Keeping Networks Secure: The Open Way - Ranny Haiby, The Linux Foundation [Presented in English]

### Overview Ranny Haiby, CTO of Networking, Edge, and Access at The Linux Foundation, discusses how open source software accelerates innovation and bolsters security in modern 5G networks. While traditional telecommunication innovation relies on slow, linear standardization and multi-vendor interoperability testing cycles, integrating open source development alongside specification efforts creates a continuous feedback loop. This parallel process helps identify ambiguities early and accelerate deployment across network domains, from core and cloud to edge and enterprise networks. However, Haiby emphasizes that open source and 5G network convergence brings significant software supply chain risks and unique telecommunication threats that require a continuous, multi-layered approach to security.

### Key Topics - **Open Source Drivers in Telecom**: Network operators require operational agility, cost reduction, and automated software controls to manage scalable infrastructure across multiple edge locations. - **Open Source and 5G Threat Landscape**: Software vulnerabilities (such as Log4j), supply chain compromises (like SolarWinds), and infrastructure attacks (like GitHub) demonstrate the growing risks. In 5G networks, the attack surface expands due to billions of insecure IoT devices, decreased network visibility, supply chain vendor concentration, and software dependencies. - **Specific 5G Architectural Vulnerabilities**: Haiby highlights security risks associated with configuration management, network layer exploits, improper network slice management, legacy 4G protocol threats, Multi-access Edge Computing (MEC) exposing core elements, spectrum sharing jamming/interference, and software-defined networking (SDN) controller exploits. - **Supply Chain and SBOM Adoption**: Surveys conducted by The Linux Foundation show that while 98% of surveyed organizations use open source software and 95% express security concerns, less than half use Software Bills of Materials (SBOMs) to track component origins.

### Technical Details Haiby outlines how the Linux Foundation Networking (LFN) and Open Source Security Foundation (OpenSSF) build security directly into the software lifecycle: - **Software Bills of Materials (SBOM)**: Following the NTIA definition of a formal, machine-readable inventory of software components and dependencies, LFN projects integrate automated SBOM generation into CI/CD pipelines. For example, ONAP uses the SPDX format via the LF Networking CI pipeline, Anuket integrates SBOM into holistic security requirements, and OpenDaylight has added automated CycloneDX generation for upcoming releases. - **Continuous Tracking and Tooling**: LF Networking leverages the Linux Foundation LFX infrastructure to provide security dashboards tracking trends, open issues, and resolved vulnerabilities. Projects also adopt OpenSSF training courses and the OpenSSF Best Practices Badge. - **CI/CD Pipeline Integration**: Best practices require integrating code linters, static/dynamic application security testing scanners, secret scanners, software composition analysis (SCA), and fuzzers directly into deployment pipelines. - **Dependency Governance**: Organizations must monitor dependencies for known vulnerabilities, enable rapid updates via package managers and automated tests, and defend against typosquatting and insecure package acquisition.

### Takeaways Securing open source software in 5G networks is an ongoing, holistic lifecycle process rather than a one-time toggle or "silver bullet." Security considerations must span from initial requirement definitions and threat modeling through development, deployment, patching with stable APIs, and eventual decommissioning. Operators and developers must rigorously vet open source components by examining maintenance cadence, multi-organizational backing, industry adoption, clear open source licensing, and secure default configurations.