MEC is one of the vulnerable entities in a 5G network, as it gets deployed at the edge of the network. The risk can be minimized by deploying endpoint protection software in the MEC host. MEC applications and services can be protected and secured by configuring and enforcing application or service specific policies. For example, configuring role-based access control for administrators managing the MEC applications and services. In addition, implement monitoring to provide enhanced visibility of the MEC applications, MEC services and the MEC infrastructure components.

1. Mitigating the Threats
Unit V

2. Introduction
• Mitigating the threats can be done by protecting 4 main platforms of
5G
• Protecting the MEC infrastructure
• Protecting the Core Network
• Protecting the Virtualized Infrastructure
• Protecting the CPE and Small Cell devices

3. Protecting the MEC infrastructure
• MEC is one of the vulnerable entities in a 5G network, as it gets deployed
at the edge of the network.
• The risk can be minimized by deploying endpoint protection software in
the MEC host.
• MEC applications and services can be protected and secured by
configuring and enforcing application or service specific policies.
• For example, configuring role-based access control for administrators
managing the MEC applications and services.
• In addition, implement monitoring to provide enhanced visibility of the
MEC applications, MEC services and the MEC infrastructure components.

4. Protecting the MEC infrastructure (Contd..)
• For example,
• Keeping track of activities of various logged-in administrators
• Collection of system resource utilization and system performance
snapshots at various time intervals etc.,
• As MEC is open to several third parties for running their own custom
applications, it is better to deploy firewalls for DDOS protection,
malware protection and API protection.

5. Protecting the Core Network

6. Protecting the Core Network
• Core network can be protected by using several mechanisms.
• Micro segmentation is one of the emerging trends in the security landscape.
• Micro segmentation helps in protecting the core network, allowing
administrators to control the communication between different
components in the core network.
• Micro segmentation allows policies to be configured at different levels such
as Virtual Machine (VM) level, Operating System (OS) level, application
level and at the flow-level.
• Data exchanged over the network can be protected by encrypting data using
traditional methods such as IPSEC and VPN.

7. • NAT allows network administrators to isolate select internal networks
and prevents access to those networks from the external world.
• Network administrators can deploy CGNAT (Carrier Grade NAT)
functions to isolate networks.
• In addition, service providers can deploy firewalls to protect the
network and implement monitoring of the end-to-end core network
functions.

8. Protecting the Virtualized Infrastructure
• 5G brings-in additional complexity to the operations teams, in deploying,
managing and securing the network infrastructure - as several 5G
components are deployed in a virtualized infrastructure.
• In order to protect, the Virtualized Network Functions (VNFs), service
providers have to turn-on DNS level security features to block bad domains
and bad talkers from accessing the network.
• Network operations teams must deploy security software that blocks
compromised VNFs, prevents VM hopping and blocks container image
packages with vulnerabilities.
• In addition, Virtualized Infrastructure components must be continuously
monitored for added protection.

9. Protecting the CPE and Small Cell devices
• In 5G, several equipment such as the Customer Premise Equipment (CPE)
and Small Cells are deployed closer to the user or at the user premise.
• In such cases, encryption of sensitive data stored in non-secure physical
locations is a must.
• All the CPE or Small Cell devices connecting to the service provider’s 5G
network should validate firmware and software packages
cryptographically at the time of booting.
• When vulnerable software packages are detected, the security teams
must be alerted, and the software must be rolled back to a trusted
version.

10. • The devices can provide a Trusted Executive Environment (TEE) to isolate
resident applications on the devices, by leveraging hardware capabilities.
• Each device connecting to the network should authenticate itself at the
time of connecting to the network.
• This can be achieved through certificate-based authentication.
• Service providers can pre-provision device credentials in the certificate
and install them on the device, before shipping the device to the field.
• In addition, device location can be continuously tracked by embedding a
GPS chipset in the device. The location of the device can be validated
during the connection establishment process.