ENISA: 5G design and architecture of global mobile networks; threats, risks, vulnerabilities; cybersecurity considerations [version 3; peer review: 2 approved, 1 approved with reservations]

Abstract —The literature on 5G design and architecture numbers in the hundreds of thousands, which makes analyzing this vast corpus of technical knowledge impossible within the scope of a single article. A rigorous literature scan has revealed investigations of various specific 5G components, or specific aspects of 5G design, architecture, or security, but none that are comprehensive in scope, encompassing all of the aforementioned categories, or that take into account the associated vulnerabilities, threats and risks to the basic 5G infrastructure. In this sense the 5G framework advocated by The European Union Agency for Cybersecurity (ENISA) in its comprehensive report is singular in relation to the extensive literature associated with the 5G domain and the fragmented character of scientific reporting related to 5G technology. It is the purpose of this article to go beyond the existing literature and examine in depth the details of the ENISA 5G Threat Landscape Report and reveal ENISA’s painstaking efforts to stand out among other leading-edge players in the 5G arena and achieve its strategic aims of integrating cybersecurity considerations with threats, risks, and vulnerabilities into an architecture of 5G right from the start of the design and development process. In formulating such a framework, ENISA has set the stage for standardization of cybersecurity considerations in relation to 5G design and architecture that may be considered a first approximation towards best practice in the field. ENISA’s role in the European Union as a leader in setting the pace of development of 5G networks is acknowledged in EU’s legislation and its directives. Significantly, its strategic direction targets future implementations of 5G networks by vendors, operators, and practitioners. This should equip EU with the necessary resilience to withstand hybrid threat onslaughts on its Pan-European network, a topic to be dealt with in full in a follow-on paper.