Regulatory Impact on 5G Security and Privacy 407
direct control. The transition is usually accompanied by the lack of a direct point of
contact with the management of operations and influence over decisions made
about the computing environment. This situation makes the organization dependent on the cooperation of the Cloud Service Provider to carry out activities that span
the responsibilities of both parties, such as continuous monitoring and incident
response;
● Data Ownership: (see Ambiguity responsiblity above). The organization’s ownership
rights over the data must be firmly established in the service contract to enable a basis
for the trust and privacy of data. The continuing controversy over privacy and data
ownership rights for social networking users illustrates the impact that ambiguous
terms can have on the parties involved. Ideally, the contract should clearly state that
the organization retains exclusive ownership over all its data; that the cloud provider
acquires no rights or licenses through the agreement, including intellectual property
rights or licenses, to use the organization’s data for its own purposes; and that the
Cloud Service Provider does not acquire and may not claim any interest in the data
due to security;
● Visibility: Knowledge of a Cloud Service Provider’s security measures is also
needed for an organization to conduct its risk management. For example, the
process of identifying vulnerabilities should include an analysis of the system
security features and the security controls used to protect the cloud environment. The Cloud Service Providers can be reluctant to provide details of their
Security and Privacy measures and status; however, since such information is
often considered proprietary and might otherwise be used to devise an avenue
of attack.
Transparency in the way a Cloud Service Provider operates is a vital ingredient for
effective oversight over system Security and Privacy by an organization. To ensure
that policy and procedures are being enforced throughout the system’s lifecycle, the
service arrangements should include some means for the organization to gain visibility into the security controls and processes employed by the cloud provider and their
performance over time. For example, the service agreement could include the right to
audit controls via a third party.
17.4.2 Security and Privacy Issues in Network Functions Virtualization
It has to be noted here that the concept Network Virtualization is different from the
Network Functions Virtualization (NFV). Network Virtualization, or a virtualized network, uses a single physical infrastructure to support multiple logical networks. Each
logical network provides its users with a custom set of protocols and functionalities. An
important aspect of Network Virtualization is that the three participating entities –
network infrastructure providers, virtual network operators, and users – are independent and driven by different objectives. Thus, it cannot be assumed that they always
cooperate to ensure that all aspects of the virtual network operate correctly and securely.
Instead, each entity may behave in a non‐cooperative or malicious way to gain benefits [34].
Security issues in virtualized network architectures impose significant challenges and
require effective solutions. The problem of hosting network protocols and services on
third‐party infrastructures raises serious questions on the trustworthiness of the
participating entities.
direct control. The transition is usually accompanied by the lack of a direct point of
contact with the management of operations and influence over decisions made
about the computing environment. This situation makes the organization dependent on the cooperation of the Cloud Service Provider to carry out activities that span
the responsibilities of both parties, such as continuous monitoring and incident
response;
● Data Ownership: (see Ambiguity responsiblity above). The organization’s ownership
rights over the data must be firmly established in the service contract to enable a basis
for the trust and privacy of data. The continuing controversy over privacy and data
ownership rights for social networking users illustrates the impact that ambiguous
terms can have on the parties involved. Ideally, the contract should clearly state that
the organization retains exclusive ownership over all its data; that the cloud provider
acquires no rights or licenses through the agreement, including intellectual property
rights or licenses, to use the organization’s data for its own purposes; and that the
Cloud Service Provider does not acquire and may not claim any interest in the data
due to security;
● Visibility: Knowledge of a Cloud Service Provider’s security measures is also
needed for an organization to conduct its risk management. For example, the
process of identifying vulnerabilities should include an analysis of the system
security features and the security controls used to protect the cloud environment. The Cloud Service Providers can be reluctant to provide details of their
Security and Privacy measures and status; however, since such information is
often considered proprietary and might otherwise be used to devise an avenue
of attack.
Transparency in the way a Cloud Service Provider operates is a vital ingredient for
effective oversight over system Security and Privacy by an organization. To ensure
that policy and procedures are being enforced throughout the system’s lifecycle, the
service arrangements should include some means for the organization to gain visibility into the security controls and processes employed by the cloud provider and their
performance over time. For example, the service agreement could include the right to
audit controls via a third party.
17.4.2 Security and Privacy Issues in Network Functions Virtualization
It has to be noted here that the concept Network Virtualization is different from the
Network Functions Virtualization (NFV). Network Virtualization, or a virtualized network, uses a single physical infrastructure to support multiple logical networks. Each
logical network provides its users with a custom set of protocols and functionalities. An
important aspect of Network Virtualization is that the three participating entities –
network infrastructure providers, virtual network operators, and users – are independent and driven by different objectives. Thus, it cannot be assumed that they always
cooperate to ensure that all aspects of the virtual network operate correctly and securely.
Instead, each entity may behave in a non‐cooperative or malicious way to gain benefits [34].
Security issues in virtualized network architectures impose significant challenges and
require effective solutions. The problem of hosting network protocols and services on
third‐party infrastructures raises serious questions on the trustworthiness of the
participating entities.