Emergence of 5G Networks and Implications for Cyber Conflict

The internet of things (IoT), autonomous driving, or Industry 4.0 – regardless of the application scenario envisioned, next-decade technologies reliant on connectivity will be based on 5G infrastructure and become increasingly dependent on virtualizations to provide adequate and adaptable network services. Virtualized network functions (VNFs) are used to provide services through software that replaces dedicated network devices. This shift from physical devices to software functions allows easier response and adaptation to environmental conditions (e.g. changes in network traffic or infrastructure). As such, they build the core of modern networks and are crucial to achieving the low latency and high speed of 5G networks. However, this makes VNFs of particular interest to cyber criminals, hacktivists, and state-sponsored hackers. In October 2019, the EU Commission identified state-sponsored attackers as the major threat to the security of 5G networks. The EU’s risk assessment identified core security requirements that are different for 5G networks. Due to the reliance on software, types of devices, and services connected and the heavily interconnected nature of 5G networks, there are more entry points for attackers. Nokia’s head of product management security has said that 5G networks have 200 times more attack vectors than their 4G predecessors. Network services such as VIMs (virtualized infrastructure managers) have already been identified as crucial assets that are expected to be heavily attacked. This article investigates how selected NATO and Western allies have addressed these issues of 5G network security over the past two years, while the pandemic has further highlighted societal dependency on network infrastructure. In particular, it will consider software supply chain security and the approach to foreign vendor integration. It investigates to what extent allies share views and practices on 5G security, which is necessary to ensure a united, secure network across borders. It will also consider the implications of adversary activities directed against identified weaknesses and offer essential principles for how to cope with the emerging threats.