The Cyber Defense eMagazine November Edition for 2023

configurable data privacy. These building blocks will help reduce potential attack vectors and will make it
much harder for adversaries to exploit IoT devices, connected infrastructure, and end users. It is also
important that the focus is not only on cyber-hardening of the IoT devices or sensors. Securing the
surrounding IoT ecosystem and components, such as mobile apps and cloud-hosted services that
interact with IoT devices and services like home security cameras and Alexa-type voice assistants, is
equally important.
Considering these ongoing and expansive cyber threats in the IoT domain, there is widespread
recognition that preventative actions need to be taken. In July, the FCC, along with a host of partnering
companies, announced a late 2024 Cyber Trust Mark labeling program for interconnected IoT and home
automation devices, such as home network routers, appliances, security cameras, and other products.
The goal of the program is to help consumers quickly assess the security level of an IoT product or
service without requiring them to be a cyber expert. Modeled after similar product security programs in
other countries such as Singapore, the new US Cyber Trust Mark program is expected to help consumers
with their IoT device purchasing decisions. The program is also expected to help motivate IoT device
manufacturers to voluntarily add more security to their offering and allow them to use the US Cyber Trust
Mark to help differentiate their offerings.
In relation to enhanced 5G/6G threats and attack surfaces, network slicing is often part of the
conversation. Network slicing, for example, allows a network operator to "slice" a 5G network into multiple
logical and independent networks and provide fine-grained control over who gets priority network access
and how much bandwidth each user, application, and service gets to consume. Advanced networking
capabilities like slicing, however, also considerably increase the implementation complexity and attack
surface 5G/Future G networks. The official 5G standard specification did not provide sufficient guidance
on how to implement features such as network slicing securely. As a result, many 5G implementations
have fallen victim to sophisticated denial of service, side channel, and man-in-the-middle attacks. To help
address these shortcomings, the NSA and CISA recently released security considerations for the
implementation of 5G network slicing. In their recommendations, they address some identified threats to
5G standalone network slicing and outline specific practices for the design, deployment, operation, and
maintenance of network slices.
The implementation and operation of next generation networks and advanced capabilities such as
network slicing will also require network operators to implement and rely more on algorithmic and AI/MLdriven
decision making. The increased use of AI/ML in the operation of networks will also require a
significant change in how these advanced networks are secured. For example, 5G/Future G networks
will also have to address and counter known AI/ML-related vulnerabilities and attacks, such as data
poisoning and adversarial attacks. Independent of network-specific vulnerabilities such as network slicing
or AI/ML operations, however, the Zero Trust mantra of “Never trust, always verify!” should always apply.
To help reduce cyber-attack surfaces and to combat continuously evolving IoT- and 5G/6G-related cyber
threats, suppliers, manufacturers, service providers, and users must
work closely together to cyber-harden their components, devices, networks, and services.
After all, cybersecurity is a team sport.
Cyber Defense eMagazine – November 2023 Edition 123
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.