Insights
Global Perspective on 5G Security, Trust, and Resilience
Valentin Constantinescu
Telco security advisor
A Neutral and Integrated Approach for Global 5G Governance
In the current environment of rapid transformation and regulatory fragmentation, this white paper aims to provide a clear and coherent vision of standards, regulations, and best practices concerning 5G security, trust, and resilience. Instead of promoting a single regulatory model or a sole vendor, it advocates for a neutral, integrated approach that incorporates key international frameworks such as the EU 5G Toolbox, NIS2, NIST, MITRE FiGHT, GSMA, 3GPP, O-RAN ALLIANCE, and Asian regimes. The goal is to develop a unified operational model that is adaptable across jurisdictions, facilitating convergence of practices and the implementation of effective strategies to address global security and resilience challenges.
Executive Summary: 5G as a Critical Infrastructure in Transition
5G represents a critical infrastructure: a cloud-native core network based on services, virtualization, disaggregation, with programmable features and distributed edge computing. The security perimeter of previous generations has disappeared.
Responses regarding governance are global but fragmented: European regulations, American technical assets, industry assurance schemes, and certification regimes in Asia-Pacific. Although their legal enforceability varies, they converge around three fundamental principles that structure this reflection:
- Security is architectural, not merely a layer of hardening.
- Trust is evidence-based, not declarative.
- Resilience is demonstrated through testing.
A unified implementation within a controlled framework allows compliance with all these regimes simultaneously.
The Attack Surface of 5G
1. Service-Based Architecture
The 5G core replaces point-to-point signaling with HTTP/2 REST, secured by TLS and OAuth 2.0, inheriting vulnerabilities from web protocols: faulty object authorization, token replays, over-authorization, and excessive data exposure. Protocols such as SS7 and Diameter persist in roaming management; in non-standalone deployments, the 4G control layer remains the security reference.
2. Virtualization and Cloud-Native Infrastructure
Containerized network functions extend the attack surface to orchestrators, registries, CI/CD pipelines, and Infrastructure-as-Code. Compromising an orchestrator equates to compromising all functions it manages. While standards like NIST secure interfaces, the underlying platform remains vulnerable—hence the importance of recommendations from ETSI NFV SEC and the use of root-of-trust mechanisms.
3. Open RAN and Disaggregation
Open Fronthaul, E2, A1, O1, O2, and xApps/rApps within the RAN Intelligent Controller (RIC) increase modularity but shift integration risks to operators, who must ensure the security of these interfaces.
4. Slicing and Edge Computing
Network slicing is a configuration, not a physical guarantee: inter-slice leaks, mis-scoped identifiers, and policy inconsistencies between RAN, transport, and core network are real risks. Edge deployments push workloads into sites that operators may not physically control.
5. Radio Layer and Devices
Standalone mode masks the permanent subscriber identity, but fake base stations, overload, and abuse of pre-authenticated broadcast remain exploitable by malicious actors.
Global Governance Landscape
| Region | Frameworks & Instruments | Focus |
|---|---|---|
| European Union | 5G Toolbox, NIS2, Cyber Resilience Act, EECC, ENISA, National regimes | Supply chain risks: ownership, jurisdiction, state influence, lifecycle security, continuity, notification |
| United States | NIST CSF 2.0, SP 800-207, SP 1800-33, CISA / ESF | Control taxonomy, zero-trust model, security guides for slicing, cloud, open RAN |
| United States | MITRE FiGHT™ | Adversary knowledge base, techniques, threat assessment, emulation, gap analysis |
| Industry (Global) | 3GPP, GSMA, ETSI NFV SEC |
Normative architecture, product assurance, operator controls, roaming security, coordinated disclosure, virtualization |
| Open RAN | O-RAN ALLIANCE WG11 | Security requirements, testing, threat modeling, certificate management, zero-trust trajectory |
| Asia-Pacific | India ITSAR, Singapore IMDA, Japan MIC, Korea TBA, Australia TSSR | Mandatory certification, regulated trust, supply restrictions, vulnerability assessments |
| Multilateral | Prague proposals, Global coalitions | Supply chain security, vendor diversification, network resilience |
Convergence and Divergence
Risks related to vendors are both technical and non-technical: ownership, jurisdiction, transparency of governance. Trust now relies on proof: assurance through testing (NESAS, SCAS, ITSAR, O-RAN assurance). The common vocabulary of zero-trust is adopted, with NIST SP 800-207 as a reference. Accountability is elevated to senior management.
However, divergences persist: legal strength of certifications, mutual recognition, reporting thresholds, and political choices in vendor selection.
Trust: From Assertion to Evidence
- Product assurance: NESAS, SCAS, ITSAR, signed attestations, deployment standards. Certification is a step, not an end.
- Software transparency: SBOM, provenance, signatures, updated with each version—key mechanisms to meet regulatory obligations.
- Contractual security: audit rights, disclosure timelines, patch levels, responsibilities clearly allocated.
- Diversification and exit strategies: managing vendor diversification and withdrawal capacity.
- Zero-trust approach: mutual TLS, short-lived tokens, hardware identity, segmentation of management planes.
Resilience: Unified Framework and Consolidated Evidence
A single control framework mapped to NIS2, ISO/IEC 27001, CSF 2.0, FS.31, and national regimes enables the collection of unified evidence. Risk management covers:
- Signaling storm, orchestrator compromise, vendor breaches, inter-slice leaks.
- Detection relies on precise indicators: roaming anomalies, PFCP abuse, fronthaul irregularities, with FiGHT as a reference.
An Integrated Operational Model
| Capability | Implementation | Compliance Standards |
|---|---|---|
| Vendor assurance | NESAS/SCAS attestations, SBOM, signatures, contractual clauses | NIS2, CRA, ITSAR, FS.31 |
| Zero-trust architecture | mTLS, tokens, workload identity, segmentation | SP 800-207, WG11 O-RAN, FS.40 |
| Platform hardening | Secure boot, root of trust, signatures, Infrastructure as Code | SP 1800-33, ETSI NFV SEC, CRA |
| Threat detection | Telecom-specific use cases, adversary modeling, coverage | FiGHT, CSF 2.0, NIS2 |
| Incident management | Unified processes, jurisdiction-specific timelines |
NIS2, EECC, Korea, India |
| Governance | Unified framework, ERM integration, KPIs, exercises | NIS2, ISO 27001, CSF 2.0, CyFun® |
Recommendations
- Define architectural principles now: zero trust, workload identity, segmentation, slice isolation.
- Consolidate regulatory obligations into a single control framework with unified proof.
- Make vendor assurance contractual: NESAS/SCAS attestations, SBOM, signatures, as deployment conditions.
- Adopt a documented adversary model (FiGHT) and measure detection coverage annually.
- Extend security controls to signaling, RAN, orchestration, and slice management.
- Conduct annual high-intensity recovery exercises involving leadership.
Conclusion
5G security is an ongoing journey, not a one-time project. Achieving trust and resilience requires robust architecture, evidence-based assurance, and continuous testing. A globally aligned, technically sound, and regulatory-coherent approach ensures the long-term sustainability of this critical infrastructure.
References
Principal public sources underpinning this paper. Versions evolve; consult the current release in each case.
- European Commission: EU Toolbox of Risk Mitigating Measures for 5G Cybersecurity, and implementation reports.
- Directive (EU) 2022/2555 (NIS2) ; Cyber Resilience Act; Directive (EU) 2018/1972 (EECC).
- ENISA : 5G threat landscape and security guidance; Belgian CCB CyFun® as a national implementation reference.
- NIST:Cybersecurity Framework 2.0; SP 800-207 Zero Trust Architecture; SP 1800-33 5G Cybersecurity (NCCoE), volumes A and B.
- MITRE : FiGHT™ knowledge base and high-level overview; MITRE ATT&CK®.
- CISA / Enduring Security Framework — 5G security guidance series (network slicing, cloud infrastructure, open RAN).
- 3GPP: TS 33.501 security architecture; SA3 security assurance specifications (SCAS); TR 33.809 false base station study.
- GSMA : FS.31 Baseline Security Controls; FS.40 5G Security Guide; NESAS; NG.113 roaming guidelines; Coordinated Vulnerability Disclosure.
- O-RAN ALLIANCE WG11: Security Requirements and Controls; Security Test Specifications; Threat Modelling and Risk Analysis; Zero Trust Architecture for Secure O-RAN; annual security updates.
- ETSI : NFV SEC deliverables on virtualisation and network function security.
- India: National Centre for Communication Security, Indian Telecom Security Assurance Requirements (ITSAR); MTCTE regime.
- Singapore: IMDA telecommunication and security standards for 5G standalone networks and connected equipment.
- Japan (MIC procurement and facility designation); South Korea (Telecommunications Business Act, Network Act); Australia (Telecommunications Sector Security Reforms).
- Prague Proposals on telecommunications network security; Global Coalition on Telecommunications.
Trust, Resilience & Sustainability
Build a secure, trusted, and sustainable digital futureConectivity & Next-Gen Networks
Power your business with next-gen connectivity