DHS probes current and future mobile threats
- By Mark Rockwell
- Apr 26, 2019
The research arm of DHS is looking to develop cybersecurity tools for of existing and emerging wireless protocols to its arsenal of network protection capabilities for federal agencies.
The Science and Technology Directorate issued a call against an ongoing five-year cybersecurity research effort for ideas on securing mobile infrastructure. The Secure and Resilient Mobile Network Infrastructure solicitation was posted on April 22.
DHS is looking for solutions to potential security gaps in air interfaces between mobile devices and the radio access network, between cell towers and base stations, virtualized segments of the radio network and core network that supports it. The announcement also mentions the side-channel network telecommunications use to send network information called Signaling System 7 (SS7).
SS7 is used by 2G, 3G and wireline telecommunications networks to carry information that back services such as call forwarding, telephone number portability, as well as calling party number display and three-way calling. The danger for SS7, it said, is that it does not have authentication between networks for traffic traversing multiple individual carriers. The vulnerability has been exploited by hackers to track and intercept calls and texts, deny service to users and commit financial fraud.
DHS will convene an industry day on May 16 in Washington D.C. to discuss next steps.
Mobile security is top of mind for the Cybersecurity and Infrastructure Security Agency at DHS.
"We're looking to get to understand the nature of the risks," Christopher Krebs, CISA director told reporters at an April 23 AFCEA conference in Washington. The agency is looking for direct engagement with industry on the topic said Krebs. The results of the research, he said, "could potentially develop into arrows in the quiver" of DHS' cybersecurity arsenal for federal networks.
The Secure and Resilient Mobile Network Infrastructure solicitation is also looking to address gaps in encryption in existing 4G networks, in which user traffic is not "necessarily" encrypted as it moves through wireline backhaul networks. "This potential lack of encryption leaves user data at risk of eavesdropping and user systems susceptible to man-in-the-middle attacks," the notice states.
The program is also looking to improve visibility into government mobile devices that are outside federal firewalls and Trusted Internet Connection networks and to help guarantee that emerging 5G network security architecture takes government needs into account. One specific threat cited is the proliferation of internet of things devices operating on unprotected small cells in urban areas.
Multiple awards are expected across various aspects of the solicitation maxing out at $2.75 million according to contracting documents.
Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.
Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.
Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.
Click here for previous articles by Rockwell.
Contact him at [email protected] or follow him on Twitter at @MRockwell4.