Navigating 5G Security: Challenges and Progresses on 5G Security Assurance and Risk Assessment

By introducing a transformative era of cloud-native, programmable, and service-oriented connectivity and network slicing, 5G networks play an ever-growing crucial role in society and economy. However, securing 5G is complex due to its multidimensional nature and vast threat surface, encompassing numerous devices, applications, and services. It is universally recognized that security design alone is insufficient without rigorous and tailored testing of implementations. The challenge lies in comprehensively performing such testing to address infrastructure complexity and heterogeneity while covering the entire 5G service lifecycle. This paper showcases significant work addressing these challenges within 5G-focused research projects supported by the Italian Ministry of University and Research (MUR) under the National Recovery and Resilience Plan (PNRR). We highlight progress in three key areas: i) development of a custom testing framework (ScasDK) for 3GPP Security Assurance Specification tests, ii) analysis of cryptographic function implementation and protocol configuration testing methodologies which can be performed by any end user via the radio interface, and iii) an ontology-based approach to structuring 5G security complexity, aiming to build a comprehensive cybersecurity knowledge base for the 5G domain. Future challenges and research directions toward continuous monitoring of 5G networks during their operations are also highlighted.