O-RAN WG11 Security Specification

Implement cryptography + protocol security + PKI per O-RAN WG11 Security Requirements covering TLS + SSH + IPsec + certificate lifecycle. TLS implementation must (a) use TLS 1.2 minimum + TLS 1.3 preferred + with WG11-approved cipher suites + Perfect Forward Secrecy + certificate verification, (b) enforce minimum key sizes per WG11 cryptographic profile (RSA 2048 minimum + ECDSA P-256 minimum + ECDHE for key exchange), (c) implement OCSP stapling + or CRL checking with documented fallback, (d) protect TLS termination points against attack including downgrade + cipher manipulation + protocol negotiation abuse. SSH implementation must (a) use SSHv2 with WG11-approved cipher suites + KEX algorithms + MAC algorithms, (b) enforce strong authentication (certificate-based + or strong key-based + with multi-factor where applicable to administrative access), (c) restrict SSH access via network se

• TLS / SSH / IPsec configuration evidence with WG11-approved cipher suites + key sizes
• certificate lifecycle management with automated enrollment + renewal + monitoring
• PKI design + CA selection + CPS + HSM evidence where applicable

• TLS deployed with weak cipher suites or without certificate verification
• certificate expiry monitoring absent producing outages
• PKI design ad-hoc without CPS

Operate logging + monitoring + incident response + DoS resilience per O-RAN WG11 Security Log Management Specifications and incident response specifications. Logging must (a) collect security-relevant events from all O-RAN components + interfaces + management functions including authentication events + authorisation decisions + configuration changes + cryptographic operations + administrative actions + xApp / rApp lifecycle events, (b) include required event content per WG11 (timestamp + source + event type + principal + outcome + correlation identifier), (c) protect log integrity + confidentiality + availability via WG11-approved transport + storage + access control, (d) retain logs per operator policy + national regulatory requirements (which vary materially by jurisdiction). Monitoring must (a) implement security monitoring across O-RAN architecture with correlation across components

• security log collection per WG11 Log Management Specifications + retention per regulation
• O-RAN-aware SOC + correlation rules + behavioural baselines + alerting
• O-RAN-aware IR plan with O-RAN scenarios + vendor coordination + forensic readiness
• DoS resilience testing + degraded-mode operating procedures

• IT SIEM rules applied to O-RAN producing miss + over-alert
• IR plan IT-generic without O-RAN scenarios
• no DoS resilience testing

Secure the O-Cloud platform + containers + secure configuration + patching per O-RAN WG11 Security Requirements + O-Cloud security profile. O-Cloud security must (a) implement secure cloud platform per CNCF + Kubernetes hardening + supply chain controls + image scanning + runtime detection, (b) protect O-Cloud management plane (O2 interface) + workload orchestration + tenant isolation, (c) enforce platform integrity via measured boot + attestation + verified images where supported, (d) operate platform monitoring + drift detection + automatic remediation. Container security must (a) use minimal base images + scan images for vulnerabilities + sign images + verify signatures at deployment, (b) enforce pod security standards + network policies + service mesh authentication + secrets management, (c) operate runtime security (Falco + similar) + monitor for container escape + privilege escalat

• O-Cloud platform hardening evidence + management plane protection + attestation
• container security configuration + image signing + runtime monitoring
• configuration baselines per component + continuous compliance scanning + drift remediation
• patch management with vulnerability advisory consumption + test lab + risk-based prioritisation

• O-Cloud management plane not adequately protected
• container images not signed or signature not verified at deployment
• patching schedule not aligned to telecom service continuity

Secure O-RAN open interfaces per O-RAN Alliance WG11 Security Requirements Specifications covering E2 (Near-RT RIC to E2 Node) + A1 (Non-RT RIC to Near-RT RIC) + O1 (SMO to managed function) + O2 (SMO to O-Cloud) + Open Fronthaul (O-DU to O-RU). Interface security requirements per WG11 must address (a) authentication of all interface peers with mutual TLS (mTLS) + certificate-based + or equivalent strong authentication, (b) confidentiality via TLS 1.2/1.3 + IPsec + or equivalent for management and control traffic + with cryptographic suites per O-RAN WG11 cryptographic requirements, (c) integrity protection of interface messages and parameters, (d) replay protection via nonce + sequence numbers + or equivalent, (e) authorisation enforcement appropriate to interface (role-based access + scope tokens + OAuth2 for application-layer interfaces + 3GPP-style network function authorisation wher

• interface security implementation per E2 + A1 + O1 + O2 + Open Fronthaul with mTLS / IPsec + certificate management
• Open Fronthaul M-Plane authentication + C/U-Plane confidentiality decision record
• interface security verification testing evidence + multi-vendor interoperability + security testing
• PTP / Sync-E / GPS-GNSS protection where applicable

• Open Fronthaul U-Plane encryption not deployed without documented risk basis
• interface authentication uses pre-shared keys vulnerable to extraction
• multi-vendor interfaces not security-tested

Secure the RAN Intelligent Controller (RIC) + xApp / rApp lifecycle + AI/ML components per O-RAN WG11 Security Requirements. RIC architecture security must (a) protect Near-RT RIC (E2 control loops + xApp hosting) and Non-RT RIC (rApp hosting + policy management) with isolation between RIC functions + tenant separation in multi-vendor deployments, (b) authenticate and authorise all RIC API access + xApp/rApp management API access + with audit logging. xApp / rApp lifecycle security must (a) onboard xApps and rApps via vetted source + signed packaging + image scanning + vulnerability assessment, (b) sandbox xApps and rApps using container security best practices + namespace isolation + resource limits + capability restrictions, (c) enforce least privilege for xApp / rApp access to RIC functions + E2 / A1 interfaces + RAN state, (d) operate runtime monitoring for xApp / rApp behaviour + an

• RIC architecture security evidence with isolation + API authentication + audit
• xApp / rApp onboarding + sandboxing + runtime monitoring + lifecycle evidence
• AI/ML model provenance + signing + drift / adversarial detection evidence
• alignment with NIST AI RMF + EU AI Act for high-risk telecom decisions

• xApps onboarded without vetting + signing + image scanning
• ML models deployed without provenance verification
• no runtime monitoring for xApp behaviour anomalies

Operate security test + certification + conformance per O-RAN WG11 Security Test Specifications and WG11 Test Specifications including Open Test and Integration Center (OTIC) testing. Security test specifications must cover (a) interface security test cases per E2 + A1 + O1 + O2 + Open Fronthaul testing the authentication + confidentiality + integrity + authorisation + replay protection + cryptographic conformance, (b) component security test cases per O-DU + O-CU + O-RU + Near-RT RIC + Non-RT RIC + SMO + O-Cloud with positive and negative test scenarios, (c) negative test cases probing for known attack vectors + fuzzing + protocol abuse + boundary conditions, (d) penetration testing of integrated multi-vendor deployments. Certification must (a) align with O-RAN OTIC certification program + with vendor self-attestation + third-party assessment as deployment risk profile warrants, (b) ali

• security test plan and execution per WG11 Security Test Specifications + OTIC test cases
• certification evidence (OTIC + SECAM/SCAS + national telecom security certification)
• conformance traceability per WG11 requirement with regression testing + audit availability

• security testing limited to positive cases without negative or fuzz testing
• certification claimed but conformance evidence incomplete
• regression testing absent on releases producing latent security regressions

Operate supply chain security + secure development lifecycle (SDL) + privacy + multi-vendor trust per O-RAN WG11 Security Requirements + Open Fronthaul vendor profile + national telecom security regimes. Supply chain security must (a) qualify O-RAN vendors and suppliers per NIST SP 800-161 SCRM tailored to telecom (vendor cybersecurity maturity + product security incident response + secure development + provenance + SBOM availability + sub-component visibility + national security review where applicable), (b) embed cybersecurity requirements in procurement (RFPs + contracts + acceptance testing + warranty), (c) verify trusted source + tamper-evident packaging + integrity verification of received components + firmware + software, (d) align with national telecom supply chain security regulations (UK TSR + US CISA + EU 5G Toolbox + Japan + Australia + similar). Secure development lifecycle

• vendor qualification per NIST SP 800-161 telecom-tailored + national telecom supply chain regulation alignment
• vendor SDL attestation + third-party assessment + PSIRT integration
• privacy by design evidence + cross-border data flow + subscriber data minimisation
• multi-vendor trust framework + integration testing + co-ordinated vulnerability response

• vendor selection on cost without supply chain security review
• vendor SDL claimed but not verified or integrated with operator programme
• multi-vendor trust framework absent producing co-ordination failure during incident

Maintain the O-RAN threat model and risk management per O-RAN Alliance WG11 Security Threat Model and Risk Assessment specifications. The threat model must (a) enumerate threat actors targeting O-RAN deployments (nation-state attackers + criminal organisations targeting telecom + insiders with operator or vendor access + compromised vendors + supply-chain attackers), (b) catalogue attack surfaces specific to O-RAN architecture (RAN Intelligent Controller (RIC) + xApps/rApps + open interfaces (E2 + A1 + O1 + O2 + Open Fronthaul) + O-Cloud platform + multi-vendor integration boundaries + AI/ML decision points + SMO + management plane), (c) maintain attack scenarios covering rogue xApp / rApp + interface protocol abuse + supply chain compromise + RIC compromise enabling RAN policy manipulation + management interface compromise + Open Fronthaul tap or man-in-the-middle, (d) integrate threat

• O-RAN threat model per deployment covering threat actors + attack surfaces + scenarios
• risk register aligned to WG11 methodology + NIST 800-30 + ISO 27005
• security architecture document with reference architecture + trust zones + secure interconnects
• annual refresh evidence

• threat model generic IT not O-RAN specific
• no integration with telecom-sector threat intelligence
• security architecture not updated after major deployment changes