Cybersecurity Policy Report, New CSRIC Tasked With 911, 5G Cybersecurity, (Jul 22, 2019)

By Paul Kirby

At its first meeting last week, the FCC's Communications Security, Reliability, and Interoperability Council VII reviewed tasks facing its six working groups over the next two years concerning recommendations for improving security and reliability for 5G networks, 911 and alerting systems, and broadcasting.

During the Friday meeting, which lasted only about a half-hour, Lisa Fowlkes, chief of the FCC's Public Safety and Homeland Security Bureau, told the CSRIC that a public notice would be released soon seeking additional participation in the six working groups. The public notice is also expected to include the names of working group chairs.

The managing security risk in the transition to 5G working group (working group 2) will "review risks to 5G wireless technologies that may carry over from existing vulnerabilities in earlier wireless technologies that can lead to the loss of confidentiality, integrity, and availability of wireless network devices. CSRIC VII will recommend best practices to mitigate the risks for each vulnerability it identifies and address recently proposed solutions by security researchers. Additionally, the FCC directs CSRIC VII to recommend any updates, if appropriate, to the 3GPP SA3 (security working group) standards, including digital certificates and pre-provisioned certificate authorities, to mitigate these risks and then place the vulnerabilities on a scale that accounts for both risk level and remediation expense. Finally, the FCC directs CSRIC to identify optional features in 3GPP standards that can diminish the effectiveness of 5G security and recommendations to address these gaps."

A report on the risks to 5G networks from legacy system vulnerabilities and recommended best practices to mitigate them is due in June 2020, while a report on recommended updates to 3GPP standards that includes a comparison of risk and remediation expenses is due December 2020.

The managing security risks in emergency 5G implementations working group (working group 3) plans "to evaluate the 3GPP release 16 standards, identify areas of risk, and develop risk mitigation strategies to minimize risk in core 5G network elements and architectures. Further, the FCC directs CSRIC to identify optional features in proposed or work-in-progress 5G standards that can diminish their effectiveness."

A report on risks introduced by release 16 is due in September 2020, while recommendations on mitigating those risks are due in March 2021.

The 911 security vulnerabilities during the IP transition working group (working group 4) will "identify security risks in legacy [911] networks, transitional 911 networks, and NG-911 networks and recommend best practices to mitigate risks in these three areas. In addition, CSRIC VII will place the vulnerabilities on a scale that accounts for both risk level and remediation expense."

A report on security risks and best practices is due in June 2020, while a report on risk magnitude and remediation costs in 911 and NG-911 networks is due in December 2020.

The SIP security vulnerabilities working group (working group 6) will "review the security vulnerabilities affecting SIP [session initiation protocol] that affect the provision of communications service. CSRIC VII should outline how industry is addressing these vulnerabilities, identify any gaps in industry action, update any existing best practices relevant to SIP, and develop additional ones that, if implemented, would address such vulnerabilities and mitigate their associated risks, including the promotion of end-to-end-security." A report is due in March 2021.

The next CSRIC VII meeting is scheduled for Sept. 17.

News: Cybersecurity