting demonstration showed how SS7 messages could be used as a covert channel for data exfiltration. By embedding information inside otherwise legitimate signalling transactions, attackers can potentially move data across networks without triggering traditional security alarms.

Perhaps the most striking point raised was how little progress has been made in eliminating SS7 dependencies. Analysis of global network deployments showed that only a handful of countries operate mobile networks entirely without SS7. Everywhere else, the protocol remains a foundational element of roaming and interconnect.

As a result, even operators that have invested heavily in 4G and 5G security can still be undermined by weaknesses in this legacy layer. The uncomfortable reality is that SS7 vulnerabilities will continue to be exploited well into 2026 and beyond.

VoLTE and Modern Core Network Risks

While legacy protocols remain a problem, modern technologies are not immune. VoLTE infrastructure in particular was identified as an increasingly attractive target.

VoLTE relies on complex interactions between signalling systems, IP multimedia subsystems and subscriber databases. Weaknesses in configuration or interconnection can open the door to call interception, fraud or denial of service. Several real world incidents during 2025 demonstrated that attackers are actively exploring these paths.

The move toward fully virtualised and cloud-native mobile cores also introduces new operational challenges. Telecom networks now resemble large IT environments, complete with the same risks around misconfiguration, insecure APIs and exposed management interfaces.

The Emerging Security Challenge of 5G Satellites

One of the most forward-looking parts of the webinar focused on non-terrestrial networks and direct-to-device satellite connectivity. What was once a concept for the distant future is rapidly becoming a commercial reality.

Satellite integration promises to extend 5G coverage to remote areas, oceans and disaster zones. However, it also changes the security model in fundamental ways. Satellites can act either as simple relay systems or as active components of the mobile radio access network. In both cases, new threat vectors emerge.

Potential issues discussed included the risk of denial of service against shared satellite resources, difficulties in applying traditional radio security controls in space-based equipment, and the possibility of more precise user tracking due to the way satellite systems handle location information.

Experts from the space cybersecurity community explained how vulnerabilities in mission control software and ground segment infrastructure could be exploited. Much of this software was originally designed for isolated environments and is only now being connected to wider networks and the internet.

As telecom networks expand beyond the boundaries of the Earth, security responsibilities extend with them. Operators will need to think not only about terrestrial threats but also about risks originating from space-based components.

The Human Factor and the Skills Gap

Technology was only part of the story. Another recurring theme was the global shortage of skilled telecom cybersecurity professionals.

Studies referenced in the session suggested that millions of additional specialists are needed worldwide, yet only a fraction of that demand can currently be filled. Many security teams are overwhelmed by the sheer volume of alerts and data they must process.

This shortage has real consequences. When teams are stretched thin, patching is delayed, anomalies are missed and complex investigations become difficult to sustain. The panel emphasised that throwing more tools at the problem is not enough. Organisations must focus on training, automation and smarter operational processes.

Automation and AI-driven analysis were presented as essential enablers. Given the scale of modern mobile networks, it is simply not feasible for human analysts to monitor every signalling protocol, every core interface and every emerging technology manually.

Preparing for 2026

Looking ahead, the experts agreed on several broad trends. Attacks on legacy systems such as SS7 will continue. Fraudsters will increasingly target eSIM provisioning processes. VoLTE and 5G core components will face growing scrutiny. Satellite-based connectivity will introduce new and unfamiliar security questions.

Perhaps most importantly, the line between traditional telecom security and general cybersecurity will continue to blur. Mobile networks are now large, distributed IT platforms, and they inherit all the complexities that come with that transformation.

Operators, regulators and vendors must therefore adopt a holistic view. Investment must go beyond compliance reporting and focus on practical defences, real time monitoring and collaborative intelligence sharing.

Final Reflections

The SecurityGen webinar provided a valuable snapshot of an industry at a crossroads. Telecom networks are becoming more advanced and more capable, but also more complex and interconnected than ever before.

2025 demonstrated that attackers do not always need new vulnerabilities. Often they succeed simply by exploiting old weaknesses in smarter ways. The challenge for 2026 is to close those gaps while also preparing for the technologies that are only just beginning to emerge.

For those involved in telecom security, the full discussion is well worth watching. The complete webinar recording can be viewed below:

Related Posts:

• The 3G4G Blog: Evolving Communication Security Towards 6G at the ETSI Security Conference 2025
• The 3G4G Blog: Detection of Real-world Fake Base Station (FBS) Attacks in Thailand
• The 3G4G Blog: Attack Surfaces for Different Generations of Mobile Technologies
• The 3G4G Blog: Presentations from ETSI Security Conference 2023
• The 3G4G Blog: Top 10 New (2022) Security Standards That You Need to Know About!
• The 3G4G Blog: Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Everything you need to know about 5G Security
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks 

Evolving Communication Security Towards 6G at the ETSI Security Conference 2025

The annual ETSI Security Conference returned to the French Riviera from 6 to 9 October, once again bringing together the global cybersecurity community in the beautiful surroundings of ETSI headquarters. Over 250 participants from industry, government agencies, academia, global standards bodies, and open-source communities attended, making it one of the most engaging editions to date. The four-day event featured keynotes, panel discussions, technical sessions, poster presentations and live demonstrations, offering a holistic view of today’s security challenges and tomorrow’s opportunities.

The opening day provided a broad overview of the global cybersecurity landscape, setting the tone for the week ahead. Discussions highlighted emerging trends such as the growing influence of artificial intelligence and the rapid evolution of regulatory frameworks, including the European Commission’s Cyber Resilience Act. The sessions underscored the importance of collaboration between policymakers, researchers, and standards organisations. The afternoon focused on the cyber skills gap, a recurring theme across many sectors, stressing the need for education and training to build a security-aware workforce capable of safeguarding future digital systems. Standards were identified as key enablers in bridging policy and implementation, helping to transform regulatory intent into operational resilience.

The second day examined the paradox between AI as both a risk and a defence mechanism in cybersecurity. Experts discussed how AI-driven systems can expose new vulnerabilities if developed without strong security foundations, while also offering powerful tools for detection and response. Another session addressed fraud reduction and the convergence of security strategies to protect both networks and end users. A major highlight was the discussion on the global uptake of ETSI’s consumer IoT security standard, ETSI EN 303 645. Representatives from Germany, the UK, Singapore and Japan shared national experiences implementing consumer labelling schemes based on this standard, confirming its status as a globally recognised baseline for IoT security.

3GPP SA3 Update from ETSI Security Conference 2025 - https://t.co/COyRhvGcfQ#Free5Gtraining #3G4G5G #3GPP #5G #5GAdvanced #6G #ETSI #TheStandardsPeople #SecurityConference #3GPPSA3 #Release19 #Release20 #Release21 pic.twitter.com/dYWlNm1xWf

— Free 5G Training (@5Gtraining) October 13, 2025

The third day was dedicated to the evolution of communication technologies and the emerging security landscape as the world moves towards 6G. Chaired by Dario Sabella from xFlow Research, the morning session explored how the journey from 5G Advanced to 6G requires a fresh approach to network security. The day began with an update from Alain Sultan of ETSI on the ongoing work within 3GPP SA3, focusing on strengthening frameworks for new architectures and deployment models. Bengt Salin from Ericsson outlined what should be considered in shaping security for 6G, emphasising that the next generation must be secure by design, not by adaptation. Nauman Khan from STC analysed the threat landscape surrounding 5G MEC and private networks, noting that as edge computing becomes more widespread, it introduces new vulnerabilities but also provides insights that can guide 6G security frameworks. Leyi Zhang from ZTE then presented on Secure Space-Air-Ground Integrated Networks, a concept uniting terrestrial, aerial, and satellite systems to provide ubiquitous connectivity. Ensuring trust, authentication, and data protection across such a heterogeneous environment presents one of the greatest challenges for 6G.

A panel discussion moderated by Dario Sabella brought together the morning’s speakers to reflect on security priorities toward 6G. The consensus was clear: while 6G is still in the early stages of standardisation, security must not be an afterthought. Lessons from 5G—particularly regarding openness, complexity, and trust—must inform the architecture and design principles of 6G from the outset. The afternoon sessions continued with broader discussions about digital sovereignty, fragmentation, and whether the internet is moving toward a “splinternet”. The day concluded with a deep dive into post-quantum cryptography, where real-world implementations provided valuable lessons for securing the next era of communication systems.

The final day of the conference shifted attention to geopolitics, cyber resilience, and the role of standards in shaping strategic responses to global challenges. Speakers explored how critical infrastructure security is increasingly influenced by geopolitical dynamics and how coordinated international standards can help mitigate risks. The Cyber Resilience Act remained a focal point, with experts emphasising the urgency of developing the 19 associated ETSI standards to support implementation. Harmonising global labelling schemes based on ETSI EN 303 645 was identified as an immediate priority, while in the longer term, education—both for future generations and C-level executives—was seen as essential to strengthen awareness of how standards underpin sovereignty, innovation, and competitiveness.

The 2025 edition of the ETSI Security Conference reaffirmed ETSI’s position as a central hub for cybersecurity dialogue and collaboration. From 5G and IoT to post-quantum cryptography and 6G, it showcased how security is now integral to every layer of the digital ecosystem. As the journey toward IMT-2030 continues, the message from Sophia Antipolis was clear: proactive, standards-based collaboration is the foundation of a secure connected future.

You can see the detailed agenda here. The presentations from the conference are all available here.

Related Posts: 

• The 3G4G Blog: Understanding ETSI’s Industry Specification Groups (ISGs) and Why They Matter
• The 3G4G Blog: Presentations from ETSI Security Conference 2023 

Detection of Real-world Fake Base Station (FBS) Attacks in Thailand

It's been a while since we created our security tutorial, back in 2018. One of the items we discussed in there were the fake cell towers or the fake base stations. The issues highlighted there still exist as highlighted by AIS CISO, Pepijn Kok at The Telecom Threat Intelligence Summit (TTIS) 2024.

The cyber threat actors exploited GSM authentication vulnerabilities to use fake base stations as part of SMS phishing attacks to steal from real bank accounts. In his talk Pepijn explains how AIS worked with ecosystem partners in Thailand to detect and block these attacks.

The talk described two case studies. The first one was a report from Dec 2022 where certain bank customers and online retail platform users were receiving SMS messages masquerading as the bank or online platform itself (something not typically possible). The messages contained links to malicious content. The second one is a recent case from April 2024 where AIS customers started receiving fake SMS with malicious links. It was obvious in that case that the SMS did not come from the AIS network which triggered AIS to start investigating as they were sure there was a fake base station in operation. The talk describes how in both the scenarios the gangs were caught.

The talk is embedded below:

You can learn more about TTIS here. The video of all the talks from day 1 is here and day 2 is here.

Related Posts: 

• The 3G4G Blog: Attack Surfaces for Different Generations of Mobile Technologies
• The 3G4G Blog: Presentations from ETSI Security Conference 2023
• The 3G4G Blog: Top 10 New (2022) Security Standards That You Need to Know About!
• The 3G4G Blog: Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Realizing Zero Trust Architecture for 5G Networks
• The 3G4G Blog: Bug hunting in 5G Networks and Devices
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• 3G4G: Overview of Security in Mobile Cellular Networks 

Attack Surfaces for Different Generations of Mobile Technologies

At DEF CON 31 last year, Tracy Mosley, Vulnerability Researcher at Trenchant presented a talk titled "Nothin’ but a G Thang - The Evolution of Cellular Networks" (background of title). The abstract of the talk says:

In this talk we will walk through each step of cellular evolution, starting at 2G and ending at 5G. The never-ending attack and defend paradigm will be clearly laid out. In order to understand the attack surface, I’ll cover network topology and protocol. For each cellular generation, I will explain known vulnerabilities and some interesting attacks. In response to those vulnerabilities, mitigations for the subsequent cellular generation are put in place. But as we all know, new mitigations mean new opportunities for attackers to get creative. While I will explain most cellular-specific terminology, a familiarity with security concepts will help to better understand this talk. Basic foundations of communications systems, information theory or RF definitely make this talk more enjoyable, but are absolutely not necessary. It’s a dense topic that is highly applicable to those working on anything that touches the cellular network!

The talk is embedded below:

The presentation can be downloaded from here.

Related Posts: 

• The 3G4G Blog: Presentations from ETSI Security Conference 2023
• The 3G4G Blog: Top 10 New (2022) Security Standards That You Need to Know About!
• The 3G4G Blog: Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Lawful Intelligence and Interception in 5G World with Data and OTT Apps
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks 

Presentations from ETSI Security Conference 2023

It's been a while since I wrote about the ETSI Security Conference, which was known as ETSI Security week once upon a time. This year, ETSI’s annual flagship event on Cyber Security took place face-to-face from 16 to 19 October 2023, in ETSI, Sophia Antipolis, France and gathered more than 200 people. 

The event this year focused on Security Research and Global Security Standards in action The event also considered wider aspects such as Attracting the next generation of Cyber Security standardization professionals and supporting SMEs.

5G Security in practice and future by Rong Wu, Huawei from ETSI Security Conference 2023 - https://t.co/GByIjxcxST#Free5Gtraining #3G4G5G #5G #5GNetworks #Security #5GSecurity #ETSIsecurityConf #TheStandardsPeople #3GPP #Standards #Rel18 #SecurityAssurance #AmbientIoT #IoT pic.twitter.com/sotNyZkBLy

— Free 5G Training (@5Gtraining) October 26, 2023

The following topics were covered

• Day 1:
• Session 1: Global Cyber Security
• Session 2: Global Cyber Security
• Session 3: Regulation State of the Nation
• Session 4: Regulation, Data Protection and Privacy, Technical Aspects
• Day 2:
• Session 1: Zero Trust, Supply Chain & Open Source
• Session 2: IoT & Certification
• Session 3: Zero Trust, Supply Chain & Open Source
• Session 4: Quantum Safe Cryptography Session
• Day 3:
• Session 1: Experiences of Attracting Next Generation of Engineers and Investing in Future
• Session 2: IoT and Certification Session
• Session 3: IoT & Mobile Certification
• Session 4: 5G in the Wild - Part 1
• Day 4:
• Session 1: 5G in the Wild - Part 2
• Session 2: 6G Futures
• Session 3: Augmented Reality and AI

You can see the detailed agenda here. The presentations from the conference are available here.

The CyberSecurity Magazine interviewed Helen L. And Jane Wright discussing diversity and careers in Cybersecurity. Helen, from the National Cyber Security Centre, has worked in Security for over 20 years and is a mentor at the CyberFirst programme. CyberFirst intends to inspire and encourage students from all backgrounds to consider a career in cybersecurity. Jane Wright is a Cyber Security Engineer at QinetiQ and has been participating in the CyberFirst. The interview, along with a video, is available here.

Related Posts: 

• The 3G4G Blog: Top 10 New (2022) Security Standards That You Need to Know About!
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Presentations from ETSI Security Week 2019 (#ETSISecurityWeek) 

Top 10 New (2022) Security Standards That You Need to Know About!

I had been meaning to add this session to the blog for a while. Some security researchers may find these useful. 

At RSA Conference 2022, Bret Jordan, CTO, Emerging Technologies, Broadcom and Kirsty Paine, Advisor - Technology & Innovation, EMEA, Splunk Inc. presented a talk covering what they described as the most important, interesting and impactful technical standards, hot off the press and so 2022. From the internet and all its things, to the latest cybersecurity defenses, including 5G updates and more acronyms than one can shake a stick at. 

"10 Security Standards in 2022 You Can't Live Without". Great #RSAC2022 presentation by @symantec Broadcom Software's @jordan_bret and @Splunk's Kirsty Paine. Download the slides here: https://t.co/aEqqnQvicM pic.twitter.com/CiIhDH7tu6

— Patrick Donegan (@HardenStance) July 13, 2022

The video is embedded below and the slides are available here.

Related Posts: 

• The 3G4G Blog: Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Lawful Intelligence and Interception in 5G World with Data and OTT Apps
• The 3G4G Blog: Realizing Zero Trust Architecture for 5G Networks
• The 3G4G Blog: Bug hunting in 5G Networks and Devices
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy) 

Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)

3GPP Release 17 introduced a new feature called AKMA (Authentication and Key Management for Applications), the goal of which is to enable the authentication and generation of application keys based on 3GPP credentials for all UE types in the 5G System, especially IoT devices, ensuring to bootstrap the security between the UE and the applications in the 5G system.

3GPP TR 21.917 has an excellent summary as follows:

Authentication and key management for applications based on 3GPP credential in 5G (AKMA) is a cellular-network-based delegated authentication system specified for the 5G system, helping establish a secure tunnel between the end user and the application server. Using AKMA, a user can log in to an application service only based on the 3GPP credential which is the permanent key stored in the user’s tamper-resistant smart card UICC. The application service provider can also delegate the task of user authentication to the mobile network operator by using AKMA. 

The AKMA architecture and procedures are specified by SA3 in TS 33.535, with the related study showing how its general principles are derived documented in TR 33.835. The AKMA feature introduces a new Network Function into the 5G system, which is the AKMA Anchor Function (AAnF). Its detailed services and API definitions are specified by CT3 in TS 29.535. Earlier generations of cellular networks include two similar standards specified by SA3, which are generic bootstrapping architecture (GBA) and battery-efficient security for very low throughput machine type communication devices (BEST). Since the AKMA feature is deemed as a successor of these systems, the work is launched by SA3 without the involvement of stage 1.

In the latest issue of 3GPP Highlights Magazine, Suresh Nair, 3GPP Working Group SA3 Chair, Saurabh Khare & Jing Ping (Nokia) has explained the AKMA procedure. The article is also available on 3GPP website here. The article lists the following as AKMA advantages:

• Since the AKMA framework uses authentication and authorization of the UE leveraging the PLMN credentials stored on the USIM, this becomes as strong as the network primary authentication and subsequent keys derived further to UE and Application Function (AF) interface.
• The Application Functions can leverage the authentication service provided by the AKMA Anchor Function (AAnF) without additional CAPEX and OPEX.
• The architecture provides a direct interface between the UE and the AF where a customized application-specific interface can be built, including the key management, key lifetime extension, etc.

The Journal of ICT Standardization has a paper on Authentication Mechanisms in the 5G System. It details AKMA and much more. It's a great place to start for anyone new looking to understand different 5G Authentication Mechanisms. 

Related Posts: 

• The 3G4G Blog: 3GPP Release 17 Description and Summary of Work Items
• The 3G4G Blog: Lawful Intelligence and Interception in 5G World with Data and OTT Apps
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Realizing Zero Trust Architecture for 5G Networks
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Introduction to 3GPP Security in Mobile Cellular Networks
• The 3G4G Blog: Initiative to Remove Non-inclusive terms from 3GPP Specifications
• The 3G4G Blog: 3GPP 5G Non Terrestrial Networks (NTN) Standardization Update
• The 3G4G Blog: 3GPP Explains TSG CT Work on UAS Connectivity, Identification and Tracking 

5G and Cyber Security

Dr. Seppo Virtanen is an Associate Professor in Cyber Security Engineering and Vice Head of Department of Computing, the University of Turku, Finland. At 5G Hack The Mall 2022, he presented a talk on Cybersecurity and 5G. 

In the talk he covered the following topics:

• Cybersecurity and Information Security
• The CIA (Confidentiality, Integrity and Availability) Model
• Achieving the goals of the CIA model
• Intrusion and Detection
• Intrusion detection, mitigation and aftercare
• Smart Environments
• Abstraction levels
• Cybersecurity in smart environments
• Cyber security concerns in smart environments
• Security concerns in Smart Personal Spaces
• Security concerns in Smart Rooms and Buildings
• Security concerns of a participant in a smart environment
• Cyber Security Concerns in Smart Environments
• Cyber Security in the 5G context
• Drivers for 5G security
• Securing 5G

This video embedded below is a nice introduction to cybersecurity and how it overlaps with 5G:

Related Posts:

• The 3G4G Blog: Lawful Intelligence and Interception in 5G World with Data and OTT Apps
• The 3G4G Blog: Realizing Zero Trust Architecture for 5G Networks
• The 3G4G Blog: Bug hunting in 5G Networks and Devices
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks 

Lawful Intelligence and Interception in 5G World with Data and OTT Apps

Not long ago we looked at the 'Impact of 5G on Lawful Interception and Law Enforcement' by SS8. David Anstiss, Senior Solutions Architect at SS8 Networks gave another interesting talk on Evolving Location and Encryption Needs of LEAs in a 5G world at Telecoms Europe Telco to Techco virtual event in March.

In this talk, David provided an insight in​to how 5G is impacting lawful interception and the challenges Law Enforcement Agencies face as they work with Communication Service Providers to gather intelligence and safeguard society. While there is an overlap with the previous talk, in this video David looked at a real world example with WhatsApp. The talk also covered:

• Real-world problems with 5GC encryption
• 5G location capabilities and the impact on law enforcement investigations
• Optimal solutions for both CSPs and LEAs

The video of the talk is embedded below:

Related Posts:

• The 3G4G Blog: Impact of 5G on Lawful Interception and Law Enforcement
• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Exploiting Possible 5G Vulnerabilities
• The 3G4G Blog: Presentations from ETSI Security Week 2019 (#ETSISecurityWeek)
• The 3G4G Blog: VoLTE Hacking
• The 3G4G Blog: Evolution of Security from 4G to 5G 

Realizing Zero Trust Architecture for 5G Networks

Over the last couple of years, I keep on coming across Zero-Trust Architecture (ZTA). A simple way to explain is that the standard model of security is known as perimeter security model, where everything within the perimeter can be trusted. In zero-trust (ZT) model, no assumptions is made about trustworthiness and hence it is also sometimes known as perimeterless security model.

This short video from IBM clearly explains what ZT means:

This blog post from Palo Alto Networks also clearly explains ZT:

By definition, Zero Trust is a strategic approach to cybersecurity that secures an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Zero Trust for 5G removes implicit trust regardless of what the situation is, who the user is, where the user is or what application they are trying to access.

The impact of Zero Trust on network security specifically protects the security of sensitive data and critical applications by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention and simplifying granular user-access controls. Where traditional security models operate under the assumption that everything inside an organization’s perimeter can be trusted, the Zero Trust model recognizes that trust is a vulnerability.

In short, Zero Trust for 5G presents an opportunity for service providers, enterprises and organizations to re-think how users, applications and infrastructure are secured in a way that is scalable and sustainable for modern cloud, SDN-based environments and open-sourced 5G networks. Delivering the Zero Trust Enterprise means taking Zero Trust principles, making them actionable and effectively rebuilding security to keep pace with digital transformation. 

A research paper looking at Intelligent ZTA (i-ZTA) provides an interesting approach to security in 5G and beyond. The paper can be downloaded from here. The abstract states:

While network virtualization, software-defined networking (SDN), and service-based architectures (SBA) are key enablers of 5G networks, operating in an untrusted environment has also become a key feature of the networks. Further, seamless connectivity to a high volume of devices in multi-radio access technology (RAT) has broadened the attack surface on information infrastructure. Network assurance in a dynamic untrusted environment calls for revolutionary architectures beyond existing static security frameworks. This paper presents the architectural design of an i-ZTA upon which modern artificial intelligence (AI) algorithms can be developed to provide information security in untrusted networks. We introduce key ZT principles as real-time Monitoring of the security state of network assets, Evaluating the risk of individual access requests, and Deciding on access authorization using a dynamic trust algorithm, called MED components. The envisioned architecture adopts an SBA-based design, similar to the 3GPP specification of 5G networks, by leveraging the open radio access network (O-RAN) architecture with appropriate real-time engines and network interfaces for collecting necessary machine learning data. The i-ZTA is also expected to exploit the multi-access edge computing (MEC) technology of 5G as a key enabler of intelligent MED components for resource-constraint devices.

Ericsson Technology Review covered Zero Trust in 5G Networks in one of their issues. Quoting from the article:

The 3GPP 5G standards define relevant network security features supporting a zero trust approach in the three domains: network access security, network domain security and service-based architecture (SBA) domain security. 

The network access security features provide users with secure access to services through the device (mobile phone or connected IoT device) and protect against attacks on the air interface between the device and the radio node. Network domain security includes features that enable nodes to securely exchange signaling data and user data, for example, between radio and core network functions (NFs).

The 5G SBA is built on web technology and web protocols to enable flexible and scalable deployments using virtualization and container technologies and cloud-based processing platforms. SBA domain security specifies the mechanism for secure communication between NFs within the serving network domain and with other network domains. 

While the new requirements and functionality introduced in the 5G specifications are already aligned with many of the zero trust tenets. It is already evident, however, that further technology development, standardization and implementation are needed in areas such as policy frameworks, security monitoring and trust evaluation to support the adoption of zero trust architecture in new telecom environments that are distributed, open, multi-vendor and/or virtualized.

While various technologies can support organizations in adhering to the guiding principles of zero trust as part of their total active defense strategy, it is important to remember that technology alone will never be sufficient to realize the full potential of zero trust. Successful implementation of a network based on zero trust principles requires the concurrent implementation of information security processes, policies and best practices, as well as the presence of knowledgeable security staff. Regardless of where a CSP is in its transition toward a zero trust architecture, the three pillars of people, processes and technology will continue to be the foundation of a robust security architecture.

Related Posts:

• 3G4G: 5G Security Overview by Mpirical
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: Bug hunting in 5G Networks and Devices
• The 3G4G Blog: Impact of 5G on Lawful Interception and Law Enforcement.
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Nokia Lectures in Collaboration with Bangalore University
• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy) 

Bug hunting in 5G Networks and Devices

Pentests or Penetration testing is ethical hacking that is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system. They are performed to identify weaknesses or vulnerabilities, including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed.

Sébastien Dudek, Founder and Security Engineer at PentHertz did a presentation at No Hat conference 2021. The outline of his talk says:

Expected to be released in 2021, we only see the early stage of 5G-NR connectivity in rare places around the world and we cannot talk yet about "real 5G" as current installations are put on the Non-Standalone mode (NSA) using 4G infrastructures. But in the meantime, it is important to get prepared for this upcoming technology and ways we can practically simulate real-world attacks in the future, with Standalone (SA) mode-capable devices and networks. In this presentation, we will see how to conduct practical security assignments on future 5G SA devices and networks, and how to investigate the protocol stack. To begin the presentation, we briefly present the differences with 2G-5G in terms of security applied to security assessment contexts, i.e. the limit we are left with, and how to circumvent them. Then we see how a 5G-NR security testbed looks like, and discuss what type of bugs are interesting to spot. Third, we make more sense about some attacks on devices by showing attacks that could be performed on the core side from the outside. Finally, we briefly introduce how we could move forward by looking at the 5G protocol stack and the state of the current mean.

Slides are available here and the video is embedded below:

A post on their website also looks at penetration of standalone 5G core. The post contains a video as well which can also be directly accessed here.

A new white paper from 5G Americas provides nearly annual updates around the topic of security in wireless cellular networks. The current edition addresses emerging challenges and opportunities, making recommendations for securing 5G networks in the context of the evolution to cloud-based and distributed networks. 

New whitepaper from 5G Americas, 'Security for 5G' provides a good overview of security in 3GPP Rel-15 & 16 - https://t.co/z0SxZUTWRK#Free5Gtraining #5GAmericas #5G #5GTechnology #5GSecurity #5GCore #SBA #Security #OpenRAN #SuuplyChain #Transportation #ZTN #APIs pic.twitter.com/fnWCIArTFv

— Free 5G Training (@5Gtraining) December 13, 2021

Additionally, the white paper provides insight into securing 5G in private, public, and hybrid cloud deployment models. Topics such as orchestration, automation, cloud-native security, and application programming interface (API) security are addressed. The transition from perimeter-based security to a zero-trust architecture to protect assets and data from external and internal threats is also discussed.

Related Posts: 

• 3G4G: 5G Security Overview by Mpirical
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Impact of 5G on Lawful Interception and Law Enforcement
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks
• Free 6G Training: 6G Security Considerations 

Impact of 5G on Lawful Interception and Law Enforcement.

At Telecoms Europe 5G 2021 event, David Anstiss, Senior Solutions Architect, SS8 Networks gave a talk on Impact of 5G on lawful interception and law enforcement. The talk provided an insight in​to how 5G is impacting lawful interception, and the challenges faced by intelligences agencies as they work with communication service providers to gather information, to safeguard society.

The talk, followed by Q&A is embedded below:

You may also find this blog post titled, 'Five Challenges of Gathering Digital Evidence in a 5G World' by David Anstiss, interesting.

Related Posts:

• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Exploiting Possible 5G Vulnerabilities
• The 3G4G Blog: Presentations from ETSI Security Week 2019 (#ETSISecurityWeek)
• The 3G4G Blog: VoLTE Hacking
• The 3G4G Blog: Evolution of Security from 4G to 5G 

AT&T Cybersecurity Experts Provide 5G Security Overview

The National Governors Association (NGA) in the USA is the voice of the leaders of 55 states, territories, and commonwealths. On May 24th, the Resource Center for State Cybersecurity featured a panel of experts from AT&T for a conversation on understanding the 5G ecosystem, security risks, supply chain resilience and the challenges and opportunities that exist around deployment.

The talk highlighted top 5G security areas of concern. The top three being:

• Increased attack surface due to massive increase in connectivity
• Greater number & variety of devices accessing the network
• Complexity of extending security policy to new types of non-traditional and IoT devices

Some of the Security Advantages with 5G are highlighted as follows:

• Software Defined Networking/Virtualization
• Stronger 3GPP encryption for over-the-air encryption
• Subscriber Identity Privacy
• Roaming or network-to-network protection
• Network Slicing

The slides of the talk is available here and the video is as follows:

Related Posts:

• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Evolution of Security from 4G to 5G
• The 3G4G Blog - Tutorial: Service Based Architecture (SBA) for 5G Core (5GC)
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks
• 3G4G: 5G (IMT-2020) Wireless 

Everything you need to know about 5G Security

5G & Security are both big topics on this blog as well as on 3G4G website. We reached out to 3GPP 5G security by experts from wenovator, Dr. Anand R. Prasad & Hans Christian Rudolph to help out audience understand the mysteries of 5G security. Embedded below is video and slides from a webinar they recorded for us.

You can ask any security questions you may have on the video on YouTube

5G Security Briefing from 3G4G

The slides could be downloaded from SlideShare.

Related Posts:

• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Evolution of Security from 4G to 5G
• The 3G4G Blog - Tutorial: Service Based Architecture (SBA) for 5G Core (5GC)
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks
• 3G4G: 5G (IMT-2020) Wireless 

Nokia Lectures in Collaboration with Bangalore University

Nokia recently delivered some lectures virtually to Bangalore University students. The talks covered a variety of talks from LTE to 5G, Security & IMS. The playlist from Nokia is embedded below. The video contains following topics:

Part 1: 5G - General Introduction and IoT Specific Features
Part 2: 5G Overview
Part 3: Network Security Practices and Principles
Part 4: LTE Network Architecture - Interface and Protocols
Part 5: IMS - IP Multimedia Subsystem

Related Posts:

• The 3G4G Blog: 5G Evolution with Matthew Baker, Nokia
• 3G4G: Ultra Reliable Low Latency Communication for 5G New Radio
• Telecoms Infrastructure Blog: Nokia's 5G Small Cells in Limelight
• Telecoms Infrastructure Blog: Nokia's AirScale indoor Radio (ASiR) Small Cells
• Telecoms Infrastructure Blog: LuxTurrim5G smart light pole concept
• Connectivity Technology Blog: Verizon and Nokia Put Small Cell in the Air at #OCR2019
• Connectivity Technology Blog: Paris Metro is now 100% covered with LTE
• Connectivity Technology Blog: Air-to-Ground (A2G) Network for Emergency Communications
• The 3G4G Blog: 5G Dynamic Spectrum Sharing (DSS)
• 3G4G: Introduction to NR-Light a.k.a. NR-Lite

Lawful Intercept in 5G Networks

Mats Näslund is a cryptologist at the National Defence Radio Establishment outside Stockholm, an agency under the Swedish dept. of defence. As part of his work, he represents Sweden in technical LI standardization in 3GPP. Mats also has a part time appointment as adjunct professor at KTH. Her recently delivered a HAIC Talk on Lawful Intercept in 5G Networks. HAIC Talks is a series of public outreach events on contemporary topics in information security, organized by the Helsinki-Aalto Institute for Cybersecurity (HAIC).

The following is the description from HAIC website:

Our societies have been prospering, much due to huge technological advances over the last 100 years. Unfortunately, criminal activity has in many cases also been able to draw benefits from these advances. Communication technology, such as the Internet and mobile phones, are today “tools-of-the-trade” that are used to plan, execute, and even hide crimes such as fraud, espionage, terrorism, child abuse, to mention just a few. Almost all countries have regulated how law enforcement, in order to prevent or investigate serious crime, can sometimes get access to meta data and communication content of service providers, data which normally is protected as personal/private information. The commonly used term for this is Lawful Interception (LI). For mobile networks LI is, from a technical standpoint, carried out according to ETSI and 3GPP standards. In this talk, the focus will lie on the technical LI architecture for 5G networks. We will also give some background, describing the general, high-level legal aspects of LI, as well as some current and future technical challenges.

The slides are available here.

Related Posts:

• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Exploiting Possible 5G Vulnerabilities
• The 3G4G Blog: Presentations from ETSI Security Week 2019 (#ETSISecurityWeek)
• The 3G4G Blog: VoLTE Hacking
• The 3G4G Blog: Evolution of Security from 4G to 5G 

Key Technology Aspects of 5G Security by Rohde & Schwarz

The 3G4G page contains a lot of useful papers and links to security here but we have also looked at evolution of security from 4G to 5G here. Rohde & Schwarz has a short 8-minute video in which wireless technology manager, Reiner Stuhlfauth, explains the key technology aspects ensuring 5G security. The video is embedded below.



Related Links:

• The 3G4G Blog: Everything you need to know about 5G Security
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Evolution of Security from 4G to 5G