The US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) recently released the first of a four part series titled Security Guidance for 5G Cloud Infrastructures. This series of four action-oriented documents is intended to provide guidance on how to move toward zero trust in support of securing 5G. It’s been created as a joint industry and government effort with the support of several large contributors through the NSA’s Enduring Security Framework (ESF).
This third release in the series is titled Security Guidance for 5G Cloud Infrastructures – Part III: Data Protection [PDF] with the focus on ensuring that network and customer data is secured during all phases of the data lifecycle (at–rest, in transit, while being processed, upon destruction).
The guidance covers:
- The Platform must support confidentiality and integrity of data at–rest, in–transit, as
well as related metadata. - The Platform must support confidentiality and integrity of processes and restrict
information sharing with only authorized parties (e.g., tenant). - The Platform must support confidentiality and integrity of process–related metadata
and restrict information sharing with only authorized parties (e.g., tenant) - The Platform must support confidentiality and integrity of workload resource
utilization (RAM, CPU, Storage, Network I/O, cache, hardware offload) and restrict
information sharing with only authorized parties. - The Platform must not allow memory inspection by any actor other than the
authorized actors for the Entity to which Memory is assigned (e.g., tenants owning the
workload), for Lawful Inspection, and by secure monitoring services
For more information see the release on the CISA website: https://www.cisa.gov/uscert/ncas/current-activity/2021/12/02/nsa-and-cisa-release-part-iii-guidance-securing-5g-cloud
The guidance is available here [PDF]: Security Guidance for 5G Cloud Infrastructures – Part III: Data Protection
All the guidance papers and other useful information will be available at the CISA’s 5G Security and Resilience page or at the NSA’s Enduring Security Framework (ESF) page.
Marin Ivezic
For over 30 years, Marin Ivezic has been protecting critical infrastructure and financial services against cyber, financial crime and regulatory risks posed by complex and emerging technologies.
He held multiple interim CISO and technology leadership roles in Global 2000 companies.
