Interconnection Security: An EU level assessment

Presentation on theme: "Interconnection Security: An EU level assessment"— Presentation transcript:

1 Interconnection Security: An EU level assessment
ENISA’s IR Team | Secure Infrastructures & Services Unit 24th Article 13a EG workshop | Vienna |

2 You can teach an old protocol new tricks
Many stakeholders are paying attention to this Hacking conferences (CCC, Hackito Ergo Sum,…) Media Coverage (Washington Post, CBS,…) Regulators (Nordic, FCC,…) Organizations (GSMA, ITU, ETSI,…) Interconnection Security | ENISA IR Team –COD1 Unit

3 What can go wrong? Data session hijacking: Belgacom case
Eavesdropping: CBS 60 minutes mTAN interception: O2 One time password theft: Positive technologies SMS and one time password interception: IEEE 2017 Subscriber Profile Extraction and Modification: NSS 2017 2018? Interconnection Security | ENISA IR Team –COD1 Unit

4 Perceived risk from signalling
Interconnection Security | ENISA IR Team –COD1 Unit

5 Common types of attacks
Interconnection Security | ENISA IR Team –COD1 Unit

6 How often? Interconnection Security | ENISA IR Team –COD1 Unit

7 How we protect ourselves?
Interconnection Security | ENISA IR Team –COD1 Unit

8 Guidelines on signalling security
Interconnection Security | ENISA IR Team –COD1 Unit

9 5G security concerns Interconnection Security | ENISA IR Team –COD1 Unit

10 Conclusions Level of risk: Medium to high!
Proper attention needed by all stakeholders Diameter inherited the risk Basic measures are in place but they are basic! Attacks are evolving 5G: A brand new threat playground? Interconnection Security | ENISA IR Team –COD1 Unit

11 High level recommendations
EU Commission 5G PPP (security) Baseline security measures for interconnections Funding to improve protection Increase international cooperation ENISA – Article13a EG Further analysis of the situation to identify further developments EU high-level guidelines to assure advanced protection at MS level NRAs Regularly analyze national situation and be aware of new developments Develop national guidelines/minimum security measures Industry Operators: adopt measures to ensure adequate level of security Standardisation bodies: Ensure security is properly addressed on the new 5G standard to avoid current threats Interconnection Security | ENISA IR Team –COD1 Unit

12 Technical recommendations
Ensure global and exhaustive monitoring of SS7 / Diameter / GTP Operators should be capable to protect against basic attacks Operators should adopt SS7 / Diameter firewalling Development of specifications and standards for new mobile signaling elements Promote communication between operators’ CERTs/SOCs at EU level Interconnection Security | ENISA IR Team –COD1 Unit

13 Good practices Advanced - Redirect to captive environment - Detect prequels to attacks - Detect advanced attacks - Deeply screen signalling messages Intermediate - Regularly perform external network security assessments - Ensure liability and legality of responses to malicious traffic - Analyse Interconnect messaging - Advice carriers to adopt security options in their interconnect offers Core measures - Monitor all interconnect traffic - Monitor core network elements - Monitor outgoing traffic Interconnection Security | ENISA IR Team –COD1 Unit

14 Thank you