3 cybersecurity threats to consider when building a private 5G network

• Businesses may elect to build their own private 5G networks.
• 5G is built to be secure, but external interactions can introduce security concerns.
• Experts recommend building and securing a 5G network the same way you would a cloud network.
• This article is part of "5G Playbook," a series exploring one of our time's most important tech innovations.

Business owners who elect to build their own private 5G networks rather than choose one from a dedicated infrastructure provider often make the decision because they see private 5G as potentially more secure or would like more control over data flows.

But it can be daunting to take on the task of keeping users safe and data secure without a lot of previous experience running such networks.

"In terms of security, 5G is extremely secure," William Webb, an IEEE fellow and the chief technology officer at Access Partnership, told Insider. "Like 4G, strong security is designed into the standard and as yet there have been no significant security breaches on 5G networks."

While 5G alone may be secure, Webb and other experts acknowledged there are risks associated with building your business' IT infrastructure with 5G at the center. Here are three threats to consider when building your own private 5G network.

1. Beware the interactions, not the internal issues

5G is an inherently secure technology, but it's only as good as the porousness of its borders and where the private network meets other IT infrastructure. 

"The security risks will arise outside of the 5G network, for example where it breaks out into the business IT network," said Webb. "If there are insecurities in the business network, then it is possible these could be used to break into the 5G network via the controlling interface."

Parm Sandhu, the vice president for enterprise 5G products and services at NTT Ltd., told Insider that while 5G is secure, "In the end, one is still deploying an application into an enterprise data center to connect multiple devices to multiple enterprise apps, which of course increases the threat surface." 

To mitigate the threats that could ensue, Sandhu said that "all existing security policies should be considered and applied to the 5G network, just as they would be applied to any other part of the enterprise network."

2. Build it like your cloud — and keep it similarly secure

While 5G is considered safer than other connected technologies, it remains public-facing, even when a private network exists, and it should be treated as such. Because the tools and technology that access the 5G network are by their nature public, it's susceptible to the same issues.

"5G also leverages virtualized and cloud technology, so naturally it inherits many of the challenges faced in IT and cloud," said Aarthi Krishna, the global head of intelligent industry security at Capgemini. "Monitoring 5G networks requires specific capabilities different from those used for IT and OT networks, as existing monitoring tools cannot be directly adapted to fit cellular environments."

3. Threats will increase the more you use 5G

One of 5G's main benefits is its ability to be used in a number of ways, from powering the Internet of Things to providing edge processing for millions of users while mobile. 

But "as the global footprint of 5G expands, so does the associated security risk," said Krishna. "Security issues in 5G arise from complex implementations and the expanded attack surface resulting from numerous devices and data that require protection."

It's therefore important to constantly monitor how your private 5G network evolves over time — and watch for incursions from unrecognized sources in and out of the network. "Traffic entering and leaving all entry points into the 5G network should be monitored and inspected for threats," said Sandhu.

To prevent unwanted transfers that are difficult to keep track of, Sandhu said companies need to ensure they configure their network properly to begin with. 

"For enterprise deployments, avoid control plane/user plane separation in the architecture," he said. "Not only is it not needed in enterprise-scale networks, but it can also further increase the potential attack surface."