text: July 2021

text: July 2021

text: July 2021

text: https://www.enisa.europa.eu/publications/guideline-on-security-measures-under-the-eecc 2 This scope of this supplement does not include full audit guidelines for 5G networks, but competent authorities may refer to the general guidance for auditing communication service providers given in the section 5.6 of the Guideline.

text: July 2021

text: th  In line with the 4 edition of the Guideline, updated the name of Security Objective 4 to ‘Security of third-party dependencies’

text: July 2021

text: 5G networks means a set of all relevant network infrastructure elements for mobile and wireless communications technology used for connectivity and value-added services with advanced performance characteristics such as very high data rates and capacity, low latency communications,

text: ultra-high reliability, or supporting a high number of connected devices. These may include legacy networks elements based on previous generations of mobile and wireless communications technology such as 4G or 3G. 5G networks should be understood to include all relevant parts of the network Mobile Network Entities providing mobile network services to users, operating their own network [or] with the help of 4 6 Operators - MNOs third parties . Entities providing services or infrastructure to MNOs in order to build and/or operate their networks. This category includes: Suppliers of MNOs - Telecom equipment manufacturers; - Other third-party suppliers, such as cloud infrastructure providers, systems integrators, security and maintenance contractors, transmission equipment manufacturer.

text: Entities providing objects or services that will connect to the 5G networks (e.g. smartphones,

text: connected vehicles, e-health) and related service components hosted in 5G control plane as defined

text: in Service Based Architecture or Mobile Edge Computing

text: https://ec.europa.eu/digital-single-market/en/news/eu-wide-coordinated-risk-assessment-5g-networks-security 4 In the context of EECC, MNOs are one type of providers of public electronic communications networks or of publicly available electronic communications services 5 In this document mobile network services refer to 5G networks and hence the corresponding term MNOs is used to denote entities providing 5G mobile network services 6 The original definition as given in the Coordinated risk assessment reads “entities providing mobile network services to users, operating their own network with the help of third parties”. To avoid a possible confusion that MNOs always depend on third parties, an ‘or’ has been added to slightly amend the said definition.

text: July 2021

text: User Equipment Authentication, roaming and Session Management Functions; User Equipment data transport functions; Access policy management; Registration and Core network functions CRITICAL authorization of network services; Storage of end-user and network data; Link with third-party mobile networks; Exposure of core network functions to external applications; Attribution of end-user devices to network slices

text: Security management systems; Billing and other support

text: systems such as network performance

text: Transport and Low-level network equipment (routers, switches, etc.); Filtering

text: transmission functions equipment (firewalls, IPS...)

text: IP networks external to MNO premises; Network services

text: provided by third parties

text: July 2021

text: R1: Misconfiguration of networks: Exploiting poorly configured systems and architecture, a State actor penetrates into the 5G network via its external interfaces, leading to the compromise of the network core functions, or exploits edge-computing nodes in order to compromise information

text: confidentiality and disrupt distributed services.

text: R2: Lack of access controls: A subcontractor with administrator’s privileges on the network

text: performs adverse action, leading to confidentiality/integrity and/or availability breach. The subcontractor’s action may be due to a legal requirement imposed by a third country or rogue behaviour of the contractor’s staff.

text: R3: Low product quality: Espionage by state or state-backed actors using malware to abuse poor quality network components or unintentional vulnerabilities affecting sensitive elements in the core network, such as Network Virtualisation Functions.

text: II – Risk scenarios R4: Dependency on any single supplier within individual networks or lack of diversity on nationrelated to 5G wide basis: A mobile network operator sources a large amount of its sensitive network supply chain components or services from a single supplier. The availability of equipment and/or updates from this supplier is subsequently drastically reduced, due to a failure by the supplier to supply (e.g. due to trade sanctions by a third State or to other commercial circumstances). In consequence, the quality of a supplier’s equipment decreases due to priority given to guaranteeing supply over improvements in product security.

text: R5: State interference through 5G supply chain: A hostile state actor exercises pressure over a supplier under its jurisdiction to provide access to sensitive network assets through (either purposefully or unintentionally) embedded vulnerabilities.

text: R6: Exploitation of 5G networks by organised crime or Organised crime group targeting end-

text: users: By taking control of a critical part of the 5G network architecture, an organized crime group

text: disrupts various services to ransom businesses relying on those services, or the mobile network

text: operator itself. Alternatively, using a similar attack path, an organised crime group may also target end-users, e.g. by injecting false messages to the users of the network as part of a large-scale “phishing” attack or online scam, or by using the compromised network to gain access to confidential data about users (e.g. second-factor authentication codes) for further profit.

text: R7: Significant disruption of critical infrastructures or services: Malicious hackers are able to IV - Risk scenarios compromise emergency services by gaining control of their dedicated network slice, thus related to compromising the availability of the service and the integrity of the information/data used for/within

text: networks and other R8: Massive failure of networks due to interruption of electricity supply or other support systems: critical systems Massive outage of power supply due to natural disasters or to attacks to the energy grid by a state, a state-backed actor or an organised crime group.

text: V - Risk scenarios R9: IoT (Internet of Things) exploitation: A hacktivist group or state-backed actor takes control of related to end user low security devices like IoT (sensors, home appliances, etc.), in order to attack the network by devices overwhelming its signalling plane.

text: For information about the ENISA Threat Landscape for 5G networks, refer to section 4 and Table 15.

text: July 2021

text: https://ec.europa.eu/digital-single-market/en/news/cybersecurity-5g-networks-eu-toolbox-risk-mitigating-measures 9 Commission Communication COM (2020)50, Secure 5G deployment in the EU - Implementing the EU toolbox, 29 January 2020, https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=64481

text: July 2021

text: Connected devices, cloud services

text: July 2021

text: July 2021

text: When assessing the implementation of security controls from the 3GPP standards, competent authorities may find useful to refer to the reference list provided in Annex II of this supplement. In addition, Annex III of this supplement includes a mapping table between the (supplemented) Guideline security domains and related technical measures from the Toolbox that are being addressed through the implementation of related measures and supplementary guidance, in addition to the baseline measure TM01 which pertains to all security domains

text: July 2021

text: Is the list of identified risks aligned with the main risks for 5G networks identified in the Coordinated 1 SO2 [a,e] [i,vi] risk assessment? Are threats related to the exposure to potentially high-risk suppliers or managed service providers, 2 SO2 [a,e] [i,vi] including those residing in other jurisdictions, taken in consideration? Has a potential dependency on a single supplier of 5G equipment been considered when assessing 3 SO2 [a,e] [i,vi] the main risks for security of networks and services? Does MNO have security requirements placed on third parties as part of contractual arrangements & [e] [vi] 4 SO4 is there a mechanism to monitor that suppliers are meeting said contractual arrangements? Does MNO require suppliers to comply with relevant EU certification schemes for 5G network [e] [vi] 5 SO4 components, customer equipment and/or suppliers’ processes or for other non 5G-specific ICT products and services, such as end-user devices and/or cloud services ? Does MNO require suppliers to demonstrate quality level of internal information security processes, [e] [vi] 6 SO4 including having security by design, built in the product development process? Does MNO require suppliers to adhere to best practices and industry standards throughout the 7 SO4 [e] [vi] lifetime of the product?

text: In addition, competent authorities may also want to explore and make use, if appropriate, of a concept of supplier trustworthiness, as applied in some MS. For example, according to Annex 2 of Germany's security catalogue (https://ec.europa.eu/growth/toolsdatabases/tris/de/index.cfm/search/?trisaction=search.detail&year=2020&num=496&mLang=EN), public telecommunications network operators and providers of publicly accessible telecommunications services with increased criticality are required to, in particular, appropriately select manufacturers and sellers or suppliers of critical components before purchasing them. An appropriate selection also includes an appropriate examination of the supply source’s trustworthiness. The obligated company must obtain a comprehensive declaration from the supply source to demonstrate its trustworthiness. The declaration must relate to all safety-relevant components and, if applicable, functionalities, as well as the supply source itself (the manufacturer, including the supplier, and, if applicable, the seller or supplier). 15 Here, and further in this section, the reference in the last column of a checklist table refers to the corresponding measure(s) and related evidence(s) in the Guideline that are most relevant for the check suggested and is provided in the following format: [measure id] [evidence id] 16 When an EU certification schemes are not available, other interim solutions, such as reliance on certification schemes based on industry standards, could be considered instead.

text: July 2021

text: Does MNO require suppliers to provide support for periodic security and penetration testing of its [e] [vi] 8 SO4 products?

text: Does MNO require suppliers to guarantee there are no intentionally introduced vulnerabilities in their [e] [vi] 9 SO4 17 products and to disclose and patch any known vulnerabilities in their products without undue delay?

text: Does MNO require suppliers to have implemented security requirements of relevant 5G technical [e] [vi] 10 SO4 18 specifications and industry standards by default ?

text: Does MNO require suppliers to guarantee adequate protection and non-disclosure of confidential [e] [vi] 11 SO4 information from or about its customers to third parties, in particular to foreign intelligence or security authorities?

text: [e] [vi] 12 SO4 Does MNO require suppliers to support MNO in investigating and remedying security incidents ?

text: Indispensable baseline https://www.enisa.europa.eu/pu Short, practical, technologically neutral document security requirements blications/indispensable- ENISA, with clear, simple and sector-agnostic minimum for the procurement of baseline-security-requirements- 2016 necessary indispensable requirements for secure secure ICT products for-the-procurement-of-secure- ICT products and services. and services ict-products-and-services

text: Practical tool for individual providers to better manage security risks when dealing with vendors of ICT products and outsourced services. The

text: Security Guide for ICT

text: Guide maps security risks which could lead to a Procurement for https://www.enisa.europa.eu/pu ENISA, disruption of electronic communications services electronic blications/security-guide-for-ict- 2014 for users, to a full framework of security communications procurement requirements, which can be applied to vendors of

text: service providers

text: ICT products and outsourced services used for the core operations of electronic communications networks and services.

text: In the case of vulnerabilities disclosed by the suppliers, competent authorities may also want to ensure that MNOs disclose such vulnerabilities to them Including all 3GPP optional security features of direct relevance for 5G network security Security should ideally be a shared responsibility between MNOs and suppliers.

text: July 2021

text: Does the list of personnel for whom background checks/screening has been performed also include 1 SO5 [b] [ii] contractors and third-party suppliers?

text: Are personnel who will have access (either physically or through management systems) to critical or 2 SO5 sensitive components of 5G networks security-vetted (as stipulated in the provisions of the Toolbox [b] [ii] technical measure TM06)?

text: SO6 Has the training program been updated to include coverage of specialized 5G technical topics? [d] [iv]

text: Is there an evidence that the key personnel who will be in charge of deploying and operating 5G 4 SO6 [d] [v] networks have followed the updated training courses?

text: Is there an evidence that personnel who will have access (either physically or through management 5 SO6 systems) to critical or sensitive network components are trained and qualified (as stipulated in the [d] [v] provisions of the Toolbox technical measure TM06)?

text: July 2021

text: Are there documented, additional, risk-based controls for physical security for MEC and base 1 SO9 [d] [ii,iv] stations included in the policy for physical security measures?

text: Are there documented additional, adequate physical infrastructure controls (for example perimeter 2 SO9 security for infrastructure and administrative premises, alarms and CCTV for detecting and recording [d] [ii,iv] incidents), especially for equipment locations which are unmanned, in place? Are there any controls in place to allow failsafe remote shutdown (or data clearing) for stolen 3 SO9 equipment and/or to require re-authentication or configuration after a physical attack or power failure [d] [ii,iv] at base stations?

text: Is there an evidence that access controls are in place for individuals accessing premises, including 4 SO9 assurance that they are security-vetted, trained and qualified and that any access, especially by third [d] [ii,iv] parties and contractors is strictly monitored? Do physical security controls included in the policy for physical security measures cover (multi- 5 SO9 [b] [ii] vendor) spare part management, at least for critical assets?

text: Are there any additional strict network access controls applied according to the updated risk 6 SO11 [f] [vii] assessment that particularly considers 5G network architecture elements? Is there an evidence demonstrating how the principle of least privilege is applied (including the 7 SO11 explanation on how various rights in the network, such as access rights between network functions, [f] [vi] network administrators’ rights and alike are minimized)?

text: SO11 Is there an evidence showing how the principle of segregation of duties is applied? [f] [vi]

text: Is there an evidence that the access control policy has been reviewed and revised in the context of 9 SO11 [c,h] [iii,xi] assessment of 5G risks?

text: Does the (revised) access control policy include provisions for restricting and/or strict controlling of 10 SO11 remote access by third parties, especially by suppliers or managed service providers considered to [c,h] [iii,iv] be high-risk or accessing the network from outside of EU? Do authentication mechanisms implemented follow general good practices and industry standards 11 SO11 [d] [iii,iv,vii] for strong authentication?

text: Are there controls in place to only allow temporary access to third parties and/or remote access and 12 SO11 that no permanent credentials are granted (e.g. temporary or one-time passwords, usable only for [d] [iii,iv,vii] designated tasks)?

text: SO11 Is there a centralised solution for Privileged Access Management (PAM) in place ? [d] [vii]

text: Do software patching procedures follow industry standard best practices for ensuring that software [d] [vi,vii] 14 SO12 products or components have not been altered (e.g. appropriate cryptographic methods for integrity and authenticity protection)?

text: Are there documented and tested processes for delivery and implementation of security patches to 15 SO12 [d] [iii] vulnerable components?

text: Are there appropriate physical protection mechanisms in place to ensure that hardware product have 16 SO12 21 [c,d] [iii] not been tampered with (e.g. physical security protection for equipment transport) ?

text: Are there specific timeframes for applying security patches to vulnerable components, particularly in 17 SO12 22 [d] [iii] the case of high and critical vulnerabilities ?

text: Is encryption applied for the concealment and protection of customer security critical data, in 18 SO13 23 [a] [i,ii] particular the permanent user identifiers ?

text: SO13 Is encryption applied for protection of signalling traffic between operators ? [a] [i,ii]

text: SO13 Is encryption applied for transport protection between network functions ? [a] [i,ii]

text: Such solution should secure physical or virtual network functions and resources by controlling, monitoring and auditing privileged access to all critical or sensitive network components or functions through a single pane of glass Note that this check may be seen as not being directly in the scope of SO 12, if this security objective is interpreted to pertain to software integrity only. If interpreted in its wider meaning, as pertaining to general integrity of network and information systems, then securing hardware devices that contain data or that ultimately will be running embedded software themselves, could be considered in the scope. Alternative mappings of this check could be considered, such as related it to SO 10 – Security of supplies (although supplies in this context pertain more to utilities such as power supply), to SO 4 – Security of third-party dependencies (if the obligation is defined for suppliers) or even SO 9 – Physical security (if assets not yet deployed within the network are included in the scope). E.g. CVSS score 7.0 – 10.0 SUPI concealment and de-concealment through SUCI and SIDF E.g. TLS 1.2 or 1.3 or PRINS SBA, using TLS 1.2 or 1.3

text: July 2021

text: Is encryption applied for protection of confidentiality of user and signalling data between user 21 SO13 [a] [i,ii] equipment and base stations? Are there appropriate controls in place, according to best practices, for the protection of 22 SO14 26 [a,b] [ii] cryptographic key material in UICC (or eUICC) ? Are appropriate controls in place, according to best practices, for the protection of cryptographic key 23 SO14 [a,b] [ii] material for encryption of subscriber permanent identifiers (SUPI)? Are there appropriate controls in place, according to best practices, for the protection of any other 24 SO14 cryptographic key material used to encrypt communication between network elements or between [a,b] [ii] different networks ? Are there appropriate controls in place for protection of VNF private keys to authenticate NF 25 SO14 [a] [ii] exchanges in the 5G core network? Where cryptographic key material is stored on third party key servers, are there appropriate 26 SO14 [a,b] [i] contractual arrangements in place with the server provider to ensure security of this key material?

text: Are there regular assessments of potential impact of an intended change prior to major system 1 SO16 [all] [ii,iv] changes, especially when critical or sensitive network components are about to be updated? Is there a mechanism in place to ensure that any major actual change implemented, especially for critical or sensitive network components, is recorded and any irregularities encountered during the 2 SO16 [all] [ii,iv] change process are investigated and, if incident reporting conditions are met, reported to competent authorities? Are changes to virtualised network environment (e.g. through patching of software defined network 3 SO16 [b,d] [ii,iv] components) included in the change management policies and procedures? Has MNO given consideration to moving to software development lifecycle best practices such as 4 SO16 Agile, Continuous Integration/Continuous Development (CI/CD), and DevSecOps, given 5G’s shift to [b,d] [ii,iv] a software based network? Is asset criticality assessment aligned with the list of critical assets identified in the Coordinated risk 5 SO17 [b,c] [ii,v] assessment? Has the MNO established relevant information repositories/registries containing details about 6 SO17 deployed technologies and components and are such registries appropriately maintained (e.g. timely [b,c] [ii,v] updates upon changes to the network)? Are there mechanisms envisaged in the MNO policies/procedures for asset management for 7 SO17 conducting regular assessments of their physical assets and for categorisation of their physical [b,c] [ii,v] network assets (e.g. core network assets, transmission hubs, exchanges, base-stations,

text: Even when transferred from the UICC manufacturer to the MNO This may include (but Is not limited to) cryptographic key material for remote SIM provisioning, for operating the N32 interface and DIAMETER or for the operation of the SIP infrastructure

text: July 2021

text: interconnection and transport links) based on a risk assessment and according to the assets sensitivity/criticality. Have policies/procedures for asset management been updated to reflect the fact that 5G networks will likely be virtualised, with VNFs being instantiated and decommissioned in an automated way and 8 SO17 do such updates include sufficient provisions to ensure good understanding of the virtual network, [b,c] [ii,v] including data flows, trust domains and the location and status of the physical hosts on which the virtual network resides?

text: Are relevant logs related to remote network access regularly reviewed according to predefined 1 SO19 [d] [v] procedures? 2 SO19 Are there capabilities for anomaly detection in place? [b] [ii] Is the monitoring infrastructure implemented according to the recommendation from the Toolbox, 3 SO19 including whether such monitoring infrastructure is established on premise, ideally inside the country [c] [iii] or inside the EU ? Does MNO have adequate resources available to monitor, understand and analyse security-related 4 SO19 [b] [ii] network activity? 5 SO20 Does MNO comply with relevant incident reporting provisions within a given legal framework? [c] [iv]

text: such as Network Operation Centres (NOC) and/or Security Operation Centres (SOC), that can serve for the purpose of timely detection of significant events or incidents 29 This follows the general requirement as identified in the Toolbox technical measure TM05, implementation on MS level may vary

text: July 2021

text: Are there measures in place to ensure supply-chain resilience (e.g. by ensuring that contingency 1 SO21 plans consider scenarios of removal of critical suppliers , understanding the related impact and [b] [ii] having appropriate failback strategies in place)? Are there any special provisions added to existing contingency plans to cover time-critical 2 SO21 applications of 5G services, such as URLLC as to ensure higher network availability for such [b] [ii] services? Is there a map of critical dependencies that may directly or indirectly impact availability or continuity 3 SO21 [d] [v] of 5G network service and if corresponding mitigation measures are defined and documented? Is there a map of critical sectors and services directly dependent on the continuity of network and 4 SO21 [d] [v] service operations and if criticality of such systems is taken in consideration in contingency plans? Are there documented plans in place in case of a disaster affecting the ongoing operation of the 5 SO22 [b] [ii] MNO’s network?

text: Say, due to trade sanctions, market conditions or similar

text: July 2021

text: Are there adequate monitoring capabilities in place in line with the recommendations form the Toolbox technical measure TM05, to ensure providing clear visibility and to implement effective 1 SO23 network monitoring of at least the critical or sensitive network components or functions, to detect [b,c] [iii,iv] anomalies and to identify and avoid threats, including but not limited to threats to 5G core coming from compromised end-user devices? Does the monitoring and logging policy also include monitoring of VPN and remote access to 5G 2 SO23 32 [b,c] [ii] network from remote locations ? Is there monitoring in place for roaming and interconnections (e.g. message monitoring and filtering capabilities to identify and block malformed, prohibited and unauthorised packets, confirm that 3 SO23 [b,c] [iii,iv] interfaces are only accessible to the correct external applications and/or networks and enabling of audit logging and delivery of data to SIEM for analysis for relevant threat vectors)? Are all patches, especially those to critical or sensitive network components or functions, subjected 4 SO25 [a,d] [i,iii] to security testing in controlled environment prior to deployment? Are security tests, vulnerability assessments/scans and penetration tests done on deployment and 5 SO26 subsequently, on periodic basis, for newly deployed network components, in particular for products [a,d] [i,iii] supplied by suppliers considered to be high-risk? Is monitoring of compliance with relevant 5G standards (e.g. 3GPP, ETSI NFV ) included in the [c,d] [iv,v] 6 SO27 compliance monitoring policies and procedures?

text: The Toolbox implementation report, published in June 2019, implicitly confirms the importance of good security testing practices by referring to best practices in several MS who have highlighted the relevance of this security control. One of the sources to consider for general guidance on security testing best practices is the US NIST special publication SP-800-115, Technical Guide to Information Security Testing and Assessment https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=152164 This may include installation of appropriate technical solutions for monitoring such as recording jump-boxes for remote connections References to related technical specs for 3GPP and ETSI NFV standards can be found in Annex II and Section 4 of this supplement, respectively

text: July 2021

text: Does threat monitoring and/or threat intelligence program include variety of threats of particular 1 SO28 [a,b] [i,iii] significance for 5G networks? 34 35 Are relevant and current sources and publications and/or relevant CTI tools and platforms 2 SO28 [a,b] [i,iii] consulted or used systematically?

text: Are there mechanisms in place to inform users about potentially vulnerable end user devices, 3 SO29 [b] [iv] including IoT devices and of related risks?

text: Has guidance been provided to consumers and enterprises on signalling threats in legacy network 36 37 38 environments (associated with SS7 , GTP and Diameter signalling protocols) such as location 4 SO29 [b] [iv] tracking, interception of data, call, e-mail and SMS messages, financial fraud and theft or digital identity theft and highlighting the risk of using SMS as a multi-factor authentication mechanism?

text: For example, ENISA 5G threat landscape report, available at: https://www.enisa.europa.eu/publications/enisa-threatlandscape-for-5g-networks, or other relevant reports from private and public organisations and bodies active in the CTI in the area of telecommunications and mobile networks In addition to commercial products and services, there are also open source solutions available that may be considered. Examples include MISP (https://www.misp-project.org/), OpenCTI (https://www.opencti.io/en/) and others. Signalling System 7 (SS7) is a set of signalling protocols developed in 1975, used primarily in 2G, 3G and fixed networks, to exchange information among different elements of the same network or between networks (call routing, roaming information, features available to subscriber etc.). GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry general packet radio service (GPRS) within GSM, UMTS and LTE networks Diameter Protocol provides authentication, authorization, and accounting (AAA) messaging services for network access and data mobility applications primarily in 3G, IP Multimedia Systems (IMS), and LTE/4G networks and may also be used in 5G networks

text: July 2021

text: Document Body Description URL

text: The 2019 report drew an initial threat landscape ENISA Threat and presented an overview of the challenges in the https://www.enisa.europa.eu/publicat Landscape for security of 5G networks. It included a ions/enisa-threat-landscape-for-5g- ENISA networks 5G networks comprehensive 5G architecture, asset diagram, 2019 threat taxonomy, threats – assets mapping and an initial assessment of threat agent motives.

text: The 2020 update (in preparation) brings updates Document in preparation, will be

text: ENISA Threat

text: to 5G architecture and assets and includes 5G available on ENISA website:

text: Landscape for

text: ENISA migration options, management processes, https://www.enisa.europa.eu/publicat

text: 5G networks

text: vulnerability analysis an map of security controls ions/enisa-threat-landscape-report-

text: from 5G specs to key vulnerabilities. for-5g-networks/

text: Reference provided in the Table 15

text: July 2021

text: https://searchnetworking.techtarget.com/definition/network-functions-virtualization-NFV 41 The list of ETSI NFV-SEC specifications given in the table does not include all the specification document, but only selected ones, that are believed to be of most relevance in terms of identifying specific detailed technical controls that could be considered for securing NFV. The full list is available here: https://www.etsi.org/standards#page=1&search=&title=1&etsiNumber=1&content=1&version=0&onApproval=0&published= 1&historical=0&startDate=&endDate=&harmonized=0&keyword=&TB=799&stdType=&frequency=&mandate=&collection=& sort=1

text: July 2021

text: Main security specification defining the NFV https://www.etsi.org/deliver/etsi_gs security and the problem statement, identifying /NFV-SEC/001_099/ NFV-SEC 001 ETSI several work areas associated with securing the 001/01.01.01_60/gs_NFV- NFV technology SEC001v010101p.pdf

text: https://www.etsi.org/deliver/etsi_gs Describes the security and trust guidance for NFV /NFV-SEC/001_099/ NFV-SEC 003 ETSI development, architecture and operation 003/01.01.01_60/gs_NFV- SEC003v010101p.pdf

text: https://www.etsi.org/deliver/etsi_gs The specification addresses security requirements /NFV-SEC/001_099/ NFV-SEC 021 ETSI for VNF onboarding and instantiation 021/02.06.01_60/gs_NFV- SEC021v020601p.pdf

text: Draft specification provides the progress to date on 3GPP study on security impacts of virtualization. It https://portal.3gpp.org/desktopmod is work in progress. It includes twenty-four key ules/ Specifications/ TR 33.848 3GPP security issues with respect to the virtualisation of SpecificationDetails.aspx 3GPP functions and architecture. Some of these ?specificationId=3574 key issues refer to ETSI NFV SEC specification

text: Threat The study reviews threats and potential Landscape and compromises related to the security of SDN https://www.enisa.europa.eu/publi ENISA Good Practice networks and includes related technical, policy and cations/sdn-threat-landscape Guide for SDN organizational recommendations.

text: Analysis of the status of virtualization security, https://www.enisa.europa.eu/publi Security aspects including current efforts, emerging best practices, ENISA cations/security-aspects-ofof virtualization known security gaps, challenges and limits of virtualization virtualized systems.

text: Guide to Security for Full Virtualisation Technologies. The purpose of the guide is to https://nvlpubs.nist.gov/nistpubs/L discuss the security concerns associated with full egacy/ SP 800-125 NIST virtualization technologies for server and desktop SP/nistspecialpublication800virtualization, and to provide recommendations for 125.pdf addressing these concerns.

text: Secure Virtual Network Configuration for VM Protection. The purpose of this NIST Special https://nvlpubs.nist.gov/nistpubs/S Publication (SP) is to provide an analysis of SP 800-125B NIST pecialPublications/NIST.SP.800various virtual network configuration options for 125B.pdf protection of virtual machines (VMs) and present recommendations based on the analysis.

text: Application Container Security Guide. This publication explains security concerns associated https://nvlpubs.nist.gov/nistpubs/ SP 800-190 NIST with the use of containers and gives SpecialPublications/NIST.SP.800recommendations and best practices for 190.pdf addressing these concerns.

text: Best practices https://downloads.cloudsecurityalli This paper by Cloud Security Alliance provides for mitigating ance.org/whitepapers/Best_Practic guidance on security risks and best practices risks in CSA es_for%20_Mitigating_Risks_Virtu specific to virtualization technologies that run on virtualized al_Environments_April2015_4-1server hardware. environments 15_GLM5.pdf

text: July 2021

text: Technical Report (TR) 33.811 (Release 15, June 2018) presents a study on the threats, potential https://portal.3gpp.org/desktopmodul security requirements and solutions for the 5G es/ TR 33.811 3GPP network slicing management and includes Specifications/SpecificationDetails.a identification of key security issues and spx?specificationId=3358 recommended mitigation measures.

text: Technical Report (TR) 33.813 (Release 16, July 2020) is currently being developed mainly to https://portal.3gpp.org/desktopmodul address network slicing security issues not TR 33.813 3GPP es/Specifications/SpecificationDetail addressed in Release 15. The contents of the s.aspx?specificationId=3541 technical report are work-in-progress and include several key issues and proposed solutions.

text: Vulnerability analysis is include in the ETL5G only in the 2020 report version (currently in preparation) 43 Based on: https://www.sdxcentral.com/edge/definitions/what-multi-access-edge-computing-mec/

text: July 2021

text: https://www.etsi.org/deliver/etsi_gs Multi-access Edge Computing (MEC); GS MEC 002 ETSI /MEC/001_099/002/02.01.01_60/g Phase 2: Use Cases and Requirements s_MEC002v020101p.pdf

text: https://www.etsi.org/deliver/etsi_gs Multi-access Edge Computing (MEC); GS MEC 003 ETSI /MEC/001_099/003/02.01.01_60/g Framework and Reference Architecture s_MEC003v020101p.pdf

text: https://www.etsi.org/images/files/E ETSI white paper Developing Software for Multi-Access ETSI TSIWhitePapers/etsi_wp20ed2_M #20 Edge Computing EC_SoftwareDevelopment.pdf

text: Harmonizing standards for edge https://www.etsi.org/images/files/E ETSI white paper computing - A synergized architecture TSIWhitePapers/ETSI_wp36_Har ETSI #36 leveraging ETSI ISG MEC and 3GPP monizing-standards-for-edgespecification computing.pdf

text: Vulnerability analysis is included in the ETL5G only in the 2020 report version (currently in preparation) 45 https://www.etsi.org/technologies/multi-access-edge-computing/mec

text: July 2021

text: Based on: https://www.etsi.org/images/files/ETSIWhitePapers/etsi_wp20ed2_MEC_SoftwareDevelopment.pdf, https://www.sdxcentral.com/edge/definitions/mec-security/ , https://www.gsma.com/futurenetworks/wpcontent/uploads/2020/02/6_Smart-Port-MEC-Security-Application-Based-on-5G-SA_GSMA.pdf, https://innovationatwork.ieee.org/edge-computing-security-issues-and-trends-to-watch-in-2020/ . Remark: The last URL referenced is valid at the time of document writing (October 2020). Please note, however, that given that GSMA is a closed group organisation the document may not be publicly available in the future to non-members.

text: July 2021

text: 5GC 5G Core Network 5G-RAN 5G Radio Access Network API Application Programming Interface CCTV Closed-circuit television CTI Cyber threat intelligence DDoS Distributed Denial of Service (attack) ETSI European Telecommunications Standards Institute eNB Evolved Node B eUICC Embedded Universal Integrated Circuit Card gNB NR Node B GPS Global Positioning by Satellite GSMA Global System for Mobile Communications Association GTP GPRS Tunnelling Protocol LTE Long-Term Evolution MANO NFV management and network orchestration MEC Multi-access Edge Computing NFV Network Function Virtualisation NOC Network Operation Center NSA Non stand alone PAM Privilege Access Management PRINS PRotocol for N32 INterconnect Security PKI Public key infrastructure SBA Service Based Architecture SDN Software Defined Networking SIDF Subscription Identifier De-concealing Function SIEM Security Information and Event Management SUCI Subscription Concealed Identifier SUPI Subscription Permanent Identifier TLS Transport Layer Security UE User Equipment UMTS Universal Mobile Telecommunications Service UICC Universal Integrated Circuit Card URLLC Ultra-Reliable Low-Latency Communication VPN Virtual Private Network

text: July 2021

text: Technical specifications – 5G security requirements

text: https://www.3gpp.org/DynaRe TS 33.501 3GPP Security architecture and procedures for 5G System port/33501.htm

text: Technical specification – 5G assurance

text: Security Assurance Specification (SCAS) for the next https://www.3gpp.org/DynaRe TS 33.511 3GPP generation Node B (gNodeB) network product class port/33511.htm 5G Security Assurance Specification (SCAS); Access and https://www.3gpp.org/DynaRe TS 33.512 3GPP Mobility management Function (AMF) port/33512.htm 5G Security Assurance Specification (SCAS); User Plane https://www.3gpp.org/DynaRe TS 33.513 3GPP Function (UPF) port/33513.htm 5G Security Assurance Specification (SCAS) for the Unified https://www.3gpp.org/DynaRe TS 33.514 3GPP Data Management (UDM) network product class port/33514.htm 5G Security Assurance Specification (SCAS) for the Session https://www.3gpp.org/DynaRe TS 33.515 3GPP Management Function (SMF) network product class port/33515.htm 5G Security Assurance Specification (SCAS) for the https://www.3gpp.org/DynaRe TS 33.516 3GPP Authentication Server Function (AUSF) network product class port/33516.htm 5G Security Assurance Specification (SCAS) for the Security https://www.3gpp.org/DynaRe TS 33.517 3GPP Edge Protection Proxy (SEPP) network product class port/33517.htm 5G Security Assurance Specification (SCAS) for the Network https://www.3gpp.org/DynaRe TS 33.518 3GPP Repository Function (NRF) network product class port/33518.htm 5G Security Assurance Specification (SCAS) for the Network https://www.3gpp.org/DynaRe TS 33.519 3GPP Exposure Function (NEF) network product class port/33519.htm 5G Security Assurance Specification (SCAS); Non-3GPP https://www.3gpp.org/DynaRe TS 33.520 3GPP InterWorking Function (N3IWF) port/33520.htm 5G Security Assurance Specification (SCAS); Network Data https://www.3gpp.org/DynaRe TS 33.521 3GPP Analytics Function (NWDAF) port/33521.htm 5G Security Assurance Specification (SCAS); Service https://www.3gpp.org/DynaRe TS 33.522 3GPP Communication Proxy (SECOP) port/33522.htm

text: Coverage of implementation options/migration paths is included in the ETL5G only in the 2020 report version (currently in preparation)

text: July 2021

text: Technical specifications of relevance for 5G NSA (non-standalone)

text: 3GPP System Architecture Evolution (SAE); Security https://www.3gpp.org/DynaRe TS 33.401 3GPP architecture port/33401.htm

text: 3GPP System Architecture Evolution (SAE); Security aspects https://www.3gpp.org/DynaRe TS 33.402 3GPP of non-3GPP accesses port/33402.htm

text: Security Assurance Specification (SCAS) for the MME network https://www.3gpp.org/DynaRe TS 33.116 3GPP product class port/33116.htm

text: https://www.3gpp.org/DynaRe TS 33.117 3GPP Catalogue of general security assurance requirements port/33117.htm

text: Security Assurance Specification (SCAS) for the evolved Node https://www.3gpp.org/DynaRe TS 33.216 3GPP B (eNB) network product class port/33216.htm

text: Security assurance specification for the PGW network product https://www.3gpp.org/DynaRe TS 33.250 3GPP class port/33250.htm

text: July 2021

text: Governance Human Security of Operations Incident Business Monitoring, Threat and risk mgt. resources systems and management management continuity auditing, awareness security facilities management testing

text: TM02   TM03   TM04   TM05     TM06   TM07    TM08  TM09  TM10  TM11   Addressing  Related to

text: Note that TM01, as a general baseline security measure pertains to all domains defined in the Guideline

text: July 2021 -N

identifier: 5G Supplement - to the Guideline on Security Measures under the EECC

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: 5G Supplement - to the Guideline on Security Measures under the EECC

serie: rapporter

text: To the Guideline on Security Measures under the EECC nd 2 Edition JULY 2021 5G SUPPLEMENT

type: rubrik

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. For more information, visit www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Goran Milenkovic and Dr. Marnix Dekker, European Union Agency for Cybersecurity

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and valuable input received from the experts in the ECASEC Expert Group (formerly known as Article 13a Expert Group), which comprises national telecom regulatory authorities (NRAs) from all EU and EFTA countries, and from the experts from national authorities in the NIS Cooperation group, and particularly those experts contributing to the NIS CG work stream on 5G cybersecurity. In the preparation of the report we have conducted an analysis of publically available information on security in 5G specifications in collaboration with Plum Consulting, under the tender ENISA S-COD-20-T14.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-456-5 - DOI: 10.2824/098554

text: 5G SUPPLEMENT

text: TABLE OF CONTENTS

text: INTRODUCTION 5

text: 1.1 OBJECTIVES AND SCOPE 5

text: 1.2 POLICY CONTEXT 6

text: 1.3 STRUCTURE OF THIS DOCUMENT 6

text: BACKGROUND: 5G RISKS AND MEASURES 7

text: 2.1 COORDINATED EU APPROACH TO CYBERSECURITY OF 5G 7

text: 2.2 TERMINOLOGY AND DEFINITIONS 7

text: 2.3 5G ASSETS 8

text: 2.4 5G RISKS 8

text: 2.5 MITIGATING MEASURES IN THE 5G CYBERSECURITY TOOLBOX 10

text: 2.6 TECHNICAL GUIDELINE ON SECURITY MEASURES UNDER THE EECC 12

text: 5G TECHNOLOGY PROFILE 13

text: 3.1 DOMAIN D1: GOVERNANCE AND RISK MANAGEMENT 14

text: 3.2 DOMAIN D2: HUMAN RESOURCES SECURITY 15

text: 3.3 DOMAIN D3: SECURITY OF SYSTEMS AND FACILITIES 16

text: 3.4 DOMAIN D4: OPERATIONS MANAGEMENT 18

text: 3.5 DOMAIN D5: INCIDENT MANAGEMENT 19

text: 3.6 DOMAIN D6: BUSINESS CONTINUITY MANAGEMENT 19

text: 3.7 DOMAIN D7: MONITORING, AUDITING AND TESTING 20

text: 3.8 DOMAIN D8: THREAT AWARENESS 21

text: SECURITY OF SPECIFIC 5G TECHNOLOGIES 23

text: 4.1 NETWORK VIRTUALISATION SECURITY 24

text: 4.2 NETWORK SLICING SECURITY 26

text: 4.3 EDGE COMPUTING SECURITY 26

text: 5G SUPPLEMENT July 2021 ANNEX I: LIST OF ACRONYMS 29 ANNEX II: 3GPP SECURITY REFERENCE LIST 30 ANNEX III: TOOLBOX MAPPING 32 5G SUPPLEMENT

text: INTRODUCTION

text: This document contains a 5G technology profile which supplements the Guideline on Security Measures under the EECC , called the Guideline hereinafter. The 5G technology profile gives additional guidance to competent national authorities about how to ensure the security of 5G networks. This document was developed in close collaboration with experts from national telecom security authorities across the EU, i.e. the ECASEC Expert Group (formerly known as the

text: Article 13

text: a Expert Group), and with the members of the NIS CG work stream for 5G cybersecurity.

text: Figure 1: Structure of the ENISA Guideline on Security Measures under the EECC

text: Considering the dynamic nature of 5G technology and the related threat landscape, this document is meant to be updated as technology and risks evolve. ENISA may consider using an alternative electronic format for this supplementary guideline, to better support regular updates.

text: 1.1 OBJECTIVES AND SCOPE

text: The objective of this document is to provide additional guidance for competent authorities on how to ensure that appropriate security measures are taken by providers of 5G networks and services. This supplement clarifies and refines the more generic security measures in the Guideline on Security Measures under the EECC specifically for 5G technology.

text: Considering the complexity of 5G technology and the variety of deployment and configuration options, both the risks and the necessary security measures will be very different for different deployments of 5G networks and services. This means that it is important to assess the setup and the security in depth, for each case, for example by performing audits on MNOs.

text: 5G SUPPLEMENT 1.2 POLICY CONTEXT

text: The Guideline, and this supplement, is a guideline for national authorities with competence on Article 40 of the EECC.

text: The Guideline, and this supplement, also addresses Supporting action SA01 of the Union toolbox of mitigating measures for 5G. It also gives guidance to EU Member States about the technical security measures under the Toolbox, in particular TM01. References to other technical measures that may be fully or partially implemented through the implementation of the measures in the Guideline and this supplement are provided further in this supplement.

text: 1.3 STRUCTURE OF THIS DOCUMENT

text: This document is structured as follows:

text: Section 2 contains the necessary background, i.e. a short introduction to cybersecurity of 5G networks, summarizing the outcomes of the coordinated EU approach for the cybersecurity of 5G networks, listing the critical assets, and key risks identified in the Union-wide risk assessment and summarizing what is in the EU toolbox on 5G cybersecurity.

text: Section 3 contains the 5G technology profile which provides supplementary guidance to national authorities on what are the appropriate security measures for 5G networks. The profile contains short general guidance and specific guidance for each of the 8 security domains in the Guideline.

text: Finally, in Section 4 we briefly discuss some specific technological aspects of 5G networks that are of particular interest from the cybersecurity point of view. For each of the key technologies we provide information or references to relevant industry standards and best practices that competent authorities may want to take in consideration.

text: 1.4 VERSIONS AND CHANGES

text: ENISA updates the Guideline and this supplement periodically, when necessary, in agreement with the competent authorities.

text: This second version of the supplement constitutes a minor update to the initial version published on 10 December 2020. This update to the supplement has been done in parallel with th an update to the Guideline (now 4 edition).

text: Main changes in the second version of the supplement:

text:  Additional security check no. 26 added to Security Objective 14

text:  Amended evidence mapping in Table 13: ‘Additional guidance checklist for domain D6’

text: 5G SUPPLEMENT

text: BACKGROUND: 5G RISKS AND MEASURES

text: 2.1 COORDINATED EU APPROACH TO CYBERSECURITY OF 5G

text: The European Commission’s Recommendation on the cybersecurity of 5G networks (hereafter ‘The Recommendation’) published on 26 March, 2019, states that the cybersecurity of 5G networks is considered critical, to protect the EU’s economy and society and to ensure the technological sovereignty of the Union. The recommendations called on Member States to complete national risk assessments and review national measures, to work together at EU level on a coordinated risk assessment and to prepare a toolbox of possible mitigating measures.

text: Based on the individual national risk assessments, the Commission and the Member States, with the support of ENISA, developed a single EU Coordinated Risk Assessment on 3 Cybersecurity in 5G Networks (hereafter ‘Coordinated risk assessment’). This coordinated risk assessment identifies the main threats and threat actors, the most sensitive assets, the main vulnerabilities and the main risks. For ease of reference, we re-iterate the main assets, in section 2.2 and the main risks, in section 2.3.

text: 2.2 TERMINOLOGY AND DEFINITIONS

text: Terminology and definitions used in this document follows the terminology and definitions in the Coordinated risk assessment, paragraphs 1.12 and 1.24. For ease of reference, we list them here.

text: Table 2: Definitions

text: Term Definition

text: 5G Networks

text: Manufacturers of

text: connected devices

text: and related service

text: providers

text: 5G SUPPLEMENT 2.3 5G ASSETS

text: Where references are made in this document to critical or sensitive network component or functions, the identification of these components or functions should be based on and consistent with the high-level categorisation of asset sensitivity defined in the Coordinated risk assessment, paragraph 2.21.

text: For ease of reference, we reproduce the table from the referenced paragraph 2.21 below.

text: Table 3: Assets (according to the Coordinated risk assessment)

text: Categories of elements Criticality Examples of key elements and functions

text: NFV management and network orchestration CRITICAL (MANO)

text: Management systems and

text: supporting services MODERATE/HIGH

text: (other than MANO)

text: Radio Access network HIGH Base stations

text: MODERATE/HIGH

text: Internetwork exchanges MODERATE/HIGH

text: Further details about the listed asset categories is available in paragraphs 2.22 - 2.27 of the Coordinated risk assessment.

text: Remark: The above list of assets is a generic, high-level list, looking at the overall elements of 5G architecture. When

text: identifying specific assets, MNOs are expected to follow the recommended approach from the Guideline and to perform their own analysis, specific for their particular setting and to determine which specific assets are in scope (see section 4.1 of the Guideline). With transition to 5G network and services, such asset lists are expected to be updated in order consider new assets introduced (as also recommended further in section 3) and should ideally be aligned with the above list of assets, in particular in terms of estimated asset criticality.

text: 2.4 5G RISKS

text: Coordinated risk assessment identified several main risk categories illustrated by concrete risk scenarios, describing possible attacks paths that a threat actor can use to reach its target. For ease of reference, we list these risks in the table below, reproducing the text from the Coordinated risk assessment.

text: 5G SUPPLEMENT

text: Table 4: Risks (according to the Coordinated risk assessment)

text: Risk group Individual risks/risk scenarios

text: I - Risk scenarios

text: related to insufficient

text: security measures

text: III - Risk scenarios

text: related to modus

text: operandi of main

text: threat actors

text: interdependencies that service.

text: between 5G

text: Remark: The above list of risks identified in the Coordinated risk assessment may be seen as a

text: generic, high-level list of risks that are believed to be relevant for MS across EU. In reality, MNOs are expected to follow the recommended approach from the Guideline and to perform their own risk assessment, specific for their particular setting and to determine which specific risks are relevant (see section 4.1 of the Guideline). With transition to 5G network and services, such risk assessment is expected to be updated in order consider specific 5G risks (as also recommended further in section 3) and should ideally be aligned with the above list of risks.

text: We refer the reader to the ENISA 5G threat landscape for a more detailed and more technical overview of threats for 5G networks.

text: 5G SUPPLEMENT 2.5 MITIGATING MEASURES IN THE 5G CYBERSECURITY TOOLBOX

text: On 29 January 2020, the NIS Cooperation Group published the EU toolbox of risk mitigating measures (‘the Toolbox’) addressing the risks identified in the coordinated risk assessment. On the same date, the Commission adopted a Communication (Secure 5G deployment in the EU - Implementing the EU Toolbox) , in which it endorsed the Toolbox conclusions and underlined the importance of their effective and quick implementation and called on Member States to take concrete steps to implement them.

text: The Toolbox identifies two groups of measures MS can take: strategic and technical measures and it also identifies a number of supporting actions that may enable, assist in implementation or improve effectiveness of the strategic and technical measures.

text: Figure 2: Toolbox structure

text: We summarize the strategic and technical measures in the Toolbox in the tables below.

text: Table 5: List of strategic measures from the Toolbox

text: Strategic Measures

text: SM01 Strengthening the role of national authorities

text: SM02 Performing audits on operators and requiring information

text: Assessing the risk profile of suppliers and applying restrictions for suppliers

text: considered to be high risk Controlling the use of Managed Service Providers (MSPs) and equipment suppliers’

text: third line support

text: Ensuring the diversity of suppliers for individual MNOs through appropriate multi-

text: vendor strategies

text: SM06 Strengthening the resilience at national level

text: Identifying key assets and fostering a diverse and sustainable 5G ecosystem in the

text: EU

text: 5G SUPPLEMENT

text: Table 6: List of technical measures from the Toolbox

text: Technical Measures

text: Ensuring the application of baseline security requirements (secure net. design and

text: architecture) Ensuring and evaluating the implementation of security measures in existing 5G

text: standards TM03 Ensuring strict access controls TM04 Increasing the security of virtualised network functions TM05 Ensuring secure 5G network management, operation and monitoring TM06 Reinforcing physical security TM07 Reinforcing software integrity, update and patch management Raising the security standards in suppliers’ processes through robust procurement

text: conditions Using EU certification for 5G net. components, customer equipment and/or suppliers’

text: processes TM10 Using EU certification for other non 5G-specific ICT products and services TM11 Reinforcing resilience and continuity plans

text: Table 7: List of supporting actions from the Toolbox

text: Supporting Actions

text: SA01 Reviewing or developing guidelines and best practices on network security SA02 Reinforcing testing and auditing capabilities at national and EU level SA03 Supporting and shaping 5G standardisation Developing guidance on the implementation of security measures in existing 5G

text: standards Ensuring the application of standard technical and organisational security measures

text: through specific EU-wide certification scheme Exchanging best practices on the implementation of strategic measures, in particular

text: national frameworks for assessing the risk profile of suppliers SA07 Improving coordination in incident response and crisis management Conducting audits of interdependencies between 5G networks and other critical

text: services SA09 Enhancing cooperation, coordination and information sharing mechanisms Ensuring 5G deployment projects supported with public funding take into account

text: cybersecurity risks

text: 5G SUPPLEMENT 2.6 GUIDELINE ON SECURITY MEASURES UNDER THE EECC

text: The ENISA Guideline on Security Measures under the EECC , referred to as the Guideline, provides guidance to competent authorities about the technical details of implementing Articles 40 and 41 of the EECC. It gives guidance to authorities on how to ensure that providers assess risks and take appropriate security measures. It contains a list of 29 high-level security objectives, grouped in 8 domains. Per security objective it lists detailed security measures which could be taken by providers to reach the security objective. The measures are grouped in 3 levels of increasing sophistication. The overall structure of security objectives and security measures is depicted in the diagram below.

text: Figure 3: Overall structure of the security objectives and security measures

text: The Guideline is split in 8 security domains:

text:  D1: Governance and risk management  D2: Human resources security  D3: Security of systems and facilities  D4: Operations management  D5: Incident management  D6: Business continuity management  D7: Monitoring, auditing and testing  D8: Threat awareness

text: The Guideline is technology neutral and the security measures are applicable to different types of networks and services and different types of electronic communication providers.

text: 5G SUPPLEMENT

text: 5G TECHNOLOGY PROFILE

text: This section, the 5G technology profile, supplements the Guideline, which is generic and technology-agnostic, with additional and more specific guidance on 5G by clarifying and refining the security measures for 5G networks and services.

text: When supervising MNOs offering 5G networks, competent authorities should ask a number of high-level, general questions:

text: 1. Does the MNO already have the general security measures in place, such as the security measures contained in the Guideline on Security Measures under the EECC?

text: 2. Has the MNO updated the risk assessments, asset lists and operational procedures and has it reinforced general security measures accordingly, as required for the 5G network deployment and operation?

text: 3. Is the MNO implementing specific security measures from the relevant 5G standards such as 3GPP , including the security-relevant optional controls, and does the same principle also apply to products and equipment that MNO is using in the network?

text: 4. Has the MNO considered the key new technologies of specific relevance for 5G networks (such as virtualization, slicing, edge computing etc.) in the overall risk assessment and has it deployed adequate controls for mitigating related risks?

text: In the rest of this section we provide detailed guidance for competent authorities for each of the 8 security domains, as follows:

text:  For each of the domains we first list all the underlying security objectives;  We then highlight those objectives that may be considered of particular importance for 5G networks and services and we provide a brief rationale for their relevance;  For each of these highlighted objectives we also include a checklist containing additional elements that competent authorities may consider;  Finally, we include reference to related technical measures from the Toolbox .

text: Remark: Taking into account the type of service provided and perceived overall level of risk,

text: competent authorities may want to consider requesting the implementation of measure up to level 3, in particular for those security objectives identified (in the step #2 above) to be of particular importance. However, it is ultimately up to the competent authorities to choose the appropriate sophistication levels, taking in consideration also the guidance provided in section 4.2 of the Guideline (Remark on minimum security measures).

text: 5G SUPPLEMENT 3.1 DOMAIN D1: GOVERNANCE AND RISK MANAGEMENT

text: Domain D1 (Governance and risk management) covers the following security objectives:

text:  SO 1: Information security policy  SO 2: Governance and risk management  SO 3: Security roles and responsibilities  SO 4: Security of third-party dependencies

text: This security domain is important to ensure that MNOs have appropriate measures and processes in place to manage information security risks continuously and adequately. It is of particular importance to ensure that the list of risks is reviewed and updated to consider key risks specific to 5G networks, especially those identified in the Coordinated risk assessment and that adequate technical measures are in place for mitigating supply-chain risks pertaining to 5G networks. Depending on the national approach in respect of assessment of high-risk supplier (as per the Toolbox measure SM03), this may also include requirements for MNOs to conduct an assessment of the risk profile of their key suppliers, say in relation to the last criteria mentioned in the Coordinated risk assessment: The overall quality of products and cybersecurity practices of the supplier, including the degree of control over its own supply chain and whether adequate prioritisation is given to security practices. Some of the guidance listed further in this section includes examples of checks that could be considered in this regard .

text: Competent authorities should pay close attention to objectives SO 2 (Governance and risk management) and SO 4 (Security of third-party dependencies), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM08 and, to some extent, TM09 and TM10.

text: Table 8: Additional guidance checklist for domain D1

text: # SO Checks to consider Ref.

text: 5G SUPPLEMENT

text: # SO Checks to consider Ref.

text: When reviewing and refining requirements for MNOs related to procurement (in relation to the above highlighted security objective SO 4 - Security of third-party dependencies), competent authorities may also find useful to explore to technical reports and best practices related to security requirements for ICT procurement, such as the two ENISA reports listed below.

text: Document Year Description URL

text: 3.2 DOMAIN D2: HUMAN RESOURCES SECURITY

text: Domain D2 (Human resources security) covers the following security objectives:

text:  SO 5: Background checks  SO 6: Security knowledge and training  SO 7: Personnel changes  SO 8: Handling violations

text: Many of the measures in this security domain refer to personnel, which, in this context, includes not only employees, but also contractors and third-party users. This could be of particular importance in the context of 5G networks, with increased reliance on sub-contractors, including those from third countries, for the purpose of managing critical network functions. Moreover, adequate knowledge of key personnel is relevant for addressing one of the important vulnerabilities identified in the coordinated EU risk assessment, which applies particularly to

text: 5G SUPPLEMENT

text: MNOs: lack of specialised and trained personnel to secure, monitor and maintain 5G networks and services.

text: Competent authorities should pay close attention to objectives SO 5 (Background checks) and SO 6 (Security knowledge and training), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM05 and TM06.

text: Table 9: Additional guidance checklist for domain D2

text: # SO Checks to consider Ref.

text: 3.3 DOMAIN D3: SECURITY OF SYSTEMS AND FACILITIES

text: Domain D3 (Security of systems and facilities) covers the following security objectives:

text:  SO 9: Physical and environmental security  SO 10: Security of supplies  SO 11: Access control to network and information systems  SO 12: Integrity of network and information systems  SO 13: Use of encryption  SO 14: Protection of security-critical data

text: These security objectives contain various controls for ensuring physical and logical security of networks and systems. For this reason the domain D3 plays perhaps a central role in ensuring technical protection of critical or sensitive network components or functions, since majority of technical risks identified in the Coordinated risk assessment and, subsequently, majority of related technical measures identified in the Toolbox, are related precisely to physical and logical security of 5G networks and related information systems and facilities.

text: Competent authorities should therefore pay close attention to objectives SO 9 (Physical and environmental security), SO 11 (Access control to network and information systems), SO 12 (Integrity of network and information systems), SO 13 (Use of encryption) and SO 14 (Protection of security-critical data under this domain), checking that measures under these objectives are implemented and considering some of the additional checks as suggested in the tables below. This addresses Toolbox measures TM03, TM06 and TM07 and is related to the Toolbox measures TM02 and TM04.

text: 5G SUPPLEMENT

text: Table 10: Additional guidance checklist for domain D3

text: # SO Checks to consider Ref.

text: 5G SUPPLEMENT

text: # SO Checks to consider Ref.

text: 3.4 DOMAIN D4: OPERATIONS MANAGEMENT

text: Domain D4 (Operations management) covers the following security objectives:

text:  SO 15: Operational procedures  SO 16: Change management  SO 17: Asset management

text: Considering the technical complexity and increased softwarization of key elements of 5G network infrastructure, it is of particular importance that MNOs have good and up-to-date operational procedures in place, in particular related to asset management, to understand the critical assets, and to have solid change management mechanisms in place.

text: Competent authorities should therefore pay close attention to objectives SO 16 (Change management) and SO 17 (Asset management), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This address Toolbox measure TM07.

text: Table 11: Additional guidance checklist for domain D4

text: # SO Checks to consider Ref.

text: 5G SUPPLEMENT

text: # SO Checks to consider Ref.

text: 3.5 DOMAIN D5: INCIDENT MANAGEMENT

text: Domain D5 (Incident management) covers the following security objectives:

text:  SO 18: Incident management procedures  SO 19: Incident detection capability  SO 20: Incident reporting and communication

text: Technological complexity of new generation mobile networks, potential dependency on suppliers and/or managed service providers that provide equipment and/or services, sometimes using remote connections from third countries and the overall complexity of the threat landscape require mature incident management capabilities, including state of the art incident detection capabilities. Moreover, comprehensive and reliable reporting on incidents that had a significant impact on operations of 5G networks and services to relevant competent authorities is equally important.

text: Competent authorities should therefore pay close attention to objectives SO 19 (Incident detection capability) and SO 20 (Incident reporting and communication), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measure TM05.

text: Table 12: Additional guidance checklist for domain D5

text: # SO Checks to consider Ref.

text: 3.6 DOMAIN D6: BUSINESS CONTINUITY MANAGEMENT

text: Domain D6 (Business continuity management) covers the following security objectives:

text:  SO 21: Service continuity strategy and contingency plans  SO 22: Disaster recovery capabilities

text: 5G SUPPLEMENT

text: Implementation of measures under this domain ensures robust network resilience and adequate disaster recovery and business continuity capabilities. And while this may already be essential part of MNO’s operations, it is worth emphasizing its importance in the context of 5G networks, as indicated in both the Coordinated risk assessment and the Toolbox. In the Coordinated risk assessment, a massive failure of networks due to interruption of electricity supply or other support systems is explicitly highlighted as one of the 9 identified significant risks to 5G networks. Consequently, the Toolbox technical measure TM11 calls MNOs to further strengthen the corresponding resilience and continuity plans.

text: Competent authorities should pay close attention to objectives SO 21 (Service continuity strategy and contingency plans) and SO 22 (Disaster recovery capabilities), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox technical measure TM11.

text: Table 13: Additional guidance checklist for domain D6

text: # SO Checks to consider Ref.

text: 3.7 DOMAIN D7: MONITORING, AUDITING AND TESTING

text: Domain D7, Monitoring, auditing and testing, covers the following security objectives:

text:  SO 23: Monitoring and logging policies  SO 24: Exercise contingency plans  SO 25: Network and information system testing  SO 26: Security assessments  SO 27: Compliance monitoring

text: In addition to having robust incident detection and management capabilities in place, as discussed earlier, having sophisticated monitoring and logging capabilities is of significant importance for detecting and analysing security incidents. This may particularly be relevant for the environments where remote access to critical or sensitive network components or functions is expected and especially when such access is to be established from third countries and/or from suppliers or service providers considered to be high-risk. Coordinated risk assessment, in particular, identifies lack of adequate monitoring practices in MNOs as one of the key vulnerabilities. Consequently, the need for strict monitoring and logging is emphasized in Toolbox technical measure TM05 as well as in the technical measure TM03.

text: At the same time, considering the increased virtualization and softwarization, the importance of testing and security assessments may be higher in 5G networks. Although not explicitly

text: 5G SUPPLEMENT

text: mentioned in the Toolbox, this is implicitly related to some of the technical measures, in particular to the technical measure TM07 .

text: Finally, having the appropriate compliance monitoring in place ensures continuous compliance with relevant standards and in the context of 5G this could also ensure compliance with relevant 5G standards, such as 3GPP, as requested by the Toolbox (technical measure TM02).

text: Competent authorities should therefore pay close attention to objectives SO 23 (Monitoring

text: and logging policies), SO25 (Network and information system testing), SO 26 (Security

text: assessments) and SO 27 (Compliance monitoring), checking that measures under these objectives are implemented and considering additional checks as suggested in the tables below. This addresses Toolbox measures TM03, TM05 and TM07 and is related to the Toolbox measures TM02 and TM04.

text: Table 14: Additional guidance checklist for domain D7

text: # SO Checks to consider Ref.

text: 3.8 DOMAIN D8: THREAT AWARENESS

text: Domain D8, Threat awareness, covers the following security objectives:

text:  SO 28: Threat intelligence  SO 29: Informing users about the threats

text: In the complex and evolving 5G threat landscape, it is necessary to ensure that MNOs operating 5G networks are aware of the current and emerging threats and that they take them in consideration when (re)assessing security risks. At the same time, user awareness about known threats and vulnerabilities, as recommended in the security objective SO29, may increase the overall security of 5G services provided to end-users.

text: Competent authorities may want to focus in particular on objectives SO 28 (Threat intelligence) and SO 29 (Informing users about the threats), checking that measures under

text: 5G SUPPLEMENT

text: these objectives are implemented and considering additional checks as suggested in the table below. This addresses Toolbox measure TM05 and is related to the Toolbox supporting action SA09 and may contribute to the mitigation of the Risk 9 from the Coordinated risk assessment (listed in the Table 3 in this document).

text: Table 15: Additional guidance checklist for domain D8

text: # SO Checks to consider Ref.

text: 5G SUPPLEMENT

text: SECURITY OF SPECIFIC 5G TECHNOLOGIES

text: 5G introduces or utilises several new technologies, in different places of the network, such as:

text:  Network virtualization  Network slicing  Edge computing

text: Number of security risks related to the utilisation of the above listed technologies in MNO’s 5G networks can be addressed by deploying general network security and information security management controls, such as those related to access control (including robust authentication and authorization mechanisms), DDoS prevention, reinforced physical security (including at remote locations) or security incident and event monitoring. Therefore, it is important that competent authorities ensure implementation and audit of relevant measures from the corresponding Guideline security objectives, taking in consideration additional guidance provided in this supplement, where applicable. However, there are some specific vulnerabilities related to these technologies, which MNOs would have to take in consideration when doing a risk assessment. Consequently, the identified risks need to be addressed adequately, which in some cases may require implementation of additional security controls. In this section, we provide further high-level information about some of these underlying technologies and we highlight the most relevant security aspects. We also include reference lists with pointers to the relevant industry standards and best practices for each of these technologies.

text: A more detailed technical information about the listed technologies and their security aspects, including the architecture, assets, security considerations and threats can be found it the comprehensive ENISA threat landscape for 5G Networks (hereinafter ‘ETL5G’). The new version of the report (currently in preparation) also brings analysis of vulnerabilities and identification of related security controls.

text: Table 16: ENISA Threat Landscape for 5G Networks

text: 5G SUPPLEMENT 4.1 NETWORK VIRTUALISATION SECURITY

text: Network Function Virtualisation (NFV) technology is based on the virtualisation of network services traditionally run on proprietary dedicated equipment including routers, switches, access nodes, gateways and a variety of other hardware . The main benefits of the NFV technology are scalability and better utilisation of network resources; reduced power consumption and improved efficiency of space usage; and reduced operational and capital expenditures.

text: The main elements of the NFV architecture are:  Virtual Network Functions (VNFs);  NFV Infrastructure (NFVI); and  Management, Automation and Network Orchestration (MANO) layer.

text: The latter, MANO, is also identified as a critical asset in the EU coordinated risk assessment.

text: A more detailed technical information about the NFV architecture can be found in ETL5G. The same report also identifies the key virtualisation threats, being the following:  Abuse on Data Centres Interconnect (DCI) protocol  Abuse of cloud computational resources  Network virtualisation bypassing  Virtualised host abuse

text: The closely related technology is Software Defined Networks (SDN). It allows dynamic management of network resources by separating the network control plane from the data plane. This enables a directly programmable network control and an abstracted underlying infrastructure for applications and network services. A logically centralised control plane allows a network wide view of data plane network elements. This can then be exposed to the application layer to achieve simplified network management and improved agility. ETL5G identifies and explains number of control plane, data plane and API related vulnerabilities in SDN.

text: Another related concept of relevance is containerisation. Containerisation is essentially a simplified form of virtualisation, whereby instead of running an entire operating system virtually only the user-space elements of the host OS are separated from each other and the hosting operating system. This gives all the advantages of full virtualisation but without the overhead of running the full guest OS, thus leading to greater efficiencies, although it does require that each container presents the same OS version to all applications (i.e. identical instances of the host OS). The efficiency and reliability gains greatly increase the portability of such containers and the ability to move entire application stacks within a virtualised environment has been made of great use for application development. The table 16 (below) includes references to documents that cover security aspects of containerisation in more detail.

text: In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the chapter 3 of this supplement, competent authorities may also want to check that relevant network virtualisation security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices, in particular relevant ETSI NFV. We list the most relevant ETSI technical specifications and additional relevant technical reports and documents, including two ENISA publications on SDN and virtualization security in the following table.

text: 5G SUPPLEMENT

text: Table 17: Virtualisation security reference list

text: Document Body Description URL

text: Technical specifications/standards

text: Technical reports and other documents

text: 5G SUPPLEMENT 4.2 NETWORK SLICING SECURITY

text: Network slicing enables MNOs to allocate portions of their networks for specific users (to ensure isolation on a neutral host environment) and use cases, e.g. industry automation, connected cars or enterprise networks. The objective is to provide a set of optimised resources and network topology to satisfy the needs of use cases (for example, connectivity, speed, latency and capacity) and conform to a specific service level agreement. As NFV, MEC and SDN, the network slicing concept is also built on virtual networking architecture where multiple virtual networks are established using shared physical infrastructure. Using common network resources (e.g. storage and processors), network slices can be created to establish a logical and self-contained network configured and connected end-to-end.

text: A detailed technical information about the network slicing architecture can be found in ETL5G. The same report also identifies the key areas network slicing vulnerabilities (Security-as-a- Service, Resource isolation, Secure Management and Orchestration and Trust Model) and provides further explanations related to these vulnerabilities.

text: In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the section 3 of this supplement, competent authorities also may want to check that relevant network slicing security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices for securing network slicing. We list some of the relevant technical documents in the table below.

text: Table 18: Slicing security reference list

text: Document Body Description URL

text: Technical reports and other documents

text: 4.3 EDGE COMPUTING SECURITY

text: Edge computing refers to a cloud-based IT service environment located at the edge of a network. Multi-access Edge Computing (MEC) is a technology aiming to satisfy the requirements of high-bandwidth and low-latency applications which operate at the edge of the network . MEC is based on the convergence of IT and telecommunications networking. Key benefits are reduced network congestion and improved performance for low latency applications. The ability of storing, processing and delivering content locally without requiring backhauling and centralised core network is the main feature of the technology.

text: Deployment of MEC technology as part of an NFV environment is envisaged. Therefore, security requirements of MEC enabled applications are expected to be addressed within the

text: 5G SUPPLEMENT

text: NFV security framework. Security fundamentals including data encryption, network visibility, automated monitoring and access control based on the principle of least privilege and supported by intrusion prevention and detection are all applicable to the MEC platform. Threats include infrastructure attacks related to wireless technology vulnerabilities (e.g. denial of service attacks to consume the bandwidth and computing resources at the edge or man in the middle attacks to inject or eavesdrop traffic from the edge), virtualisation attacks (e.g. denial of service and man in the middle attacks by rogue virtual machines) and privacy leakage (e.g. unauthorised access to information storage in the edge cloud).

text: A more detailed technical information about the MEC architecture can be found it ETL5G. The same report also identifies and described the key MEC threats (e.g. a false or rogue MEC gateway, edge node overload and abuse of edge open APIs) as well as the key areas of vulnerabilities (vulnerabilities related to virtualization and containerization, physical security, APIs and regulatory issues) and provides further explanations related to these vulnerabilities.

text: In addition to ensuring the implementation of general security measures from the Guideline and taking in consideration additional guidance provided in the chapter 3 of this supplement, competent authorities may want to check that relevant edge computing security risks are included in MNO’s security assessment and that MNOs follow industry standards and best practices, in particular relevant technical specifications and reports from ETSI, as a leading organization in standardization of MEC technology . We list some of the most relevant technical specifications and additional relevant technical reports and documents in the table below.

text: Table 19: MEC security reference list

text: Document Body Description URL

text: Technical specifications/standards

text: Technical reports and other documents

text: 5G SUPPLEMENT

text: Additionally, competent authorities may also find useful to take note of the following additional security aspects related to MEC :

text:  MEC device clusters may be more susceptible to physical theft and infiltration as they are likely to be located in physically less secure locations. Similarly, software tampering of the MEC platform should be prevented. To achieve this, platform security, platform management security, data storage and transmission security need to be enhanced as well as introducing trusted computing technologies.  An increased number of entry points in the MEC environment (e.g. IoT use case) implies challenging attack surface and complex certificate management as the absence or weakness of security measures in MEC devices can be exploited and create vulnerabilities for the whole network. Ensuring real-time network visibility is one of the key considerations.  Robust authentication and authorisation procedures need to be in place for the MEC platform which is located much closer to access network than the core network. The key issue is how to establish a uniform level of security policies for all MEC elements to minimise the risks.  In terms of network resilience, the introduction of the MEC platform should not affect network availability. This means that MEC solution vendors should offer the level of resilience to meet high-availability requirements of network operators. An appropriate failsafe mechanism should be in place to prevent the MEC platform failure from adversely affecting the normal operation of the network.

text: 5G SUPPLEMENT ANNEX I: LIST OF ACRONYMS

text: Acronym Meaning

text: 5G SUPPLEMENT ANNEX II: 3GPP SECURITY REFERENCE LIST

text: The reference list in the table below contains references to 3GPP technical specification TS 33.501, which defines the 5G security architecture, as well as to a series of technical specification documents from the SCAS (Security Assurance Specifications) that contain relevant test cases for assessment of compliance with security requirements.

text: In addition, the table contains an additional list of 3GPP specs of relevance for NSA (nonstandalone) 5G deployments options. Further technical details about different implementation options/migration paths can be found in ETL5G . This includes the description of the main elements of a NSA architecture, as well as identification and analysis of specific risks (such as those related to legacy technologies, roaming risks or a failure to meet general security assurance requirements).

text: Table 20: 3GPP Security Specifications Reference List

text: Standard / Body Description URL specs/ doc

text: 5G SUPPLEMENT 5G SUPPLEMENT ANNEX III: TOOLBOX MAPPING

text: The table below shows a mapping between the (supplemented) Guideline security domains and related technical measures form the Toolbox that are being addressed through the implementation of related measures and supplementary guidance or are related to them .

text: Table 21: Toolbox Mapping

text: D1: D2: D3: D4: D5: D6: D7: D8:

text: TM01         5G SUPPLEMENT -EN -759 -20 -01 TP ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN: 978-92-9204-456-5 DOI: 10.2824/098554 33