5G security features and risks
In short: 5G improves on 4G with stronger subscriber privacy, home-network control of authentication and protected interfaces between network functions and operators. But 5G is also software-defined and cloud-native, so many risks now come from virtualisation, APIs, supply chain and misconfiguration. Some protections are optional and must be switched on.
Security improvements in 5G
3GPP specifies 5G security in detail (the main architecture document is TS 33.501). Many improvements apply only to standalone 5G, where the 5G Core is used.
- Authentication: devices and network authenticate each other using 5G-AKA or EAP-AKA', with keys rooted in the SIM. In 5G the home network confirms the result, which reduces fraud from visited networks.
- Identity privacy: the permanent identity (SUPI) is encrypted with the home network's public key into a SUCI before it is sent. Operators must configure this properly; a "null scheme" sends it unprotected.
- Service-based interfaces: network functions use TLS between them, and access to services is controlled with OAuth 2.0 tokens issued by the NRF.
- Roaming: the Security Edge Protection Proxy (SEPP) sits at the border between operators to filter and protect signalling, addressing abuse seen with older SS7 and Diameter links.
- User plane integrity: 5G supports integrity protection of user data over the radio, but it is optional and may not be enabled.
Where the risks are
| Risk | Why it matters | Typical mitigation |
|---|---|---|
| Virtualisation and cloud | Network functions share hosts, orchestration and container platforms | Hardening, segmentation, Kubernetes security, least privilege |
| API exposure | SBA and the NEF expose powerful functions | Mutual TLS, OAuth scopes, input validation, API monitoring |
| Supply chain | Complex multi-vendor software and hardware | Vendor assurance (for example GSMA NESAS with 3GPP SCAS tests), patching, diversity |
| Radio attacks | Jamming and fake base stations remain possible | Detection of rogue cells, disabling legacy fallback for sensitive users |
| Legacy interworking | NSA and 4G or 2G fallback lose 5G protections | Move to SA, monitor downgrade attempts, protect older signalling |
| Massive IoT | Weak devices can form botnets on fast links | Device security, slice isolation, rate limits, anomaly detection |
Configuration matters
Several protections are optional or depend on operator choices: SUCI protection schemes, user plane integrity, TLS between functions and SEPP filtering rules. A 5G network is only as secure as its configuration. Guidance from bodies such as ENISA (including the EU 5G toolbox), national cyber security agencies and GSMA helps operators and enterprises decide what to require.
Tip: enterprises using operator 5G should still treat it as an untrusted transport. Apply zero trust principles: authenticate devices and users, encrypt application traffic and monitor endpoints.
Exam and workplace angles
Expect questions comparing 4G and 5G security. Strong answers mention SUCI, home network control of authentication, SBA protection with TLS and OAuth 2.0, and SEPP. Then add the balancing point: 5G moves much of the attack surface into software and cloud, so traditional IT controls such as patching, access control, logging and secure DevOps become central to mobile network security.
Practice
What does the SEPP protect?
How are network functions in the 5G SBA authorised to call each other?
Why might a 5G phone still be exposed to identity catching?
Key takeaways
- 5G adds mutual authentication with home network control and concealed identities.
- SBA interfaces use TLS and OAuth 2.0; the SEPP protects roaming signalling.
- Several protections are optional and must be configured.
- Cloud, API and supply chain risks are now central to mobile security.
- Enterprises should still encrypt traffic and apply zero trust over 5G.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.