Operators need to go beyond 3GPP if the public is to trust 5G models

5G will change our lives, according to the promises being made by many network operators. There are glimpses it could happen. South Koreans can now use augmented reality apps when watching a match at a stadium to get a more intense experience. Facebook’s metaverse will be using 5G’s real-time capabilities for their augmented reality interaction. And gaming companies are on their way to utilizing the new low-latency computing resources to deliver better experiences for online and mobile gamers.

Regardless of its promises, however, 5G needs to be secure. Of course, security has always been an inherent part of 3G and 4G network delivery. But 5G technology is different and requires a new approach.

5G is a revolution that has grown from three important technology advancements. For starters, the network topology has changed from a centralised to a distributed network with multiple internet breakpoints. This takes computing to the network edge, providing users faster access to the applications they want to use.

The RAN has been altered, too. It’s not only supporting higher cell density, higher bandwidth, and ultra-low latency, but also enabling an open-hardware world thanks to the Open RAN concept being introduced for 5G roll outs. This change enables more choice and flexibility in network design.

In addition, the core network has been transformed into a cloud-native design that uses application programming interfaces or APIs. This transformation provides the foundation for the incredible virtual and augmented reality concepts 5G is associated with, including the launch of autonomous vehicles and scenarios where doctors can complete brain surgery on patients in another country.

The same technology advancements that allow service providers to deliver ultra-fast connectivity and ultra-low latency, however, also open the door to more sophisticated cyberattacks. To address the security implications, the ‘3rd Generation Partnership Project’ (3GPP) has defined specifications for 5G, including security elements for software integrity, encrypted communication, registration, and access management.

These security considerations are crucial, and many vendors are in favour of them. But they are not failsafe because network traffic and threats are so dynamic. Without behavioural protection, any component on the service provider’s network can be compromised, even when 5G network vendors are following 3GPP security elements.

Given the complexity of the networks, and the sophistication of hackers, 5G network teams need more than 3GPP standards. To close the gap, they need an automated means to detect unexpected changes in ‘normal’ network behaviour and mitigate incidents when security is compromised.

The most effective 5G security solutions use latency agnostic behavioural machine learning and other intelligent algorithms that detect attacks within high-bandwidth traffic with "per user” granularity from core to edge.

The cloud environment that 5G relies on also needs to be protected from breaches. A sound 5G security solution must secure the cloud environment against identity and access abuse, protect against malicious user behaviour, and safeguard the environment’s overall security posture. In addition, security must include web application and API protection at the edge as well as at the core. Otherwise, the customer experience will be greatly undermined.

There’s no doubt that 3GPP security standards are a good prerequisite for securing 5G network solutions. However, they are not enough to handle the full security requirements. To build public trust, it’s time to move beyond 3GPP and help ensure that the promises of 5G and using it for ‘good’ are not overturned by malicious cyber criminals