European Parliament

Study 17-03-2022

This study describes two main dimensions of 5G technology, i.e. privacy and security. This research paper focuses on the analysis of cybersecurity risks and threats, privacy challenges and 5G technology opportunities at EU level and worldwide, as well as the relationship between cybersecurity risks and privacy issues. The methodological framework for this assessment of the impact of 5G technology is built on three pillars: (i) a document-based analysis; (ii) a parallel analysis with stakeholder involvement; and (iii) a selection of relevant case studies. The complexity of the 5G ecosystem, where new use cases are constantly emerging, also led the authors to assess the prospects of using new 5G-enabled technologies, such as the internet-of-things, robotics and AI. Moreover, policy options are defined and put forward for consideration by the European Parliament’s Committees on Legal Affairs, Internal Market and Consumer Protection, Civil Liberties, Justice and Home Affairs, and the Subcommittee on Security and Defence, as well as by other EU institutions and the Member States.

PDFs available at https://www.europarl.europa.eu/thinktank/en/document/EPRS_STU(2022)697205

The post Privacy and security aspects of 5G technology appeared first on EMFSA.

February 24, 2022

NFV Security in 5G – Challenges and Best Practices

This report explores relevant challenges, vulnerabilities and attacks to the Network Function Virtualization (NFV) within the 5G network. NFV changes the network security environment due to resource pools based on cloud computing and open network architecture. 60 security challenges grouped in 7 categories have been identified and explored. Among others, this report exposes vulnerabilities, attack scenarios and their impact on the 5G NFV assets. To address these upcoming challenges, security controls and best practices are put forward in this report, taking into account the particularities of this highly complex, heterogeneous and volatile environment. In particular, 55 best practices categorized in Technical, Policy and Organizational categories have been identified.

https://www.enisa.europa.eu/publications/nfv-security-in-5g-challenges-and-best-practices

The post ENISA: Security in 5G – Challenges and Best Practices appeared first on EMFSA.

ABSTRACT

In the concluding statement of the 2021 BRICS Summit, the bloc’s five members—Brazil, Russia, India, China, and South Africa—pledged to pursue enhanced cooperation on cybersecurity issues, including by “establishing legal frameworks of cooperation among BRICS” and a BRICS intergovernmental agreement on cybersecurity. This piece briefly outlines the mounting relevance of cybersecurity for the BRICS countries, recent national policymaking in this area in the bloc, and the dynamics at play as the BRICS countries seek to further intensify and structure their cooperation on cybersecurity matters.

https://journals.assaf.org.za/index.php/ajic/article/view/12944

The post Cybersecurity Policymaking in the BRICS Countries: From Addressing National Priorities to Seeking International Cooperation appeared first on EMFSA.

Smart cities could transform urban living for the better. However, in order to mitigate the risks of cyber threats that can be exacerbated by inadequately secured and mobile edge computing (MEC) technologies, government officials should be aware of smart cities security concerns associated with their supporting infrastructure.

September 24, 2021 • Verizon

What is a smart city?

A smart city is an urban area that uses technologies and networking to help improve local services and infrastructure management. For example, a smart city can harness the power of the Internet of Things (IoT), MEC and faster networking, such as 4G LTE and 5G, to reduce operational costs and provide better, faster services and information-sharing.

Typically, a smart city collects data using a web of IoT-connected sensors to gather insights about how residents use the environment and access services. This data helps inform decision-makers so resources can be more appropriately allocated.

As urbanization accelerates, smart cities will likely take on even more relevance. In fact, according to a report by Technavio, the market for smart cities is predicted to grow by about $2.1 trillion by 2024—and with it, smart cities’ security concerns.

Read more at https://www.govtech.com/sponsored/smart-cities-security-concerns-and-safety-issues-5g-mec-and-security-risks

The post Smart Cities Security Concerns and Safety Issues: 5G, MEC and Security Risks appeared first on EMFSA.

The space rush will result in tens of thousands of new assets launched within the decade, which will create a “truly enormous” cyber attack surface, said Sam Visner, a technical fellow at the MITRE Corporation.

By BRAD D. WILLIAMS, August 16

WASHINGTON: A space race is afoot, and in this brave new interstellar world, experts say concerns remain about the cybersecurity and resiliency — or lack thereof — for constellations of space-based assets and the global networks they enable. And with global investment in space exploding, the issue is not going away anytime soon.

“I’ve seen change over the past four years like I haven’t seen over the past 36 years,” Kevin Bell, senior vice president of the Space Systems Group at The Aerospace Corporation and a former Air Force pilot, said last week at an event organized by Booz Allen Hamilton.

Space-based systems proliferation is being driven, as well as enabled, by new tech, ranging from ships and satellites to 5G. The US military will rely on space assets as nodes in global networks to enable its Joint Warfighting Concept and All Domain Operations. In addition to defense and intelligence applications, space increasingly factors into vast swaths of global economies — shaping sectors ranging from transportation to agriculture — in turn making space progressively more of an economic security issue.

The increasing interest in space — once the limited domain of nation-states — is growing to include burgeoning commercial sectors in countries like the US and South Korea. Two billionaires made news last month for their trips to space on commercial ships, and some companies have already sent commercial ships to the International Space Station. Several companies are reportedly exploring space tourism, including one entity that recently announced the first space hotel will open in 2027. Rising commercial ventures into space will complicate military and intelligence space operations.

The space rush will result in tens of thousands of new assets launched within the decade, many running 5G, which will create a “truly enormous” cyber attack surface, said Sam Visner, a technical fellow at the MITRE Corporation and former associate at the Space Information Sharing and Analysis Center, which focuses on cybersecurity of space networks and assets.

Read more at https://breakingdefense.com/2021/08/amid-space-race-cybersecurity-and-resiliency-remain-concerns-experts/

The post Amid Space Race, Cybersecurity And Resiliency Remain Concerns: Experts appeared first on EMFSA.

The ESF 5G Threat Model Working Panel, a subgroup within the ESF, examined three major threat vectors in 5G­—standards, the supply chain, and threats to systems architecture—to develop a summary and technical review of types of threats posed by 5G adoption in the United States and sample scenarios of 5G risks.

Please note, this paper represents the beginning of the ESF’s research and not the culmination of it. It is not an exhaustive risk summary or technical review of attack methodologies and includes public and private research and analysis.

Return to CISA’s 5G.

https://www.cisa.gov/5g

EXECUTIVE SUMMARY

The fifth-generation (5G) of wireless technology represents a complete transformation of telecommunication networks, introducing a vast array of new connections, capabilities, and services. These advancements will provide the connection for billions of devices and will pave the way for applications that will enable new innovation, new markets, and economic growth around the world. However, these developments also introduce significant risks that threaten national security, economic security, and impact other national and global interests. Given these threats, 5G networks will be an attractive target for criminals and foreign adversaries to exploit for valuable information and intelligence. To address these concerns, the United States National Telecommunications and Information Administration (NTIA) developed the National Strategy to Secure 5G, a strategic document that expands on how the United States Government will secure 5G infrastructure domestically and abroad. The National Strategy to Secure 5G aligns to the National Cyber Strategy and establishes four lines of effort:

(1) facilitating the rollout of 5G domestically;

(2) assessing the cybersecurity risks to and identifying core security principles of 5G capabilities and infrastructure;

(3) addressing risks to United States economic and national security during development and deployment of 5Ginfrastructure worldwide; and

(4) promoting responsible global development and deployment of secure and reliable 5G infrastructure.

In alignment with Line of Effort 2 in the National Strategy to Secure 5G, the Enduring Security Framework (ESF) was identified to assist with assessing risks and vulnerabilities to 5G infrastructure. This included building on existing capabilities in assessing and managing supply chain risk. As a result, the ESF 5G Threat Model Working Panel was established.1 The preliminary focus of the 5G Threat Model Working Panel was to explore and prioritize potential threat vectors that may be associated with the use of 5G non-standalone (NSA) networks. The working panel reviewed existing bodies of work to identify and generate an aggregated list of known and potential threats to the 5G environment, determined and developed sample scenarios of where 5G may be adopted, and assessed risks to 5G core technologies. This analysis paper represents the beginning of the Working Panel’s thinking on the types of risks introduced by 5G adoption in the Unites States, and not the culmination of it. This product is not an exhaustive risk summary or technical review of attack methodologies and is derived from the considerable amount of analysis that already exists on this topic, to include public and private research and analysis.

1The ESF is a cross-sector working group that operates under the auspices of Critical Infrastructure Partnership Advisory Council (CIPAC) to address threats and risks to the security and stability of U.S. national security systems. It is comprised of experts from the U.S. government as well as representatives from the Information Technology, Communications, and the Defense Industrial Base sectors. The ESF is charged with bringing together representatives from private and public sectors to work on intelligence-driven, shared cybersecurity challenges.

PDF https://www.cisa.gov/sites/default/files/publications/potential-threat-vectors-5G-infrastructure_508_v2_0%20%281%29.pdf

The post POTENTIAL THREAT VECTORS TO 5G INFRASTRUCTURE appeared first on EMFSA.

A modern network security approach is needed as agencies prepare to roll out 5G wireless networks to support their missions.

Source: https://fedtechmagazine.com/article/2021/03/government-agencies-prepare-5g-dont-forget-security

by John Davis

Retired U.S. Army Major General John Davis is vice president and federal chief security officer for Palo Alto Networks, where he is responsible for expanding cybersecurity initiatives and global policy for the international public sector and assisting governments around the world to successfully prevent cybersecurity attacks.

5G promises transformative mobility, and connection speeds we’ve never seen before. While the benefits are notable, as federal agencies prepare for 5G connectivity, it’s vital that they evaluate their infrastructures for 5G preparedness because existing practices and legacy security solutions will not meet what’s needed to secure 5G.

The advantages of 5G are undeniable — higher data speeds, latency improvements, greater agility, efficiency and openness — meaning that 5G will be a major driver of digital transformation. And for federal agencies, this means stronger and faster connectivity that significantly enhances mission readiness and enables new capabilities across many environments, from campuses, logistics and military bases to aircraft carriers.

5G’s next-generation wireless technology will ensure these environments can leverage industrial-scale Internet of Things networks with ultralow latency, mission-critical reliability and a high degree of mobility.

Yet before agencies begin to revolutionize their ecosystems to take advantage of 5G, they must understand that accompanying the impressive 5G capabilities are elevated cyber-risk, expanding threats and vulnerabilities. This makes it more critical than ever for federal agencies to prioritize setting the foundation for a strong security posture early in their 5G planning or deployments.

If government agencies have not yet modernized their networks and cybersecurity solutions, 5G will make it a crucial requirement.

https://fedtechmagazine.com/article/2021/03/government-agencies-prepare-5g-dont-forget-security

The post As Government Agencies Prepare for 5G, Don’t Forget Security appeared first on EMFSA.

Digital technologies hold great promise for the economy and society. But some recent developments, such as face recognition, also present ethical dilemmas. The challenges are immense for Switzerland, which is one of the leading developers of artificial intelligence (AI). This content was published on December 10, 2020.

CHRISTIAN RAAFLAUB

Digitalisation has led to an explosion of new ethical challenges: the loss of jobs due to automation, filter bubbles, data protection, face recognition, deepfake videos, cyber security and most disturbingly, the misuse of AI technologies.

It is hard to imagine what would happen if AI fell into the wrong hands. If you take the issue of “killer robots”, for example, the international community cannot agree on whether to introduce strict rules to control their use. Talks at the United Nations in Geneva on regulating lethal autonomous weapons have so far had limited results.

Such weapons do not yet exist, but campaigners say they could be deployed on the battlefield in just a few years given the rapid advances and spending on AI and other technologies.

Read more at https://www.swissinfo.ch/eng/machines-and-ethics–artificial-intelligence-switzerland/46213634

The post The ethics of artificial intelligence, a Swiss Perspective appeared first on EMFSA.

Open standards were supposed to drive interoperability of Internet of Things devices, allowing cybersecurity software to interrogate devices across the network. Many vendors even hoped to install apps or agents inside IoT nodes; after all mobile devices allow this. Yet none of these approaches, APIs, or standards that products are built upon achieved wide adoption. With so little control and visibility into IoT, the coming wave of 5G devices should make security professionals nervous.

In response to 5G’s potential to exacerbate an already complex problem of IoT security, researchers in defense and academic circles have launched programs to jumpstart R&D. This summer, the Defense Advanced Research Projects Agency (DARPA) released IoT research grants. And in a separate but parallel development, academic researchers at the Association of Computing Machinery (ACM) simultaneously launched a program allowing industry IoT experts to collaborate with academic researchers.

Read more: https://www.darkreading.com/iot/darpa-and-academia-jumpstart-5g-iot-security-efforts/a/d-id/1339388

The post DARPA and Academia Jumpstart 5G IoT Security Efforts appeared first on EMFSA.

MTI research finds only 60% of transit agencies have a cybersecurity preparedness plan, leaving them ill prepared for a cyber attack.

October 6, 2020 | San José, CA

New Mineta Transportation Institute (MTI) research assesses the readiness of agencies to understand, mitigate, and respond to the growing threat of cybersecurity. Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendation to Enhance Surface Transit Cyber Preparedness surveyed 90 transit agency technology leaders and found over 80% of agencies reported feeling prepared for a cybersecurity threat, yet only 60% have a cybersecurity program in place.

Despite the U.S. Department of Homeland Security designating the Transportation System Sector as one of 16 critical infrastructure sectors whose disruption would have a debilitating effect on our nation’s security, the report found that most transit agencies, which fall within this sector, do not have many of the basic policies or personnel in place to respond to a cyber incident.

Other key findings include:

• While 73% of respondents feel they have access to information to help implement a cybersecurity preparedness program, only 60% have a cybersecurity response plan in place and 43% do not find their plan sufficient;
• 47% of agencies reported auditing their cybersecurity program at least once a year;
• Over 50% of agencies do not keep a log for longer than a year– one of the most basic cybersecurity preparedness requirements;
• 36% do not have a cyber disaster recovery plan; and
• 67% do not have a cyber crisis communications plan.

Read more at: https://transweb.sjsu.edu/press/How-Prepared-Transit-Cyber-Attack

The post How Prepared Is Transit for a Cyber Attack? appeared first on EMFSA.