Part 6 · Threats, Attacks, and Operator Protection
24
The 5G Threat Model
Every surface, every actor, on one map you can defend from
"You cannot defend what you have not enumerated. A threat model is the map; everything in Part 6 is how you patrol it."
— WHY THIS CHAPTER OPENS PART 6
This chapter assembles a complete 5G threat model — every attack surface from the device to the cloud, the actors who exploit them, and a risk ranking to prioritize defense. It is the consolidation of the threats raised throughout the book, mapped to industry frameworks (MITRE FiGHT, GSMA), and the springboard for the monitoring, SOC, and audit chapters that follow.
🎯 Learning objectives
Build a 5G threat model that matches the real architecture.
Checked June 2026 — verify against the latest 3GPP version.
24.1 The Master Threat Map
FIGURE 24.1Master Threat Map — Every Surface on One Page
Purpose: the consolidated attack surface. Eight branches, each expanded below — this is the map the SOC (Chapter 27) and audit (Chapter 28) patrol.
FIGURE 24.2Threat Actor Gallery — Capability × Intent
Purpose: match defenses to adversaries. A consumer eMBB network and a national-grid slice face very different actors; the threat model must reflect who actually targets you.
FIGURE 24.3UE / Device Threat Branch
Purpose: device-side threats. The ceiling is bounded by the USIM (Chapter 4), but malware, SIM swap, and fleet compromise remain real — countered by hardware roots and device monitoring.
FIGURE 24.4Air Interface & RAN Threat Branch
Purpose: the radio and RAN threats. Mutual authentication (Chapter 5) kills the classic false base station on SA; jamming, sniffing, transport taps, and downgrade survive and need their own controls.
FIGURE 24.5Rogue gNB / False Base Station Scenario
Purpose: the canonical RAN attack, post-5G. Mutual authentication stops the man-in-the-middle, but the rogue gNB can still disrupt — and clustered MAC failures (Chapter 6) are its signature.
FIGURE 24.6Core / SBA Threat Branch
Purpose: the SBA threats (Chapters 10–11). The new web-style core inherits web-style attacks; mTLS+OAuth, NRF hardening, and HSM-protected keys are the answers.
FIGURE 24.7Lateral Movement Inside an SBA Core
Purpose: why per-operation authorization matters. With OAuth scope/audience, a compromised NF is boxed in; without it (mTLS only), one foothold owns the core (Chapter 10).
FIGURE 24.8API / Exposure Threat Branch
Purpose: exposure threats (Chapter 12). The northbound is a web API with web-API threats; the controls are CAPIF, three-dimensional authorization, quotas, and data minimization.
FIGURE 24.9Roaming / Interconnect Threat Branch
Purpose: roaming threats (Chapter 13). The SS7/Diameter attack classes survive at the interconnect; the SEPP's filtering, PRINS, and topology hiding are the defenses.
FIGURE 24.10Cloud / NFVI Threat Branch
Purpose: cloud threats (Chapter 29). The core is now software on Kubernetes, inheriting cloud-native attacks — container escape, secrets exposure, and supply-chain compromise lead the list.
FIGURE 24.11Supply Chain Threat Path
Purpose: the modern indirect attack. A backdoored dependency or image rides the pipeline into production; signing, scanning, and SBOM (Chapter 29) intercept it.
FIGURE 24.12Insider Threat Vectors
Purpose: the hardest threat — trusted access. Insiders bypass perimeter controls; least privilege, MFA, immutable audit logs, and separation of duties are the defenses.
FIGURE 24.13MITRE FiGHT Mapping of Chapter Threats
Purpose: speak the industry's language. Mapping threats to MITRE FiGHT connects your model to detection tooling, threat intel, and the SOC (Chapters 26–27).
FIGURE 24.14Risk Matrix — Likelihood × Impact
Purpose: turn the model into priorities. Plot each threat by likelihood and impact; defend the upper-right first. This drives the audit and monitoring focus of Chapters 26–28.
FIGURE 24.15The Threat Model's Output — a Ranked Risk Register
Purpose: the deliverable. A threat model's value is a ranked, owned, control-mapped register that the audit and SOC chapters operationalize — not a one-time diagram.
24.2 The Practical Operator View
Build a living risk register, not a static diagram — rank by likelihood × impact, assign owners and controls.
Tailor to your actors — critical infrastructure faces nation-states and insiders; consumer eMBB faces fraud and DoS.
Map to MITRE FiGHT / GSMA for shared language with tooling and intel.
Defend the upper-right first — crown-jewel compromise (UDM, NRF) and interconnect abuse.
Feed the register into monitoring and audit (Chapters 26, 28).
Common gaps
Threat model treated as a one-time document, never updated.
Insider and supply-chain branches under-weighted.
No mapping to detection tooling (FiGHT) → blind spots.
Uniform defense instead of upper-right prioritization.
24.3 Threats and Mitigations (Top-Level)
Branch
Headline threat
Primary control · chapter
UE/device
malware, SIM swap, fleet compromise
USIM root, EIR, fleet monitoring · 4,23
RAN/air
rogue gNB, downgrade, transport tap
mutual auth, IPsec, FBS detect · 5,14,15
Transport
interception/injection
NDS/IP IPsec · 14
Core/SBA
lateral movement, NRF/UDM compromise
mTLS+OAuth, HSM · 10,11
API/NEF
surveillance, scraping
CAPIF, quota, minimization · 12
Roaming
tracking, fraud, key theft
SEPP filtering, PRINS · 13
Cloud
escape, secrets, supply chain
CNF hardening · 29
Insider
privileged abuse, key export
MFA, least priv, audit · 11,30
24.4 Terminology
Term
Meaning
threat model
Enumeration of surfaces, actors, threats, and controls
MITRE FiGHT
5G adversary tactics/techniques knowledge base
risk matrix / register
Likelihood×impact ranking driving prioritization
attack surface
The set of points an attacker can target
Real network example. A national operator's first 5G threat model was a slide deck listing radio attacks — false base stations, jamming — because that's what the RAN team knew. A subsequent independent assessment found the highest-impact risks were entirely absent: insider key export from the UDM, NRF compromise enabling SBA-wide impersonation, and roaming-interconnect abuse. The model had been written from one team's perspective and missed the crown jewels and the interconnect. Rebuilt as a living, cross-team risk register mapped to MITRE FiGHT and ranked by likelihood × impact, it reprioritized the security roadmap toward UDM/NRF hardening and SEPP filtering — and became the input to the SOC's detection use cases and the annual audit. A threat model written from one vantage point defends one vantage point; the whole surface needs the whole org.
★ Chapter Summary
The 5G attack surface has eight branches: UE, RAN/air, transport, core/SBA, API/NEF, roaming, cloud, insider.
Match defenses to the actors you face (nation-state/insider for critical infrastructure).
The highest-impact risks are usually UDM/key theft, NRF compromise, roaming abuse, and insiders — not just radio attacks.
Map threats to MITRE FiGHT/GSMA and rank with a risk matrix.
The output is a living, owned, control-mapped risk register that drives monitoring (Ch 26) and audit (Ch 28).
? Review Questions
Name the eight threat-model branches and one headline threat for each.
Why must a threat model be tailored to the actors a network faces?
Which threats typically sit in the high-impact corner, and why are they often missed?
How does OAuth contain SBA lateral movement?
Why are insider and supply-chain threats the hardest to defend?
What does mapping to MITRE FiGHT give an operator?
How should a risk matrix drive defense prioritization?
A threat model lists only radio attacks. What's wrong and how do you fix it?
🧪 Mini lab — build your risk register
On paper, build a top-10 5G risk register for a chosen network (e.g., a hospital private 5G, or a national consumer network): (1) For each of the eight branches, list the most relevant threat. (2) Score each by likelihood and impact (1–5) and rank. (3) Assign a primary control and the chapter that covers it. (4) Identify which actors drive your top three. (5) Map each to a MITRE FiGHT tactic. The result is the single most useful security artifact you can hand to a SOC (Chapter 27) and an auditor (Chapter 28) — and it's the lens for the rest of Part 6.