Regulatory Impact on 5G Security and Privacy 411
D) Different objectives for Trust: The participating entities – network infrastructure
providers, MVNOs, MVNEs and CSPs – are independent and driven by different
objectives. They may not cooperate to ensure that all aspects of the network operate
correctly and securely.
E) Interconnectivity: The interconnectivity among new architectural components
exposes new interfaces that, unless protected, can create new security threats. In
the technology development phase, the standardization of protocols and network
equipments should be considered.
F) Single point of failure: The control plane in SDN can become a single point of failure
and render the whole network down in case of compromise. The issue becomes
even more complicated when the Controller is located in a CSP‐operated Cloud.
G) Loss of governance: For an enterprise, migrating a part of its own IT system to a
cloud infrastructure, implies to partially give control to the Cloud Service Providers.
This transition is accompanied by the lack of direct point of contact with respect to
the management operations. The situation makes an organization dependent on the
cooperation of the Cloud Service Provider to carry out activities that span the
responsibilities of both parties.
Similar to Loss of governance is Loss of control. Transitioning to Clouds architecture requires a transfer of responsibility and control to the Cloud Service Provider
over information as well as system components that were previously under the
organization’s direct control. This situation makes the organization dependent on
the cooperation of the Cloud Service Provider.
H) Service Provider lock‐in: A consequence of the loss of governance could be the lack
of freedom regarding how to replace a cloud provider by another.
I) Visibility: Knowledge of a Cloud Service Provider’s security measures is also needed
for an organization to conduct its risk management. The Cloud Service Providers
can be reluctant to provide details of their Security and Privacy measures and status. Transparency in the way a Cloud Service Provider operates is a vital ingredient
for effective oversight over system security and privacy by an organization.
J) Protection inconsistency: Due to the decentralized architecture of a cloud infrastructure, its protection mechanisms are likely to be inconsistent among distributed
security modules.
17.5 Relevance Assessment of Security and Privacy
Issues for Regulation
Developing new technologies raises new issues and some of these issues require regulation as a solution. The new network technologies being studied in 5G Networks (Clouds,
NFV, SDN) are no different in this aspect. In this section, the relevance of the issues
described and summarized in Section 17.4.4 has been assessed against the regulatory
objectives for Security and Privacy. Those objectives have been summarized in
Section 17.2, and they are considered to be relevant for the technologies under the
scope of 5G Networks.
The different regulatory objectives are influenced by the regulatory issues of high
relevance, as summarized in the Table 17.1 below:
D) Different objectives for Trust: The participating entities – network infrastructure
providers, MVNOs, MVNEs and CSPs – are independent and driven by different
objectives. They may not cooperate to ensure that all aspects of the network operate
correctly and securely.
E) Interconnectivity: The interconnectivity among new architectural components
exposes new interfaces that, unless protected, can create new security threats. In
the technology development phase, the standardization of protocols and network
equipments should be considered.
F) Single point of failure: The control plane in SDN can become a single point of failure
and render the whole network down in case of compromise. The issue becomes
even more complicated when the Controller is located in a CSP‐operated Cloud.
G) Loss of governance: For an enterprise, migrating a part of its own IT system to a
cloud infrastructure, implies to partially give control to the Cloud Service Providers.
This transition is accompanied by the lack of direct point of contact with respect to
the management operations. The situation makes an organization dependent on the
cooperation of the Cloud Service Provider to carry out activities that span the
responsibilities of both parties.
Similar to Loss of governance is Loss of control. Transitioning to Clouds architecture requires a transfer of responsibility and control to the Cloud Service Provider
over information as well as system components that were previously under the
organization’s direct control. This situation makes the organization dependent on
the cooperation of the Cloud Service Provider.
H) Service Provider lock‐in: A consequence of the loss of governance could be the lack
of freedom regarding how to replace a cloud provider by another.
I) Visibility: Knowledge of a Cloud Service Provider’s security measures is also needed
for an organization to conduct its risk management. The Cloud Service Providers
can be reluctant to provide details of their Security and Privacy measures and status. Transparency in the way a Cloud Service Provider operates is a vital ingredient
for effective oversight over system security and privacy by an organization.
J) Protection inconsistency: Due to the decentralized architecture of a cloud infrastructure, its protection mechanisms are likely to be inconsistent among distributed
security modules.
17.5 Relevance Assessment of Security and Privacy
Issues for Regulation
Developing new technologies raises new issues and some of these issues require regulation as a solution. The new network technologies being studied in 5G Networks (Clouds,
NFV, SDN) are no different in this aspect. In this section, the relevance of the issues
described and summarized in Section 17.4.4 has been assessed against the regulatory
objectives for Security and Privacy. Those objectives have been summarized in
Section 17.2, and they are considered to be relevant for the technologies under the
scope of 5G Networks.
The different regulatory objectives are influenced by the regulatory issues of high
relevance, as summarized in the Table 17.1 below: