EU member states, with the support of the Commission and the European Agency for Cybersecurity (Enisa), have published a wide-ranging report warning of the risk of increased cyber attacks on 5G networks throughout the continent. Although the EU has until now resisted US pressure to boycott Chinese companies such as Huawei and ZTE, the report highlights the risks to 5G from non-EU state or state-backed actors. “Among the various potential actors, non-EU states or state-backed are considered as the most serious ones and the most likely to target 5G networks,” said the European Commission and Finland, which currently holds the rotating EU presidency.
Huawei, which has always denied its equipment can be used for spying, reiterated its willingness to work with European partners on 5G network security. “This exercise is an important step toward developing a common approach to cybersecurity and delivering safe networks for the 5G era,” a Huawei spokesman told Reuters.
In addition to identifying the main threats, the report highlights the most sensitive assets, the main vulnerabilities (including technical ones and other types of vulnerabilities) and a number of strategic risks. It says the main security challenges are linked to key innovations in 5G technology, in particular the important part of software and the wide range of services and applications enabled by 5G, as well as the role of suppliers in building and operating 5G networks and the degree of dependency on individual suppliers. “A major dependency on a single supplier increases the exposure to a potential supply interruption, resulting for instance from a commercial failure, and its consequences,” it said.
The EC added that member states should assess the effects of the Recommendation in order to determine whether there is a need for further action by 01 October 2020. Other steps include a toolbox of mitigating measures addressing cyber security risks at national and bloc-wide level to be agreed by the Network and Information Systems Cooperation Group before 31 December 2019, while the EU Agency for Cybersecurity is also completing a map of specific threats related to 5G networks.
