Hello,

ETSI
A CONVERSATION WITH CA ON JUNE, 14TH 2018
The past and the future
Some citations from the ENISA study:
PAST (2G/3G/4G) Future (5G)
“Wild West” running on legacy
• Propiertary protocols • Protocol stack
infrastructure

• Original design: inter telco JSON/HTTP/TCP/IP

Consider revising the current legal
communication with trusted • Usage of common open
landscape

partners only technologies

[in 5G] (JOSE, OAuth,
grace period between
• Security flaws everywhere Swagger)
vulnerability discovery and real
exploitation will become much shorter
• Usage
compared ofand
to SS7 mature
Diametertools (like
APIM) instead of special
development

© 2018 CA. Confidential. All rights reserved. 2

 http://dilbert.com/strip/2018-05-09

© 2018 CA. Confidential. All rights reserved. 3

5G Roaming

GRX/IPX

Telecom Service Telecom

SEPP API API SEPP
Provider 1 Hub(s) Provider 2

SEPP: Security Edge Protection Proxy => API Gateway

GRX: GPRS Roaming Exchange
IPX: IP Exchange
© 2018 CA. Confidential. All rights reserved. 4
SEPP = API Gateway
• Authentication
• En-/Decryption
• Signatures
• Transport and payload checks
• Transformations
• Mediations
• Caching
• Security, security, security

© 2018 CA. Confidential. All rights reserved. 5

OWASP Top 10
• A1: Injection
• A2: Broken Authentication
• A3: Sensitive Data Exposure
• A4: XML External Entities (XXE)
• A5: Broken Access Control
• A6: Security Misconfiguration
• A7: Cross-Site Scripting
• A8: Insecure Deserialization
• A9: Using components with known vulnerablilites
• A10: Insufficent Logging&Monitoring
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

© 2018 CA. Confidential. All rights reserved. 6

More than 10 years experience
• Problem already solved
• Across all industries
• Across all enterprise sizes
• Across all load levels
• Across all platforms

• Wide usage in telco space outside of 2G-4G

© 2018 CA. Confidential. All rights reserved. 7

API Management – more than SEPP

Internet

Partner
Telecom App
Gateway API
Provider Consumer
Customer
Portal

Developer

© 2018 CA. Confidential. All rights reserved. 8

Sven Walther
Consultant Presales API Management
sven.walther@ca.com
@svenwal

slideshare.net/CAinc

linkedin.com/company/ca-technologies

ca.com