Right now the UK is still a member of the European Union. As such it is party to guidelines the EU is determining for assessing the risk of 5G networks.
The process is the result of a European Commission Recommendation adopted in March 2019 to ensure a high level of cyber security of 5G networks across the EU. The most significant step to date has been the publication of a report on the EU co-ordinated risk assessment on cyber security in 5G networks.
The report, published on 9 October, is based on the results of the national cyber security risk assessments by all EU Member States, including the UK. It identifies the main threats and threats actors, the most sensitive assets, the main vulnerabilities (including technical ones and other types of vulnerabilities) and a number of strategic risks.
The next step was for member states to submit draft security guidelines, which will then be used to develop a "toolbox" of mitigating measures to address the identified cyber security risks at national and EU level. This will be released by the end of 2019. This is the process that the UK has now delayed, putting it out of step with other EU members.
The submissions from EU member states have been watched closely, in the light of the banning of Chinese vendor Huawei from 5G networks in the US and Australia. On 16 October, the German Bundesnetzagentur (Federal Network Agency) submitted its draft guidelines, which were widely interpreted as a go-ahead for Huawei because they said no company should be excluded on non-technical grounds.
Huawei has been very active in the development of 5G networks and planning in Europe. It has a major presence in Brussels, and two weeks ago hosted what it said was first ever vendor-sponsored official EU debate. The event drew more than 300 attendees. It was addressed by Abraham Liu, Huawei's representative to the European Union, and jointly chaired by four Members of the European Parliament, one from each of the major political blocs.
The 9 October EU report identifies a number of important security challenges in 5G networks, compared with the situation in existing 3G and 4G networks:
- A increased exposure to attacks and more potential entry points for attackers. “With 5G networks increasingly based on software, risks related to major security flaws, such as those deriving from poor software development processes within suppliers are gaining in importance.”
- Due to new characteristics of the 5G network architecture and new functionalities, certain pieces of network equipment or functions are becoming more sensitive, such as base stations or key technical management functions of the networks.
- Risks related to the reliance of mobile network operators on suppliers. “This will also lead to a higher number of attacks paths that might be exploited by threat actors and increase the potential severity of the impact of such attacks. Among the various potential actors, non-EU nation states are considered as the most serious ones and the most likely to target 5G networks.” The report did not name them.
- “In this context of increased exposure to attacks facilitated by suppliers, the risk profile of individual suppliers will become particularly important, including the likelihood of the supplier being subject to interference from a non-EU country.” The report did not mention by name Huawei or the USA or China.
- “Increased risks from major dependencies on suppliers: a major dependency on a single supplier increases the exposure to a potential supply interruption, resulting for instance from a commercial failure, and its consequences. It also aggravates the potential impact of weaknesses or vulnerabilities, and of their possible exploitation by threat actors, in particular where the dependency concerns a supplier presenting a high degree of risk.”
- Threats to availability and integrity of networks will become major security concerns: in addition to confidentiality and privacy threats, with 5G networks expected to become the backbone of many critical IT applications, the integrity and availability of those networks will become major national security concerns and a major security challenge from an EU perspective.
The writer visited Brussels as a guest of Huawei.