Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / Industrial 5G Security: Designing for Lost Connectivity

Transcript

Industrial 5G Security: Designing for Lost Connectivity · Cybersecurity Under Pressure. Real Attacks, Real Lessons

0:46
Good morning. Welcome to cybersecurity under
0:49
pressure, real attacks, real lessons.
0:52
Today's Friday, July 3rd, 2026 Shout out to our friends in the
0:56
United States. What happens when the technical
0:59
detail of ransomware in industrial control systems meets
1:02
the boardroom reality of operational uptime?
1:06
This story answers that. It really does.
1:09
It's a it's a perfect storm. Yeah, it is because we are here
1:12
to dive deep into the, well, the incredibly precarious
1:16
intersection of 5G technology, legacy industrial systems, and
1:22
you know, that relentless crushing pressure to maintain
1:25
operational uptime at literally all costs.
1:27
Right, because uptime is king. Exactly.
1:30
And you know, you hear about 5G, and if you were like most people
1:32
listening to this right now, you'd probably just think of
1:34
your. Smartphone.
1:34
Oh, for sure, you. Think about like faster movie
1:37
downloads at the airport or, you know, lower latency when you're
1:40
playing a mobile game or something.
1:41
Which is exactly the marketing narrative that telecom companies
1:45
have spent, you know, billions of dollars pushing to the
1:47
consumer market. Right, the commercials with the
1:49
fast cars and the glowing blue lines.
1:51
Yeah, exactly. It is a highly sanitized view of
1:53
what the technology actually is and what it's doing.
1:56
Right. But what we are really talking
1:58
about today is what happens when that wireless frontier collides
2:02
with multi $1,000,000 industrial operations.
2:05
Real heavy stuff. Yeah, we are talking about
2:08
factories, marine ports, massive automated warehouses.
2:12
We are looking at a fundamental re architecting of how the
2:15
physical world is controlled by digital systems.
2:17
And it is a collision that, quite frankly, most
2:20
organizations are entirely unprepared for.
2:23
Like completely blind to it. Really.
2:25
Even the massive 1. Especially the massive ones.
2:27
If you look at the transition from traditional heavily wired
2:31
operational technology environments, what we generally
2:34
call OT, to this brave new world of industrial 5G, it is framed
2:39
in the industry as this massive frictionless leap forward.
2:42
Right, just snip the wires and suddenly everything is better.
2:45
Yeah, exactly. And to be fair, in terms of
2:48
sheer capability it is amazing. But structurally it is a
2:51
fundamental re architecting of the attack surface.
2:54
Which is terrifying, but I mean, I completely see why a board of
2:58
directors would be seduced by it.
2:59
Though. Oh, absolutely.
3:00
If you are sitting in the boardroom, the pitch for 5G is
3:04
just absolutely intoxicating. You are hearing all about
3:07
incredible flexibility, less cabling, which means lower
3:10
physical maintenance costs. Right, right.
3:12
Because cables break. Exactly.
3:13
They break, they get run over by forklifts, they degrade over
3:16
time, and going wireless means faster deployment times.
3:20
You're being sold on this seamless real time support for
3:24
automated guided vehicles Hevs. Those are the.
3:27
Little robots moving parts around.
3:29
Yeah, just zooming around the factory floor, dynamically
3:31
avoiding obstacles. Mobile robots reorganizing
3:34
massive warehouses on the fly based on supply chain
3:37
algorithms. It looks like magic.
3:39
It does digital twins mapping out entire production cells in
3:42
real time. I mean, it sounds like the
3:45
operational utopia. Yeah, it is a brilliant pitch.
3:48
It looks absolutely spectacular on a PowerPoint slide in a
3:51
highly air conditioned boardroom.
3:52
But there is a butt coming. Yeah, there is a massive butt
3:55
coming. The dark reality, and this is
3:59
what keeps security architects awake at night staring at the
4:02
ceiling, is that by embracing all of that beautiful wireless
4:05
flexibility, you are taking massive operational risk and
4:09
shifting it directly into the radial layer.
4:12
OK, stop right there. Shifting it into the radial
4:15
layer. What does that actually mean in
4:17
plain English for the people out there running these facilities?
4:20
OK, so it means you are taking critical control loops, the
4:24
exact digital commands that tell a massive robotic arm to stop
4:29
moving before it crushes a human worker.
4:31
Kind of important. Highly important commands that
4:34
used to be safely hardwired into a closed physical copper or
4:38
fiber system, right? And you are literally
4:40
broadcasting them through the open air.
4:42
OK, let me try to put this into perspective for you, the
4:44
listener. Imagine you are sitting at home
4:46
streaming a movie on your WI. Fi Classic scenario.
4:49
Right. Someone turns on the microwave
4:51
or your neighbor's router interferes with yours and
4:53
suddenly the network gets congested.
4:55
The screen freezes, that little circle starts spinning, the
4:58
video buffers. Very annoying.
5:00
It is annoying. Sure, you might miss a crucial
5:03
line of dialogue, but imagine that exact same buffering
5:06
happening not to your TV, but to a massive multi ton mobile
5:11
production asset on a factory floor.
5:13
Close. But that analogy actually misses
5:15
the most dangerous part of the industrial equation.
5:19
How so? What am I missing?
5:20
Well, when your movie buffers, the streaming service just
5:23
pauses. The stakes are zero.
5:25
You wait 10 seconds, it comes back right?
5:27
But in motion control systems, physics doesn't pause right.
5:33
If a robotic arm carrying a two ton automotive chassis buffers
5:37
or an AGV loses its control signal for half a second, the
5:40
machine doesn't just politely freeze in mid air.
5:42
Because momentum is still the thing.
5:43
Exactly. The safety logic usually
5:45
dictates an emergency stop or worse.
5:47
If the signal fails entirely, the momentum just carries it
5:50
forward blindly. That is not an annoyance, that
5:52
is a catastrophic physical consequence.
5:55
So the tolerance for a glitch goes from, you know, mildly
5:58
frustrating to we just destroyed $1,000,000 of hardware and maybe
6:02
hurt someone. Exactly, and it highlights the
6:05
fundamental difference in how we perceive and detect network
6:09
anomalies. How do?
6:10
You mean? You see in a traditional wired
6:12
industrial cell, if you have latency spikes or packet
6:16
retransmissions, it is a very obvious anomaly.
6:19
A cable is either physically plugged in or it isn't.
6:22
It's binary, very binary. It is sending electrons down the
6:26
copper wire or it isn't. If the data stops, a red light
6:29
flashes on a Control Board, an alarm goes off and and the
6:32
maintenance tech knows exactly which cable to go look at.
6:35
They just follow the wire. Right, but in a wireless
6:38
environment, an attacker can mask their malicious activity
6:41
completely behind the veil of everyday radio instability.
6:44
Because wireless is inherently sort of kind of messy, right?
6:48
It's just invisible waves bouncing around a giant metal
6:51
room. It is incredibly messy.
6:53
Radio waves are subject to basic physical interference all day
6:56
long. You have multipath fading, where
6:58
a radio wave bounces off a steel I-beam, hits a concrete floor,
7:02
and arrives at the receiving antenna slightly out of phase
7:04
with the direct wave. Which effectively cancels out.
7:07
Exactly. It cancels it out.
7:08
You have shadowing from heavy machinery moving around.
7:12
You have handover issues as a mobile robot moves from the
7:16
coverage area OF15G cell tower to another.
7:20
So wait if I am a hacker trying to mess with this factory?
7:23
If you are an attacker and you start manipulating traffic,
7:26
dropping packets or injecting latency, the system operators
7:30
looking at the network dashboard might just think, oh a massive
7:34
forklift carrying sheet metal just drove past the main
7:37
antenna. Or like we're just having
7:39
congestion issues today. Yeah, the attacker hides in the
7:42
ambient everyday noise of the wireless environment.
7:45
Which is terrifying. You can't fight an enemy if you
7:47
just think it's bad weather on the factory floor.
7:49
No, you can't. You're fighting ghosts.
7:51
And I was reading through the sources about this specific
7:54
example of an automotive plant using a private 5G network, and
7:58
the realization here is that a short disruption does not even
8:02
need to cause physical damage to be an effective cyberattack.
8:05
Right, you don't actually need the robotic arm to crash into a
8:08
wall. Because physical destruction is
8:09
kind of amateur hour, right? Oh, physical destruction is
8:12
total amateur hour. The real economic damage is far
8:16
more subtle than blowing things up.
8:19
Right, because you just need to block the material flow for a
8:21
moment. Just a tiny interruption
8:23
triggers a manual workaround, the automated safety protocols
8:27
kick in, human workers have to step in to reset the system, and
8:30
suddenly bam, you have entirely stopped a production line.
8:34
And in just in time manufacturing, every second
8:37
counts. Yeah, if Station 4 stops,
8:39
Station 5 has no parts. 60 seconds later, the whole plant
8:43
grinds to a halt. Topping a modern automotive
8:46
production line can cost upwards of 10s of thousands of dollars
8:49
per minute. Per minute.
8:51
Per minute, a 5 minute localized network disruption could cost
8:54
half $1,000,000. This is why we have to
8:56
completely reframe our thinking. Yeah, if you are listening to
8:59
this and you work in leadership, hear this.
9:02
Cybersecurity in this context is no longer just an IT problem,
9:05
Not at all. It is not about keeping hackers
9:07
out of the HR database or protecting company emails.
9:10
It is the fundamental core of operational uptime.
9:14
If your radio layer is compromised, your factory does
9:16
not run. Period.
9:18
It's that simple. Which naturally leads me to
9:20
wonder, if the stakes are literally 10s of thousands of
9:23
dollars a minute, and the radio waves are this fundamentally
9:26
vulnerable to interference, what exactly are we exposing to the
9:31
open air? The $1,000,000 question.
9:34
Because it cannot just be the shiny new 5G robots.
9:37
We didn't throw away all the old machines, did we?
9:39
Oh man, I wish we had. I really wish it were just the
9:41
new natively secure robots. But it's not.
9:45
The reality is much, much grimmer.
9:47
We are connecting decades old legacy systems to these cutting
9:52
edge 5G networks. It is a massive architectural
9:55
paradox. How old are we talking?
9:56
Well, you have the most advanced high speed transport layer ever
10:00
created, carrying protocols that were designed when the Internet
10:02
was essentially a novelty for university researchers.
10:05
I have to admit I read 1 statistic in our research notes
10:08
that genuinely shocked me. Like I had to read it twice to
10:11
make sure it wasn't hallucinating.
10:12
The plain text staff. Yes, it said.
10:15
The 65% of legacy industrial control systems transmit their
10:19
data in plain text. Plain text.
10:22
No encryption whatsoever. You and I wouldn't even log into
10:25
a basic social media account on our phones without end to end
10:28
encryption. And yet 65% of the systems
10:31
controlling massive industrial infrastructure, power grids,
10:35
water treatment plants, assembly lines are just shouting their
10:39
operational secrets into the void.
10:40
It sounds completely absurd to a modern ear, it really does.
10:44
But you have to understand the historical context to see why
10:47
it's like this. OK, take you back.
10:49
You are looking at protocols like Modbus, TCPIP, Profinet and
10:54
Ether Cat. What are those, mechanically
10:56
speaking? They are essentially the
10:58
languages that industrial machines use to talk to each
11:01
other. Modbus, for example, was
11:03
invented in the late 1970s. The disco era of networking.
11:07
Exactly, and when these protocols were designed, they
11:10
were meant for completely isolated air gapped
11:12
environments. Meaning they were not connected
11:14
to the outside world in any way, shape or form.
11:16
Exactly. The foundational assumption
11:18
baked into the very code was that if you were on the network,
11:21
you are already authorized to be there.
11:23
Because getting on the network was physically difficult.
11:26
Exactly why would you need a password to get on the network?
11:29
You had to drive to the factory, swipe an ID bag, physically walk
11:33
past the security guard into a lock to secure control room, and
11:37
plug a serial cable directly into the machine.
11:39
So the physical security literally was the cyber
11:42
security. Precisely.
11:43
They never imagined A globally connected architecture, let
11:46
alone a wireless one. So the engineers who wrote these
11:49
protocols prioritized speed, determinism and reliability over
11:54
security. Because speed mattered more than
11:56
keeping out phantom hackers that didn't exist yet.
11:58
Right. There is no encryption.
12:00
There is no robust authentication.
12:02
It is literally sending raw hex codes over a wire.
12:04
Give me an example. OK, so a command says turn valve
12:08
4 to 90° and anyone listening on that network sees the exact
12:12
command in clear text. There is no secret handshake.
12:15
If the command arrives, the machine simply executes it.
12:18
It doesn't ask who sent it. But, and I know I'm playing
12:22
devil's advocate here, but I know this is what someone
12:24
listening might be screaming at their dashboard right now.
12:27
Why don't these companies just update the old machines?
12:30
Only it were that easy. But seriously, if you know the
12:33
Modbus protocol is fundamentally insecure from the 1970s, just
12:37
patch it or replace the hardware.
12:39
Why are we connecting a technological dinosaur to a 5G
12:42
spaceship? Because replacing the dinosaur
12:44
requires turning it off, and we are right back to the boardroom
12:48
reality. We started with the absolutely
12:51
prohibitive costs of downtime. It always comes down to the
12:54
money doesn't. It always upgrading an entire
12:56
legacy ICS infrastructure requires halting operations.
13:01
Let's look at major logistics hubs like marine ports.
13:03
OK, we are talking about automated straddle carriers,
13:06
massive ship to shore cranes for a major port.
13:09
Operational downtime can cost $1,000,000 an hour.
13:13
A million an hour. Wow.
13:15
So the board of directors looks at a proposal from their
13:17
security team for a three day, 72 hour shutdown to RIP and
13:21
replace legacy equipment. So that's a $72 million loss of
13:24
revenue right out of the gate? Right.
13:26
And that's not even counting the cascading supply chain
13:28
nightmares. Ships wading off the coast,
13:31
trucks backed up on the highway. They balk at that number.
13:33
It gets vetoed immediately. So what do they do instead?
13:36
Just cross their fingers and hope nobody notices.
13:39
They look for a shortcut. They buy a specialized piece of
13:42
hardware called a Protocol Conversion Gateway.
13:44
Which does what exactly? It's only job is to translate
13:47
that old unencrypted Modbus traffic into shiny new 5G IP
13:52
packets. So it's just a translator.
13:54
Basically it takes the dinosaurs language, wraps it in a modern
13:59
5G envelope and sends it over the the airwaves.
14:02
But the inside of the envelope is still just unprotected
14:04
Modbus. Exactly.
14:05
It works functionally. It keeps the factory running,
14:08
but the underlying vulnerability, the fact that the
14:10
core message has no authentication, remains entirely
14:13
intact. It is the ultimate technical
14:15
debt. You're just kicking the can down
14:17
a very expensive, very dangerous Rd.
14:19
Yeah, and the danger of that weak authentication isn't
14:22
theoretical. We saw exactly how this plays
14:24
out in the real world with the Mirai botnet.
14:27
Mirai Yes, a textbook painful example of how devastating
14:32
default legacy mindsets can be. It was a wake up call that a lot
14:35
of people slept right through. For those who aren't familiar,
14:37
maybe just remember it as that day the Internet basically
14:40
broke. The Mirai case study is wild.
14:42
It really is. You had hackers who didn't even
14:45
use sophisticated 0 day exploits.
14:48
They didn't write some crazy advanced malware, they simply
14:51
scanned the Internet for open telnet ports, and telnet is
14:54
another ancient unencrypted protocol.
14:56
Right. Yes, from the 1960s.
14:59
Even older than Modbus. So they scanned for these open
15:02
doors and then they just used a basic dictionary list of default
15:05
factory passwords, stuff like admin, admin root password
15:09
12345. The kind of stuff you'd see on a
15:11
luggage combination lock. Exactly because nobody ever
15:14
bothers to change the defaults on these constrained industrial
15:17
and IoT devices. The maintenance guys just plug
15:20
them in, verify they work and walk away to the next job.
15:23
They have a quota to meet. They aren't thinking about cyber
15:26
hygiene. So the hackers use those
15:28
defaults to hijack millions of security cameras, industrial
15:32
routers and sensors and build a massive botnet army capable of
15:35
taking down major Internet services through sheer brute
15:38
force. Oh man, and the lesson we
15:40
completely failed to learn from Mirai is that when you bring 5G
15:44
into the mix you are drastically expanding the attack surface for
15:48
those it's exact types of low effort exploits.
15:51
Right, because everything is wireless now.
15:53
Yeah, you are taking millions of new cheap sensors and putting
15:57
them directly on high speed networks.
15:59
But, and it actually gets worse, it gets even more complicated
16:02
when you look at how 5G itself is actually being rolled out by
16:05
the telecom operators. What do you mean?
16:06
Isn't 5G just 5G? Not at all.
16:08
We have to look at standalone 5G versus non standalone 5G.
16:12
Let me guess, non standalone is the cost saving crutch we are
16:15
currently leaning on right? You nailed it.
16:18
It is the architect actual compromise of the decade.
16:20
OK, lay it out for me. So a full standalone or essay
16:24
deployment uses a dedicated newly built 5G core.
16:28
It is built from the ground up with a modern 5G security
16:31
architecture. So that's the spaceship we
16:33
actually want to be flying. In yes, that's the goal, but the
16:36
transition to full stand alone is a multi year, highly
16:40
expensive process for telecom operators.
16:42
Because they have to build physical things.
16:44
They have to replace the entire backbone of their networks, the
16:47
hardware, the software, all of it.
16:49
So to get to market faster to be able to put that little 5G logo
16:53
on your phone screen and charge you more for it, most operators
16:57
use non stand alone or NSA mode. OK, breakdown how NSA works
17:02
mechanically because I think a lot of people assume their phone
17:04
is just on pure 5G. In NSA mode, the 5G radio
17:09
interface, the airwaves, the antennas are used for the
17:12
connection to the device so you get the fast download speeds.
17:15
Which is what people care about. Right.
17:17
But the actual brain of the network, the routing, the
17:21
authentication, the management, it is entirely reliant on the
17:25
old 4G evolved packet cork. Wait.
17:27
Oh wow, so you are selling me the 5G speed but you are routing
17:31
all my data through a 4G brain? Exactly, It's like building a
17:34
high speed bullet train but forcing it to run on tracks from
17:36
the 1800s. That sounds like a recipe for a
17:38
disaster. It is because this brings all of
17:41
4G inherited weaknesses, signaling storms, lack of strong
17:46
mutual authentication in certain layers right into the 5G era.
17:49
You get a massive false sense of security.
17:53
The marketing brochure says 5G, but the security reality is a
17:57
hybrid mess of older vulnerabilities.
17:59
It's like putting a state-of-the-art titanium vault
18:02
door on a cardboard box. That is a perfect way to
18:05
describe. It OK.
18:06
So if we take stock of where we are right now in this
18:09
conversation, we have logical network vulnerabilities because
18:13
we are wrapping unencrypted 1970s legacy protocols in 5G
18:18
envelopes. We have architectural weaknesses
18:21
because we are relying on non stand alone roll outs running on
18:24
4G brains. But I think we need to pivot
18:27
back to the physical reality of the factory floor, because if
18:31
the logical layer isn't scary enough, the physical layer, the
18:34
actual radio waves, is where it gets truly chaotic.
18:37
The physical layer is the ultimate shared medium.
18:40
It is the open air. Anyone can touch it.
18:42
And that means we have to talk about the enduring brute force
18:45
threat of radio jamming. Oh, jamming.
18:48
It's the oldest trick in the wireless.
18:49
Book you know, it is almost funny in a really dark, twisted
18:53
way. I know what you're going to say.
18:54
You can spend $10 million on Zero Trust architecture,
18:58
advanced software encryption and AI driven firewalls, and some
19:03
bad actor with a cheap modified software defined radio they
19:07
bought online for 300 bucks can just sit in a van in the
19:10
employee parking lot, flood the local spectrum with RF noise,
19:14
and effectively become a ghost in the machine.
19:17
It is the great equalizer of wireless networks.
19:20
A guy in a van can take down a smart factory.
19:24
How is it that simple? Because jamming is fundamentally
19:27
about the signal to noise ratio, a power modulated jammer doesn't
19:31
need to be sophisticated. It doesn't need to decrypt your
19:34
data, doesn't need to crack your passwords.
19:36
It's just dumb noise. It is incredibly dumb noise.
19:38
It just needs to yell louder than your devices.
19:41
It drowns them out, and the immediate manifestation of that
19:43
on the network dashboard is severe, inexplicable high packet
19:46
loss. Which, beyond just stopping the
19:49
data from moving, actually physically drains the energy of
19:52
these resource constrained Internet of Things devices,
19:55
right? That's the secondary effect,
19:57
yeah. Because from what I understand,
19:59
when a packet fails to send, the device just tries again.
20:02
Yes, the automatic retransmission protocols kick
20:04
in. It assumes there was a temporary
20:06
glitch. So they just keep trying to
20:08
resend the data. They're basically screaming over
20:11
a loud crowd at a rock concert until they completely lose their
20:14
voice and their battery dies. That is a very accurate way to
20:17
visualize it, and that dynamic creates what we call the the
20:20
weakest link amplification effect.
20:22
How does that amplify the attack though?
20:25
Well, the 5G core itself, the servers in the data center might
20:28
be highly secure and perfectly healthy, right?
20:32
But the ecosystem relies on these fundamentally insecure
20:35
battery powered endpoints, cheap temperature sensors, basic valve
20:40
actuators. Things with tiny batteries.
20:42
Exactly. When a jammer forces thousands
20:45
of these devices into a continuous loop of failed
20:47
retransmissions, they exhaust their batteries.
20:50
They flood the local cell tower with retry requests and it
20:53
destabilizes the entire local 5G ecosystem.
20:57
So the noise essentially forces the system to attack itself.
21:00
Yes. Now let's take that out of the
21:02
abstract and apply it to a physical use case.
21:04
Let's go back to the port terminal.
21:06
OK, back to the massive ships. Right, if a jamming attack
21:09
causes a sudden loss of connectivity to an automated
21:12
crane. Right.
21:13
A compromised crane control channel isn't just a technical
21:16
glitch on an IT dashboard, it is a life or death safety incident.
21:21
Very much so. Think about it, you have 40 tons
21:23
of steel container hanging 100 feet in the air moving at high
21:27
speeds. If the telemetry drops because
21:30
of a guy in a van with a jammer, the crane safety systems might
21:34
trigger an emergency stop. Which you'd think is a good
21:36
thing, but. But the sudden deceleration
21:38
causes the load to swing violently.
21:41
Or worse, the control signal drops right when it's supposed
21:44
to slow down to set the container down gently, and
21:47
instead it drops a shipping container directly onto a truck
21:50
cab. Exactly.
21:51
The consequences scale instantly from a digital nuisance to a
21:55
catastrophic physical event. The math stops being about data
21:59
loss and starts being about human lives.
22:01
OK, I refuse to accept that we're just sitting ducks here.
22:04
We aren't good. There has to be a solution.
22:06
Yeah. You can't just tell me the
22:07
physical layer is entirely defenseless against a guy with
22:10
an eBay jammer and a van. No, we aren't completely
22:12
defenseless, but combating physical interference requires
22:16
immense, highly responsive engineering.
22:18
Tell me some good news please. All right, this brings us to
22:21
some genuinely fascinating research out of Alberg, Denmark,
22:24
focusing on rural 5G networks and multi connectivity
22:28
strategies. OK, what do they do?
22:30
They introduced A dynamic algorithm known as Primary
22:33
Anchored Adaptive Failover, or PAAF.
22:37
PAAF primary anchored adaptive failover.
22:41
OK, let's unpack this. How exactly does a software
22:45
algorithm outsmart raw physical radio noise?
22:48
Because noise is physics. It comes down to establishing
22:51
ultra fast control loop mechanisms that constantly
22:54
monitor the health of the connection in real time.
22:56
The PAF system is constantly looking at specific physical
22:59
layer metrics. What kind of metrics?
23:01
Primarily it looks at reference signal received power RSRP.
23:05
Which is basically the equivalent of the little signal
23:07
bars on your cell phone, right? The baseline signal strength.
23:09
Essentially, yes. It looks at RSRP and it also
23:12
monitors uplink transmission power, which tells you how hard
23:15
the endpoint device is working to push a signal back to the
23:17
tower. They say OK, so if the guy in
23:19
the van turns on his jammer, the background noise floor rises.
23:23
The device suddenly realizes its whispers aren't being heard by
23:26
the power, so it has to scream louder, meaning the uplink
23:29
transmission power spikes. Correct, you've got it.
23:32
And when the PAAF algorithm detects that power spike, or a
23:35
sudden drop in RSRP, or an unacceptable spike in end to end
23:39
latency, meaning the packets are taking too long to arrive, it
23:42
triggers A defensive response. It adapts.
23:45
Now we have to contrast this with the traditional response to
23:48
understand why it's so cool. In standard ultra reliable low
23:52
latency communications URLC, the traditional way to ensure a
23:56
packet arrives through interference is full
23:58
duplication. Like sending two of every.
24:01
Exactly. You just send a copy of every
24:02
single packet over a secondary independent 5G link.
24:06
You brute force the reliability. If path A gets jammed, path B
24:10
gets through. But wait, sending literally
24:12
everything twice? That sounds incredibly
24:14
expensive. It is.
24:15
It double s your bandwidth overhead instantly if you're
24:17
paying for data or if you have thousands of robots on a factory
24:20
floor. That is totally inefficient.
24:23
It is horribly inefficient, which is why PAAF is such a
24:26
massive breakthrough. It uses partial duplication.
24:29
Meaning it only duplicates when it has to.
24:32
Yes, it only activates that secondary redundant link when
24:36
the primary link hits those specific degradation thresholds
24:39
we just talked about. It balances the critical need
24:42
for ultra reliability with the high overhead costs of full
24:46
duplication. That's smart.
24:48
Right. The moment the primary link
24:50
stabilizes, say, the jammer turns off, or maybe the robot
24:53
just moves behind a thick concrete wall that blocks the
24:55
jammer signal, the algorithm stops duplicating.
24:59
It is a dynamic event driven survival mechanism at the
25:02
physical layer. That is genuinely brilliant.
25:05
It's like having a backup generator that only kicks on the
25:07
millisecond the voltage drops, rather than running at 24/7 just
25:11
in case. That's exactly what it is.
25:12
Here's the thing, managing the physical layer is just table
25:15
stakes, isn't? It unfortunately yes.
25:17
Because while we are busy dodging jammers in the parking
25:19
lot and monitoring uplink power, attackers are also evolving
25:23
their digital strategies. If they can't beat the radio
25:26
waves, they're going to try to bypass the 5G architecture
25:29
itself. That is the grim reality of the
25:31
cybersecurity arms race. If we look beyond the physical
25:34
layer to the advanced architectural and future looking
25:37
threats, the complexity doesn't just increase, it scales
25:40
exponentially. OK, let's talk about network
25:43
slicing because I see this term thrown around in literally every
25:46
5G marketing pitch. Network slicing the silver
25:49
bullet. Right.
25:50
The idea, as I understand it, is that you can take one physical
25:54
network, one set of antennas and servers and slice it into
25:58
multiple virtual networks. That's the premise.
26:00
So you have one slice specifically tuned for the
26:02
factory robots, one slice for the guest Wi-Fi in the lobby,
26:06
one slice for the office IT computers.
26:09
It is presented to executives as this ultimate fail safe VIP lane
26:13
for critical data. Yeah, the pitch is if the guest
26:16
Wi-Fi gets hacked by someone in the lobby, the robots are
26:19
perfectly safe because they are in a completely different slice.
26:22
That is the theory, and it is a beautiful, very comforting
26:25
theory, but let me quickly dismantle that false comfort for
26:28
you. Please do.
26:29
The isolation between those slices isn't a physical copper
26:32
wire. It isn't a separate router in a
26:35
different room. It is entirely software defined.
26:37
OK, think of it like taking one large physical apartment
26:40
building and use using software to draw invisible walls,
26:44
creating separate apartments. One apartment is the factory
26:47
floor, another is the guest Wi-Fi.
26:49
OK, I'm with you, Invisible apartments.
26:50
But those invisible walls are managed by an SDN, a software
26:54
defined networking controller. The SDN controller is
26:57
essentially the master key system for the entire building.
27:01
It dictates who lives where and how thick the walls are.
27:04
Oh no, I see exactly where this is going.
27:06
If the SDN controller is compromised, or if an attacker
27:09
exploits a zero day vulnerability and the
27:12
virtualization hypervisor separating those slices, it
27:14
becomes a single point of failure.
27:16
The invisible walls just vanish. Yes, an attacker who gains a
27:19
foothold in a low priority, low security slice, say that guest
27:24
Wi-Fi you mentioned could potentially execute what it's
27:26
called a cross slice attack. So they don't attack the robots
27:29
directly. No, they pivot.
27:30
They pivot through the compromised SDN controller, grab
27:33
the master key, walk right through the invisible walls and
27:36
bring down the mission critical transport network from the
27:39
inside. Wow, the VIP lane is only a
27:41
secure as the software drawing the lines on the road.
27:44
So much for the VIP lane. That's terrifying.
27:47
And since we are talking about software vulnerabilities, we
27:49
have to talk about the absolute elephant in the room, the
27:53
weaponization of artificial intelligence.
27:56
Yes, we have to talk about AI. Because the attackers aren't
27:59
just using brute force password lists like Mirai anymore,
28:02
they're using AI to poison the well.
28:05
Yes, we are seeing a very concerning highly sophisticated
28:09
trend regarding data poisoning, specifically targeting
28:13
predictive maintenance models. Let's walk through how that
28:16
actually works, because I hear data poisoning and it sounds
28:19
like I don't know, a sci-fi spy movie.
28:21
It is actually terrifyingly mundane, which is what makes it
28:24
so effective. Ports and factories use massive
28:28
AI models to predict when a machine is going to fail.
28:31
So they don't have to guess. Right.
28:33
The AI monitors the vibration and temperature of, say, a
28:37
massive industrial motor. It learns the baseline, so it
28:40
knows when the motor is starting to degrade weeks before it
28:43
actually breaks. This saves millions in unplanned
28:46
downtime. Makes total sense.
28:48
It's smart. But what if an attacker gets
28:50
access to just the temperature sensor feeding data to that AI?
28:56
Just the sensor, not the motor. Right.
28:58
They don't break the motor, they don't shut it off.
29:00
They just slowly, subtly inject false data into the training
29:04
sets. Over the course of six months.
29:06
They alter the temperature reading, telling the AI the
29:08
motor is running 5° cooler than reality.
29:11
So the AI is constantly retraining on this new data.
29:14
It recalibrates its baseline. It thinks a failing overheating
29:18
motor is perfectly. Healthy.
29:19
Exactly. The AI will confidently tell the
29:21
plant manager on a beautiful digital dashboard that
29:24
everything is fine right up until the machine literally
29:26
tears itself apart from heat stress.
29:28
That is devious. And we are also seeing prompt
29:31
injection attacks against automated systems.
29:34
If an AI is parsing text, commands, or logistics, manifest
29:37
attackers are manipulating the hidden inputs to force the AI
29:41
into an unintended malicious action like rerouting A shipment
29:45
or opening a secure valve. But on the flip side, and tell
29:49
me if I am being too optimistic here, I saw a reference in our
29:52
notes to Autonomous SOC's security operation centers run
29:56
by AI. Are we really letting AI fight
29:59
AI on these networks? We have to.
30:01
We have absolutely no choice. It is the only way to match the
30:03
speed of the attacks. Because humans are too slow.
30:05
Way too slow. These autonomous SOC's use AI to
30:08
monitor the network behavior, and if they detect an anomaly
30:11
like a device that early trying to access an SDN controller, it
30:14
shouldn't. The AI can execute an automated
30:16
playbook and logically isolate that compromise node in
30:20
milliseconds. In milliseconds.
30:21
Yes, a human analyst couldn't even click their mouse that
30:24
fast. It is literal machine versus
30:26
machine warfare happening invisibly on the network all day
30:29
long. That is wild.
30:31
It really is science fiction happening right now.
30:34
But while the AI battle is raging, there is a much larger,
30:38
frankly, existential threat looming on the horizon.
30:41
Do we need to address CRQCS? Cryptographically relevant
30:45
quantum computers I. Have to be honest, every time I
30:47
read about quantum computing it sounds like pure sci-fi but the
30:51
security community treats it like a very real ticking clock.
30:54
Why? Because it is the Y2K of
30:57
cryptography, but with actual teeth.
30:59
OK, how does a quantum computer actually break our security?
31:02
Break it down for me. Current encryption, the math
31:04
that secures your bank account, your emails, and the 5G network
31:08
relies on the fact that it is very easy for a normal computer
31:12
to multiply apply 2 massive prime numbers together, but
31:15
practically impossible to do the reverse.
31:17
Okay, it would take a classical supercomputer thousands of years
31:21
to factor that massive number back into its original primes to
31:24
find the key. Right, the math is just too hard
31:26
for the processors we have today.
31:28
Exactly. But a sufficiently powerful
31:31
quantum computer using something called Shores algorithm doesn't
31:35
try every combination 1 by 1. It processes the probabilities
31:40
simultaneously using quantum states.
31:42
Meaning it's insanely fast. It can factor those massive
31:45
prime numbers in hours or even minutes.
31:49
When that threshold is crossed, the mathematical algorithms that
31:52
currently secure our public key infrastructure, our PKI, will be
31:57
broken. And the PKI is what
31:58
authenticates every device, encrypts every tunnel, and
32:02
secures every wireless key exchange.
32:03
Yes, meaning all that encrypted data traversing the 5G network
32:07
is suddenly an open book. Every secret command, every
32:10
industrial blueprint expose. This means we can't wait for the
32:13
quantum computers to actually be built to fix this.
32:15
We have to act now. We absolutely cannot wait.
32:18
This is why there is an urgent industry wide need for crypto
32:21
agility. Organizations must architect
32:23
their systems now so that when NIST, the National Institute of
32:26
Standards and Technology, finalizes post quantum
32:28
cryptographic standards, companies can hot swap their
32:31
encryption algorithms without tearing down their entire
32:34
physical infrastructure. Because if you wait.
32:36
If they wait until the encryption is broken to start
32:38
upgrading, it will be vastly too late.
32:41
Attackers are already executing Harvest now decrypt later
32:45
attacks. Wait, what is that?
32:47
They are scraping encrypted data off networks today, just storing
32:51
it on a hard drives, waiting until they have the quantum
32:53
computer to read it in five or ten years.
32:55
OK, my anxiety is officially peaking.
32:58
Yeah, it's a lot. Yeah, so let's ground this back
33:00
in a physical use case, because while quantum math is
33:03
terrifying, we are also seeing emerging risks in the physical
33:07
world, specifically tied to green energy initiatives.
33:11
The notes highlight onshore power supply systems, or OPS.
33:15
This is a fascinating and terrifying intersection of
33:17
sustainability and cybersecurity.
33:20
Let's look at the maritime shipping industry.
33:22
Historically, when a massive container ship docked at a port
33:25
to unload, it had to keep its massive diesel engines running
33:29
just to power the ship's internal systems.
33:31
The lights, the refrigeration for food, The computers.
33:34
Which creates a massive cloud of diesel emissions hovering over
33:37
the port and city. I know a lot of coastal cities
33:40
have been fighting to stop that. Exactly.
33:42
The pollution is terrible, so the green solution is OPI
33:45
onshore power supply, also known as cold ironing.
33:48
It allows these massive 24,000 TEU container ships.
33:53
Wait, TEU? I've seen that acronym, but what
33:55
does it mean? 20 foot equivalent unit.
33:58
It's how we measure cargo capacity.
34:00
Imagine 24,000 standard shipping containers stacked on one
34:04
vessel. It is essentially A skyscraper
34:07
laid on its side. Got it.
34:09
So this massive floating skyscraper pulls into port.
34:12
It turns off its dirty diesel engines and it plugs a massive
34:16
high voltage cable directly into the ports electrical grid.
34:19
Which is great for the environment, Girlyus, but from a
34:22
cybersecurity perspective, you are taking a floating city with
34:25
all of its own complex, likely poorly maintained IT and OT
34:29
networks and plugging it directly into the critical
34:31
infrastructure of a major city's smart grid.
34:34
You are creating a physical and logical conduit between the
34:36
ship's systems and the grid. Oh man, if a ship has been
34:39
sailing around the world for six months and picked up a malware
34:41
infection in another port. Or if the ports grid is already
34:44
compromised by a nation state actor.
34:47
The infection can travel across that connection.
34:49
Exactly. It travels across that high
34:51
voltage power connection if the data management links governing
34:54
the power transfer aren't perfectly segmented.
34:57
So we are essentially treating massive container ships like
35:01
dirty USB drives and plugging them into our city's power grid.
35:04
Yes, that is exactly what we are doing.
35:07
A cyber attack on an OPS system could manipulate billing data,
35:11
cause massive power surges that fry the ship's electronics, or,
35:15
conversely, trigger widespread blackouts across the entire port
35:19
city. OK, let's take a breath and look
35:21
at the whole board here. It's a big board.
35:23
It is. We have legacy plaintext
35:25
protocols from the 70s, five G radio jammers from eBay, cross
35:29
slice software attacks in the invisible apartments, AI data
35:32
poisoning the temperature sensors, quantum computing
35:35
threatening to break all our math, and container ships acting
35:38
as massive USB drives infecting the power grid.
35:41
It sounds like a bad movie plot when you list it all out.
35:43
It does. If you are a chief information
35:45
and security officer listening to this.
35:48
How can any human team possibly manage this overwhelming matrix
35:51
of risks? It requires a complete evolution
35:54
in how we assess and respond to threats.
35:57
We have to bring this back to the human element and the
35:59
reality of the boardroom. The old way of doing things,
36:03
basic threat modeling, is dead. What do you mean by basic threat
36:07
modeling? Historically, security teams
36:10
would look at an isolated component.
36:12
They would look at a single database or a single robot on
36:15
the floor and say how could someone hack this specific
36:18
thing? Right.
36:19
And then they put a wall around. It exactly because no component
36:21
is isolated anymore right? In a hyper connected 5G factory,
36:25
everything touches everything. We must shift to comprehensive
36:29
threat analysis and risk assessment.
36:31
Tarot utilizing attack graphs. Attack graphs visualizing the
36:36
path like drying it out? Yes.
36:38
An attack graph maps out the entire chain of vulnerabilities.
36:41
It helps the board visualize how an attacker doesn't just hack
36:44
one thing in a vacuum. They chain privileges.
36:47
They step from stone to stone across the network.
36:49
OK, walk me through what privilege chaining actually
36:52
looks like in a physical factory setting.
36:54
OK, imagine an attacker finds a weak point in the 5G network,
36:58
maybe a misconfigured router. They use that initial foothold
37:02
to compromise a navigation electronic control unit, an ECU
37:07
on a mobile automated robot. OK, stop there.
37:10
What is an ECU? An electronic control unit.
37:12
Think of it like a localized lobe in a brain.
37:15
OK, you have one lobe for vision, one for balance.
37:18
In a robot, you have an ECU just for navigation, figuring out
37:22
where it is in the room using lasers.
37:24
You have another ECU for the actual physical drive motors.
37:28
OK, so the attacker hacks the navigation lobe, but the
37:30
navigation ECU doesn't control the physical wheels.
37:33
Right, correct. So the impact seems low, it just
37:35
messes up the map. But the attacker doesn't stop
37:38
there. They use the navigation ECU as a
37:40
beachhead to move laterally to a gateway ECU.
37:43
From the gateway ECU they finally bridge over to the
37:46
controller area network bus, the CAN bus.
37:48
And the CAN bus is. The CAN bus is the spinal cord.
37:51
It is the central nervous system that connects all the localized
37:53
brains together. So they just step from the guest
37:55
room to the hallway and then kick down the door to the
37:58
central nervous system. Yes, and once they are on the
38:01
canvas, they can send fake nerve impulses to any part of the
38:05
machine and the impact diverges based entirely on their goal.
38:09
What are their options? Well, if they manipulate the
38:12
robots production speed, say forcing the motors to run just
38:15
10% slower, they cause localized economic damage.
38:19
The factory produces fewer cars that day.
38:22
It is a slow bleed that might easily evade detection.
38:25
Right. People just think the machine is
38:26
sluggish. But if they attack the safety
38:28
mechanisms, if they disable the proximity sensors that tell the
38:31
robot a human is standing in front of it, they cause physical
38:34
injuries or death. The attack graph helps the board
38:37
understand not just the technical vulnerability of that
38:39
first router, but the cascading business and safety impacts at
38:43
the very end of the chain. That makes the stakes so
38:45
incredibly clear, and yet the most frustrating part is that
38:49
all of the sophisticated modeling, all these attack
38:52
graphs can be completely undone by simple human error.
38:56
I was looking at the management of change discipline in our
38:58
sources. You can spend millions of
39:01
dollars on zero trust architecture, micro
39:04
segmentation, and advanced AI threat detection, and then Bob
39:09
for maintenance decides he needs a better Wi-Fi signal to
39:12
download a diagnostic manual for a broken machine.
39:15
Oh, Bob. We've all met Bob.
39:17
So he buys a rogue 5G router in an electronic store and plugs it
39:21
directly into a secure control panel on the factory floor so
39:24
his cabinet gets better reception.
39:26
Or a vendor comes into service machine right and they ask for a
39:30
temporary diagnostic link for one afternoon and the IT team
39:33
provisions it and nobody ever remembers to unplug it or revoke
39:36
the access. They just bypassed millions of
39:38
dollars of security architecture because it was convenient for a
39:41
Tuesday afternoon. Which is exactly why Zero trust
39:43
architectures are mandatory, not optional.
39:45
The core philosophy of Zero Trust is that you cannot trust a
39:49
device just because it is physically inside your factory
39:52
walls or plugged into your local switch.
39:53
You can't trust Bob's router. No, location is no longer a
39:57
proxy for trust. You have to continuously
39:59
authenticate an. Authorize every single
40:02
interaction, every single packet.
40:04
And in the specific context of 5G, this also means leveraging
40:07
inherent network features like subscription permanent
40:10
identifier encryption, supi encryption.
40:13
OK, let's breakdown supi, because in 4G devices broadcast
40:18
their identity, their MSI number in plaintext, right?
40:20
Yes, every time your phone connects to a 4G tower, it
40:23
essentially yells its Social Security number into the air to
40:27
identify itself. Which allows an attacker with an
40:29
MSI catcher light a Stingray device to physically track the
40:34
movement of specific devices or even specific personnel across a
40:38
city or a factory floor. Precisely.
40:40
SPPI encryption in 5G fixes this by concealing that permanent
40:44
identity using public key cryptography before it ever hits
40:47
the airwaves, preventing those physical tracking attacks.
40:50
So that's a built in win for 5G. It is, but only if the telecom
40:53
operator and the enterprise actually configure the network
40:56
to enforce it. The feature exists, but you have
40:58
to actively turn it on. But I know where you are going
41:00
next. You do.
41:01
You are going to raise the ultimate pushback here, aren't
41:04
you? I am because the board of
41:06
directors are going to listen to everything you just said.
41:08
They hear zero trust, continuous authentication, heavy
41:11
cryptography, post quantum algorithms and then they are
41:15
going to look at their production metrics.
41:17
The trade off between performance and security is
41:20
brutal. Every time you encrypt a packet,
41:22
every time you mathematically authenticate a node, you are
41:25
adding latency. I validate that completely.
41:28
It is the core tension of industrial 5G.
41:31
It is the unsolvable equation at the heart of the industry right
41:34
now. Because math takes time.
41:36
Cryptographic operations, especially integrity protection
41:39
on the user plane ensuring the data hasn't been tampered with,
41:43
introduce severe latency. The mathematical hashing
41:46
operations literally take time for the processors to compute in
41:51
an ultra reliable low latency environment where automated
41:54
operations are measured in single digit milliseconds.
41:57
Adding a delay is a big deal. Adding a 5 millisecond delay for
42:00
encryption overhead can throw a high speed motion control system
42:03
completely out of sync. So you are forcing companies to
42:06
make an agonizing impossible choice.
42:09
You either run your factory at real time operational speed and
42:13
leave the data exposed to manipulation, or you lock the
42:16
data down with heavy encryption and accept that your robots have
42:20
to move slower, costing you money every single second of the
42:23
day. That is the exact dilemma, and
42:25
until lightweight cryptographic algorithms can catch up to the
42:29
extreme latency requirements of industrial automation, which we
42:32
are researching but we aren't there yet, it is a risk
42:35
acceptance conversation that every single board must have.
42:39
You have to draw the line. They have to decide exactly
42:41
where the line is between an acceptable operational delay and
42:44
an unacceptable security vulnerability.
42:46
And that leads to a deeply uncomfortable hypothetical
42:49
scenario that I want you, the person listening to this right
42:52
now, whether you are a plant manager and IT director or just
42:56
someone fascinated by this collision of worlds, to really
42:58
think about. Imagine a boardroom that faces
43:01
this exact dilemma. They run the math, they look at
43:05
the margins, and they decide that the cryptographic latency
43:07
is just too costly. They choose operational speed
43:10
over security, deliberately leaving a critical control loop
43:13
unencrypted to save a few milliseconds.
43:16
A month later, an attacker exploits that exact
43:18
vulnerability. They manipulate a safety sensor
43:21
on the sand bus, resulting in a massive physical catastrophe on
43:24
the factory floor. Who is liable legally, morally,
43:27
financially, when you deliberately choose speed over
43:30
safety, every millisecond of latency you saved was just a
43:33
door you intentionally left unlocked.
43:36
That's all for this episode of cybersecurity under pressure.
43:39
Real attacks, real lessons. See you in the next chapter.