# Towards Incidence Management in 5G Based on Situal Awareness
## 1 Introduction  
The rapid proliferation of the use of mobile devices has revealed the lack of ability of the current networks to accommodate the vast amount of information that they will have to manage [1; 2; 3]. This situation has given rise to the development of a brand new generation of mobile networks not only to provide solutions to such problems, but also to improve many features of their predecessors. Enhanced capabilities, related to transfer massive data, interoperability or reduction in energy consumption, allow a better Quality of Experience (QoE) to the users [4]. Achieving these goals requires great capacity for innovation, such as high speed data transfers or better information management methods [5]. The last part has significant impact on business models based on services and real-time applications (e-health, e-security, Voice over IP, streaming, etc. ), where emerging technologies, such as Software-Defined Networking (SDN) or Network Function Virtualization (NFV), facilitate pattern customization and management of the mobile network traffic. However, the development of these services is limited by the poor performance in the management and decision-making strategies [6], which additionally entails difficulty when deploying information security measures, the principal objective of this research. Nowadays, information security management plays a major role towards achieving the objectives and goals of companies and organizations. Traditionally, it has been carried out by implementing guidelines, standards and platforms that aim to protect their resources and assets (ISO/IEC 27000 [7], NIST-SP 800 [8], CVSS-SIG-First [9], MAGERIT [10], ITIL and COBIT [11], etc. )However, these proposals have shown shortcomings when they are implemented in dynamic scenarios, where the context plays a very important role in decision-making [12]. This is the case of network-based monitoring environments, and more specifically, those that implement 5G technology, where the assets and events are considered highly dependent on the environment. As a solution to this problem, some authors have adopted incident management methodologies capable of handling information in a much more cognitive way, and, therefore, facilitating their understanding through contextual analysis. Worthy of special mention are those based on constructing Situational Awareness (SA) of the protected environment by applying the [PERSON]'s model, where the perception, comprehension and projection of the system status are kept in mind [13]. The adaptation of this paradigm to the management of information security in networks has led to the coining of the term Network Security Situational Awareness (NSSA) [14]. Despite, however, its effectiveness having been proven in existing networks, it has not yet been considered to meet the challenges posed by 5G technologies. To the best of our knowledge, there are few studies that survey Security and Risk Management in 5G Networks. In [15], a context aware framework for the next generation of Mobile Cloud Network (MCN) is proposed. This work introduces a \"Context Generation and Handling Function\" to provide enriched processing information from radio and core elements, taking into account two key-enabled 5G technologies (SDN and NFV concepts). Meanwhile, a recently published threat report has been conducted by the European Union Agency for Network and Information Security (ENISA) [16]. This work reviews the potential security in SDN/5G networks, considering not only SDN but also NFV and Radio fields. This report identifies the network assets and the security threats, their related challenges and risks. It also describes the existing security methods and provides good practices for 5G systems. These works could be considered part of the initial research of 5G Security Management. However, these are limited in scope. On one hand, the ENISA Report [16] identifies only the assets and threats to SDN/5G environments (no architecture proposal has been done). On the other hand, [PERSON] et al.