Ericsson RAN
Security Threat
Detection

Ericsson enables
Communication Service
Providers to discover security
threats to the RAN using
automation and efficient
detection algorithms. Threatssuch as false base stations are
responded to with appropriate
measures to protect user
data, privacy and business
operations.

2

Ericsson | Ericsson RAN Security Threat Detection title

Networks are
obvious targets
for threat actors
The threat landscape formobile networks is everchanging, with a web ofadvanced threat actors using
increasingly sophisticatedtactics and techniques.
Diverse motives exist –from theft and fraud, tospying, political protest andsabotage. With networks
playing such a vital part inour digital lives, they are now
obvious targets for threatactors.

Data breaches are happening constantly.
A major data breach is defined as a breachin which more than 30,000 records are lostor stolen.
Verizon’s annual report into data
breaches recorded 5,258 breaches in 2021.
IBM’s 2021 report found that the average
total cost of a data breach is $4.24M. 287
days was the average time required toidentify and contain a data breach. That’smore than 9 months.
Data breaches are a very significant
problem affecting both telecom service
providers and their enterprise customers.
When network security breaches occur
and data is lost or damaged, there areconsequences for service providers.
Breaches may also compromise network
services, impacting availability forsubscribers through outages and loss ofmobile service. These outages can lastminutes, hours, or even days while theproblem is resolved, and normal service
resumed.
Outages and data theft result in
financial losses for service providers.
Penalty payments will be owed tosubscribers and enterprise customers tocompensate for loss of service, and there
may be a possibility of regulatory finesfrom authorities too.
During this time, service providers arebusy with several urgent tasks. They’re
responding to the incident to fix thenetwork problem, using digital forensics
to identify the cause, and communicatingwith subscribers and the media about thecause of the outage, and the time to restore
normal service.

“Hackers attack every 39 seconds”“Average total cost of a data breach $4.24 million”“5,258 confirmed data breaches”“287 days – average to identify and contain a data breach”

Healthcare

14

Telecom service providers

8Social networking

10Finance

Major databreaches>30.000records

6Technology

7Web & Gaming

19Ericsson | Ericsson RAN Security Threat Detection

3Service providers
are challenged bya limited visibility of
threat activity in RAN
Tactics and techniques used to breach
network security are constantly changing.
The use of false base stations is a method
for compromising telecom networks. Also
known as ‘stingrays’ or ‘IMSI catchers’,
they are an important type of RAN-specificthreat to detect and report.”
The Radio Access Network (RAN) is
the largest and most accessible part of a
CSP’s network, with thousands of potential
targets. Much radio equipment is placedin public locations with a lower degree ofphysical protection, compared with otherparts of the network, which will generally
be located within secured buildings.

Service providers are challenged bylimited visibility of RAN threat activity,
control of RAN security and timely reportsof security breaches. Lack of RAN-specificsecurity automation and detection makes
managing security in the RAN domain
hard. Without highly tuned RAN-specificdetection algorithms and processes,
detection turns to laborious manual threat
hunting or time-consuming incident
response. Manual checking of security
compliance and controls is time consuming,taking resources which could be used onhigher-value tasks.

How false basestations operate
False base stations attacks are relatively
easy to perform in older generation
networks with fewer in-built security
mechanisms. The required investment inequipment to create a false base station
can be as low as $1,500.
False base stations are small andlightweight. They could be carried in a box
or backpack. Therefore, they are highly
mobile and can be carried around by one
person. Without specialist equipment or
sophisticated software, they are relatively
hard to detect.
Even if an adversary can mimic a basestation, the attack does not scale welland will be limited to the coverage of a
false base station. Hence, if the attacker istargeting a specific user, they will alreadyhave an approximate understanding of
where the victim is geographically located.

False base station

4

Threat detection
made possible withEricsson Security
Manager and RAN
software
Ericsson Security Manager (ESM) and RAN software,
implemented together, make it possible to detectthreats to radio access networks.
Ericsson Security Manager already includes
Operational and Management (OAM) Detection
Logic to detect threats based on real time security
event logging (RTSEL). With the introduction ofRAN Detection Logic, the threat detection capabilities
of ESM are further enhanced with the detection offalse base stations.

Ericsson | Ericsson RAN Security Threat Detection

Ericsson | Ericsson RAN Security Threat Detection

5An ideal detection
solution“71% of CMOs believe
the biggest cost of asecurity incident is theloss of brand value”
Source: Data Privacy Manager

RAN Security Threat Detection provides
improved visibility and control overpotential security breaches in the RAN.
Continuous monitoring of active threatsmeans service providers can take action tomitigate the consequences early. Security
automation with ESM has the potentialof cost savings up to 80% and with RAN
threat detection there is a greater potential
benefit.
Manual threat detection is very
resource-intensive and takes skilled
security operations staff away from otherhighly specialized activities. The work istime consuming and challenging. RAN
specific detection provides more tuned andfocused alerts, reducing the risks of missing
threat activities.
RAN Security Threat Detection helps
service providers to reduce the risk ofpotential service loss, regulatory fines andreputational damage which could result
from a network being compromised.
Investing in security increases end-userperception of a responsible service provider
protecting its subscribers and can therefore
strengthen the service provider’s brand.

Cost savings up to 80%
compared with manual
security management“Ericsson Security
Manager has brought
security compliancevisibility and control toa new level – it is liketurning the lights on ina dark cave”

80%

Philippe Vuilleumier,
Head of Group Security, Swisscom

6

Ericsson | Ericsson RAN Security Threat Detection

Detect a false
base station!
The Ericsson RAN software provides thecapabilities required to initiate securityenhanced measurement reporting between
the legitimate base stations and the UEs(e.g., mobile phones). These measurements
are collected by Ericsson Network Manager(ENM) and then analyzed by ESM, whichalerts the Security Operation Center (SOC)
if a false base station is detected.
Together with Ericsson Security
Manager (ESM), the Ericsson RAN Security
Threat Detection software offers timely
detection using automation and advanced
detection algorithms. It’s flexible and canbe set to constant alert, reducing manual
probing and testing, and freeing up security
operations resources to reduce Opex.

Unique values forService Providers
The Ericsson RAN Security Threat
Detection solution is powerful andinnovative, with unique values for telecom
deployments. This is how false base station
detection works.

RAN-specific threat detection enables
communication service providers topromptly discover threats to the RAN,
including false base stations. They canthen take appropriate measures toprotect user data, privacy and business
operations. Detection is better performedby using intelligence from within theRAN itself, and with deep telecom knowhow to understand threats and potential
weaknesses. An enterprise/IT-focused
solution will not be sufficient or effective.
Network-centric intelligence
It is a software-only automated solution
leveraging intelligence from within thenetwork. Measurements are made by theUEs, controlled by the RAN and analyzed
by ESM. Efficient and innovative detection
algorithms build on deep Ericsson
radio expertise. Automated detection isconstantly active, and false base stations
are promptly reported. Detection can becustomized to focus on at-risk locations
or times. The solution combines both
3GPP standards and Ericsson analytics
innovation.

“Detection canbe customized
to focus onat-risk locations
or times.“

Ericsson | Ericsson RAN Security Threat Detection

7Meeting all specificrequirements“You can beconfident whena detection isreported that thethreat is real.“The solution has smart analytics
capabilities with dependable and timely
reports. Alerts of false base stations arehighly precise with minimal false positives,
meaning you can be almost certain when adetection is reported that the threat is real.
It is a cost-effective software-only
solution with no need for any network
probes or other air interface measuring
devices. No drive testing or other manual
processes are required, and threat
detection activities are easily scaled tocover a large percentage of the RAN.

8Ericsson | Ericsson RAN Security Threat Detection

Ericsson is a world leader in communications
technology and services with headquartersin Stockholm, Sweden. Our organizationconsists of more than 111,000 experts who
provide customers in 180 countries with
innovative solutions and services. Together
we are building a more connected future
where anyone and any industry is empowered
to reach their full potential. Net sales in 2016
were SEK 222.6 billion (USD 24.5 billion).
The Ericsson stock is listed on Nasdaq
Stockholm and on NASDAQ in New York.

Number To be Updated
Ericsson.com

The content of this document is subject
to revision without notice due to continued progress in methodology, designand manufacturing. Ericsson shall haveno liability for any error or damage ofany kind resulting from the use of thisdocument

2/28701-FGB 101 0781 Uen© Ericsson AB 2022