SUPPLY CHAIN SECURITY CONSIDERATIONS FOR 5G DEPLOYMENTS – WHERE ARE WE IN THIS JOURNEY ?

Supply chain attacks have increased exponentially over the past years. The software supply chain has quickly become the latest target for malicious actors, with targeted attacks on foundational software components intended to orchestrate data breaches, initiate service outages or execute ransomwares. Many new initiatives, such as SBOM (Software Bill of Materials) and SLSA (Supply-chain Levels for Software Artifacts), have emerged to address this challenge and government requirements now also address the supply chain risk and secure software development that will also affect private networks.

Due to the many use cases supported by 5G technology and the “softwarisation” of the network, those deployments are a great target for attackers. Securing an increasingly distributed (edge) and disaggregated (Open RAN) architecture requires accountability of each stakeholder (network functions vendors, cloud platform providers, system integrators, telecom operators,…) in securing the 5G supply chain. Private network deployments will face legal requirements e.g., coming from NIS2 which will be handed down to their network suppliers.