# 5G Network Slice Isolation
## 3 Network Slice Isolation As a Security Measure
### Challenges in Network Slicing Security  
In this subsection, the key network slice security challenges are defined in four aspects, which are protection, prevention, identification and management, as summarized in Table 1.  
The protection challenges are raised by concerns about the network infrastructure to support NSaaS, where it shall begin to consider the protection of network infrastructure from static-resource to dynamic-resource network environments. Typically, static resources can be referred to as hardware assets, and dynamic resources can be considered software assets. Furthermore, these software assets can be created at runtime when the network elasticity is triggered by traffic and network services on-demand. Since these runtime software assets can be network slices, virtual network functions and SDN properties that may overload the network and affect the network services availability, we have to protect the network availability, service reliability and company liabilities at all times. In particular, other network services might have a functional error or be compromised, which can possibly affect any other network services' availability. All these protections shall be considered from the network resilience to the risk assessment of network services. The prevention challenges are the unauthorized access and inappropriate use of network infrastructure resources, which can be considered the access or usage from the same AD or from other ADs. Traditionally, the MNO only manages a single AD and never has experience managing and authorizing third parties that access various levels of resources based on the service's level agreement with the tenant. Therefore, preventing cross-ADs resource access is another challenge the MNO is required to manage. In particular, under the virtualized network environment, co-resident attacks may trigger unauthorized access to another virtual machine co-existing under the same bare-metal. Furthermore, the MNO also requires preventing another serious issue in all kinds of systems within the infrastructure, including insider threats. In order to prevent insider threats under such fast evolving and changing network environments, a proper management process and control process has to be applied on top of traditional approaches. For example, ISO/IEC 27001 has a series of control processes to ensure the information security management in securing the system. We often face an unknown threat when network automation is applied to a virtualized network infrastructure environment because there is a possibility that an attacker may be inappropriately manipulating network resources via auto-optimization and auto-reconfiguration. Therefore, we shall apply zero trust to prevent auto-manipulation of network resources. The identification of security threat challenges is typically an essential task for the MNO before network deployment. Usually, the MNO will establish security control policies appropriately, which is not just based on the local regulations' requirements and international benchmark approaches [13] but also the demand for adapting the best practice from the industry. Therefore, identifying the security control policies for deploying NSaaS requires considering the security policies under the flexible network and dynamic network runtime environments. It cannot simply apply black-box approaches that will eventually expose various unidentified attack vectors and vulnerable loopholes since the common practice of identifying the attack vectors or conducting the risk assessments requires an existing network environment. In particular, attack vectors will not be straightforward without an existing network infrastructure and services environment. Even though the flexible network infrastructure is unpredictable for managing the resources, we shall clearly state the security policies when applying network elasticity.