5G and Me: And Security

In today’s uber-connected world, everyone has dealt with that little voice in the back of the head, asking if you are safe… Is your data safe? Is your “stuff” private and protected? Are your connections exposing you to security attacks? And rightly so. It is nearly impossible to predict all the ways in which crooked minds (i.e. hackers and thieves) will steal your everything in but a moment, given a chance.

In the world of security, experts think in terms of “attack surfaces.” These are all the ways and methods, simply put, in which the bad guys can launch attacks that can hurt you. They can hurt an individual at a time, or a whole nation. The basic principles of security remain the same: identify all the attack surfaces. Turn off all access to the attack surfaces. Then monitor closely and monitor often for any suspicious activity. Rinse and repeat.

This recipe, however, only works with the attack surfaces you are aware of, aka the “known unknowns.” What about the “unknown unknowns?”

With 5G emerging—the hyper-connectivity, the bandwidth guarantees, the low-latency guarantee, the scale, and the expected ubiquity—there is potential for a huge number of unknown unknowns. For the first five years of 5G deployments, humanity is going to discover attack surfaces that we had never thought of before. If one contrasts 5G design and architecture with 4G, it definitely includes stronger and more robust security principles. However, compared to 4G, the risk profile of a 5G transport may be far worse as 5G is expected to carry more mission-critical services that 4G currently does, and as a scale far greater than 4G ever will.

Here is an example: How about weird atmospheric phenomena that unpredictably open electromagnetic tunnels through layers of Earth’s atmosphere, exposing mobile networks to devices hundreds of miles away? When that happens, how will a physically remote hacker exploit the new large-scale, superfast 5G transport you just deployed? How about a rogue nation that wants to attack your critical IoT infrastructure riding on 5G?  While this problem affects all uses of the electromagnetic spectrum (including 4G), 5G will have a lot more riding on it, including national critical infrastructures. I am sure you would prefer to just close the tunnels if you could, rather than find out the answers to these questions.

Then there are the garden-variety of attack surface types to be expected, yet remain hidden until exploited and discovered. These are:

1. Network fragility: A 5G network will be built on a foundation of virtualization, a technology proven in the data center, but less so in the telecom transport sphere where physical functions are the norm. Virtualization is great for cost and efficiency, but also requires careful and balanced pre-allocation of resources. By targeting resource imbalances in virtualized stacks, could hackers negatively impact 5G service delivery, and cause a cascade of such events? It’s not out of the question.

2. Increased system complexity: The ambitious goals of 5G require the systems that implement to be quite complex. A complex system with more virtualized and sometimes dedicated parts such as accelerators can provide multiple ways to attack. This can adversely impact everything the system carries.

3. Single points of failure: We know that there will be SPoFs. But where? And how do I know it will be the weakest link in the chain?

4. Plain-old physics of it: The ionospheric tunnel is an example of what the physics of the spectrum can do. It may be hard but it’s certainly not impossible to hijack a part of the spectrum when such physical phenomena permit and exploit them with a denial-of-service (DoS) attack, and close up with not so much as a ripple on the pond.

5. Layers of disaggregation: This is a fundamental principle on which 5G is based. While it enables elegant and efficient designs and implementations, it also opens opportunities for bad actors to hide or inject their agents between those layers of disaggregation. How will they use a beautiful design principle as an attack surface? We will only find out as it happens.

6. Multi-actor networks: The disaggregated design opens up the possibility of multiple business entities collaborating to meet the goal of carrying your 5G-based services. The flip side? They will promise service levels to each other, but they must trust each other to be able to operate together. What, how and who might hijack a trust token (for example), and bring all actors down to some nefarious goals? When that happens, who is at fault? Who is on the hook to pay a price?

7. 3rd-party Applications: Many 5G-based services will be implemented via applications provided by 3rd The new openness and innovation that this ecosystem will enable could become a set of attack surfaces for hackers to exploit. It is near-impossible to check and test each and every 3rd party application for loopholes a priori, and may become attack surfaces that will significantly increase 5G security risk.

Security experts are often heard saying that it’s not if you will be attacked, only when. With the emerging 5G world, we confess that we are only beginning to understand the how of it, i.e. the new and emerging unknown unknowns.

At Dell Technologies, we provide infrastructure expertise to build scalable, dependable and secure 5G networks. In future blog entries on this topic, we will continue to provide more insights into how 5G and security are at once both scary and exciting to embrace for the 5G user. Stay tuned!