ATIS Enhanced 5G and Zero Trust Cloud 2025

Keypoints

• Annual-style security reports like this one typically begin with scope and background, then summarize the current standards landscape, deployment models, control recommendations, implementation challenges, and finally conclude with recommendations and next steps.
• In the opening sections, the report frames the core problem: 5G is moving from operator-owned infrastructure to layered cloud environments, increasing exposure to internal and external threats, reducing visibility into lower infrastructure layers, and making trust assumptions unsafe.
• A major recurring theme is that zero trust must assume breach and minimize implicit trust zones, especially in cloud-native 5G environments where multiple vendors, providers, and integrators may control different layers of the stack.
• The report identifies 12 fundamental zero trust security control groups for 5G, including sensitive data encryption, IAM, PKI mutual authentication, MFA, micro-segmentation, anomaly detection, EDR/TDR, continuous monitoring, DevSecOps, threat intelligence, automated validation, and SIEM/SOAR integration.
• NIST’s zero trust tenets are used as the conceptual baseline, especially the need for continuous verification, dynamic policy enforcement, and ongoing monitoring of asset posture and communications.
• CISA’s Zero Trust Maturity Model is presented as a four-stage progression: Traditional, Initial, Advanced, and Optimal, with AI/ML playing a key role at the most mature stage.
• Standards and industry bodies are positioned as complementary efforts: 3GPP focuses on 5G Core SBA, ETSI NFV-SEC addresses whole-system security management, O-RAN pursues zero trust for Open RAN, and FCC CSRIC provides policy and standards recommendations.
• The report highlights four common 5G cloud deployment models: multi-vendor stack, telco vendor full stack, hyperscale cloud public offering, and hyperscale cloud private cloud, noting that each changes the security responsibility boundary.
• IAM and MFA are treated as foundational controls, with the report assuming threat actors may already be inside the network and access must therefore be tightly controlled at every stage.
• PKI-based mutual authentication, TLS, certificate pinning, and OAuth 2.0 are repeatedly emphasized for securing machine-to-machine and NF-to-NF communications.
• Microservices, containers, trust zones, and micro-segmentation are central design concepts, with the report recommending fine-grained isolation to limit lateral movement and reduce blast radius if one NF is compromised.
• Kubernetes, CNI technologies such as Calico and Cilium, and service meshes such as Istio and Linkerd are identified as major enforcement layers for micro-segmentation and secure service-to-service communication.
• Continuous security monitoring is described as essential because static defenses are insufficient against adaptive adversaries; the report stresses the need to define, collect, expose, normalize, and evaluate security data across heterogeneous environments.
• The report notes a key industry gap: security data is often proprietary and unstructured, while effective SIEM/SOAR operations require standardized, machine-consumable telemetry.
• SIEM and SOAR are presented as the operational backbone of SOC response, but the report says telco-specific support is often missing in commercial tools, forcing vendors or skilled operators to create custom detections.
• eBPF is highlighted as a high-value telemetry source because it offers detailed kernel-level visibility with lower performance overhead than older techniques such as deep packet inspection.
• AI/ML-based anomaly detection is presented as increasingly important for spotting malicious behavior, preventing lateral movement, and identifying unknown or emerging threats, including zero-days and AI-enabled attacks.
• The report also warns that AI/ML introduces new attack surfaces of its own, so governance, security controls, and future defensive research are needed for AI-based systems in 5G environments.
• EDR/TDR is discussed as especially important for telco workloads such as AMF, CU, and DU, but containerized CNFs require specialized tuning, Linux awareness, and careful decisions about kernel-mode versus user-mode deployment.
• CISA’s “Top Routinely Exploited Vulnerabilities” is cited to underscore that many of the most exploited vulnerabilities began as zero-days, reinforcing the need for modern EDR capabilities.
• Threat intelligence is tied to structured sharing formats like STIX and TAXII, with the report noting that IT ecosystems are more mature than the 5G-specific ecosystem.
• MITRE FiGHT and GSMA MoTIF are presented as emerging telecom-focused threat frameworks intended to fill gaps left by MITRE ATT&CK for 5G-specific threats such as fraud, roaming signaling abuse, false base stations, and mobile spam.
• Policy management is another major focus, with the report recommending a hybrid policy model that blends centralized, federated, hierarchical, and hybrid approaches to fit both structured 5G Core/RAN environments and more variable orchestration layers.
• Policy-as-Code and Infrastructure-as-Code are emphasized as practical methods for making zero trust repeatable, testable, and automatable across CI/CD pipelines and cloud infrastructure.
• The report maps 5G Core components to zero trust functions, identifying roles for PCF, UDM/UDR, AMF, NEF, NRF, SCP, NSSF, and other network functions as PDPs, PEPs, or trust-engine contributors.
• Orchestration and context awareness are treated as essential for real-time policy decisions, with access depending on factors such as identity, device posture, location, risk score, and service context.
• A broader situational awareness capability is proposed as a future enhancement to ZTA, allowing more proactive decisions based on how the cloud environment is likely to evolve.
• The conclusion stresses that the biggest challenges are standardization, interoperability, and policy enforcement across different deployment models and vendors.
• Key recommendations include aligning standards across 3GPP, ETSI, O-RAN, and other bodies; standardizing security data for continuous monitoring; improving SIEM/SOAR integration; adopting hybrid ZT models; and preparing for post-quantum cryptography migration.
• For MNOs, the report advocates deploying micro-segmentation, service meshes, eBPF, AI-enhanced SIEM/SOAR, and continuous authentication to secure both legacy and cloud-native 5G infrastructure.
• For cloud providers, it calls for native zero trust services, clearer vulnerability sharing, better support for EDR in private cloud environments, and stronger visibility into cloud security posture.
• The recurring takeaway is that 5G security is no longer perimeter-based; it must be resource-centric, continuously verified, and jointly implemented across telecom, cloud, and standards ecosystems.