TCCA urges standards push on critical broadband security

TCCA has published a white paper on cybersecurity in critical communications broadband networks, intended to help align stakeholders around international standards.

The paper, titled Cybersecurity in Critical Communications - an initial overview, examines cybersecurity requirements, frameworks, methodologies and network deployment models linked to the shift to 4G and 5G in mission-critical communications. It also sets out recommendations for organisations adopting broadband-based systems.

Critical communications operators and agencies are moving from traditional narrowband networks to more complex broadband environments built on 4G and 5G technologies. That shift brings a wider range of suppliers into the market, including telecoms vendors, device makers, application providers and service operators, while increasing the number of interconnected systems that need protection.

According to TCCA, these newer networks rely on open standards that are widely understood, which can also make them easier for threat actors to study. At the same time, the sector can draw on the experience of the 3GPP ecosystem, which has worked on securing mobile networks for decades.

Broader risk

The white paper argues that organisations should establish internal cybersecurity teams at the start of solution design, before engaging suppliers. It also recommends bringing in staff with expertise in the threats specific to broadband critical communications environments.

A complete critical broadband communications system can include radio access networks, network cores, mission critical service providers, devices, subscriber identity modules, applications and device management systems. Because these assets often come from different vendors, the supply chain becomes a more exposed part of the security model.

Organisations need a clear understanding of every asset involved in a deployment to assess risks properly. That reflects the broader challenge facing agencies and operators as communications systems become more software-driven and more dependent on complex vendor relationships.

Industry bodies and standards groups already play a role in defining cybersecurity requirements in this field. The paper presents that work as part of a broader effort to create a more consistent approach to mission-critical broadband networks and services across markets.

One aim is to encourage cooperation between equipment makers, operators, agencies and application suppliers that may previously have worked in more separate parts of the critical communications sector. In broadband systems, these groups depend more heavily on each other because services are built across multiple layers of infrastructure and software.

Standards push

The publication marks an early step in a longer process of discussion and development around security in critical broadband communications. TCCA represents users, operators and suppliers in the critical communications market and has been involved in global mobile standards work for broadband and TETRA-based services.

Filippo Gaggioli, who leads the cybersecurity task force within TCCA's Critical Communications Broadband Group and is from Nokia, linked the effort to a broader standards agenda.

"As critical broadband communications networks emerge globally, organisations should collaborate to share knowledge and experiences, with a longer-term vision of building international standards to enable an even more robust and secure set of mission critical communications solutions for everyone," said Filippo Gaggioli, leader of the Cybersecurity Task Force within TCCA's Critical Communications Broadband Group.

Tero Pesonen, chair of TCCA's Critical Communications Broadband Group, said the cyber risk profile of broadband systems differs from that of older narrowband networks.

"The cyber environment for mission critical broadband networks is significantly more complex and the amount of stakeholders is higher than in traditional narrowband networks," Pesonen said. "I am delighted to see TCCA members addressing this with an educational overview. This is an important first milestone in a chain of cyber security related work that will take place in the community."