Regulatory Impact on 5G Security and Privacy 405
17.3.3 Legal Framework for Security and Privacy in Software Defined
Networking and Network Function Virtualization
The legal framework for Security and Privacy, as defined in Section 17.3.1, is assumed
to be applied also for Software Defined Networking and Network Functions
Virtualization. Also, the rules and policies which are being specified for Security and
Privacy in Clouds are assumed to be applied for Network Functions Virtualization,
because of the strong interrelation of those two technologies.
17.4 Security and Privacy Issues in New 5G Technologies
The following sub‐sections deal with different Security and Privacy issues in 5G network
context, that is, Cloud Computing, Network Functions Virtualization (NFV), and Software
Defined Networking (SDN).
17.4.1 Security and Privacy Issues in Cloud Computing
The ITU focus group on Cloud Computing
3
has identified the following security issues
with respect to the cloud service users [22]:
● Responsibility ambiguity: the lack of a clear definition of responsibility among cloud
service users and Providers may evoke conceptual conflicts. Also, the problem of
which entity is the data controller stays open at an international scale;
● Loss of governance: for an enterprise, migrating a part of its own IT system to a cloud
infrastructure implies to partially give control to the cloud service providers;
● Loss of trust: it is sometimes difficult for a cloud service user to recognize his Provider’s
trust level, due to the black‐box feature of the cloud service. There is no measure of
how to get and share the Provider’s security level in a formalized manner. Furthermore,
the cloud service users have no abilities to evaluate security implementation level
achieved by the Provider;
● Service Provider lock‐in: a consequence of the loss of governance could be the lack of
freedom regarding how to replace a cloud provider with another;
● Non‐secure cloud service user access: as most of the resource deliveries are through a
remote connection, i.e. non‐protected APIs, services are one of the easiest attack
vectors. Attack methods such as phishing, fraud and exploitation of software vulnerabilities still achieve results;
● Lack of information/asset management: when applying to use cloud computing services,
the cloud service user will have serious concerns on lack of information/asset management by Cloud Service Providers, such as the location of sensitive asset/information, the
lack of physical control for data storage, and the reliability of data backup;
● Data loss and leakage: the loss of the encryption key or privileged access code will
bring serious problems to the cloud service users.
3 The ITU-T Focus Group on Cloud Computing (FG Cloud) was established further to the ITU-T TSAG
agreement at its meeting in Geneva, 8–11 February 2010, followed by the ITU-T study groups and
membership consultation. It was successfully concluded in December 2011.
17.3.3 Legal Framework for Security and Privacy in Software Defined
Networking and Network Function Virtualization
The legal framework for Security and Privacy, as defined in Section 17.3.1, is assumed
to be applied also for Software Defined Networking and Network Functions
Virtualization. Also, the rules and policies which are being specified for Security and
Privacy in Clouds are assumed to be applied for Network Functions Virtualization,
because of the strong interrelation of those two technologies.
17.4 Security and Privacy Issues in New 5G Technologies
The following sub‐sections deal with different Security and Privacy issues in 5G network
context, that is, Cloud Computing, Network Functions Virtualization (NFV), and Software
Defined Networking (SDN).
17.4.1 Security and Privacy Issues in Cloud Computing
The ITU focus group on Cloud Computing
3
has identified the following security issues
with respect to the cloud service users [22]:
● Responsibility ambiguity: the lack of a clear definition of responsibility among cloud
service users and Providers may evoke conceptual conflicts. Also, the problem of
which entity is the data controller stays open at an international scale;
● Loss of governance: for an enterprise, migrating a part of its own IT system to a cloud
infrastructure implies to partially give control to the cloud service providers;
● Loss of trust: it is sometimes difficult for a cloud service user to recognize his Provider’s
trust level, due to the black‐box feature of the cloud service. There is no measure of
how to get and share the Provider’s security level in a formalized manner. Furthermore,
the cloud service users have no abilities to evaluate security implementation level
achieved by the Provider;
● Service Provider lock‐in: a consequence of the loss of governance could be the lack of
freedom regarding how to replace a cloud provider with another;
● Non‐secure cloud service user access: as most of the resource deliveries are through a
remote connection, i.e. non‐protected APIs, services are one of the easiest attack
vectors. Attack methods such as phishing, fraud and exploitation of software vulnerabilities still achieve results;
● Lack of information/asset management: when applying to use cloud computing services,
the cloud service user will have serious concerns on lack of information/asset management by Cloud Service Providers, such as the location of sensitive asset/information, the
lack of physical control for data storage, and the reliability of data backup;
● Data loss and leakage: the loss of the encryption key or privileged access code will
bring serious problems to the cloud service users.
3 The ITU-T Focus Group on Cloud Computing (FG Cloud) was established further to the ITU-T TSAG
agreement at its meeting in Geneva, 8–11 February 2010, followed by the ITU-T study groups and
membership consultation. It was successfully concluded in December 2011.