Ask Chandra

Chandra McMahon is Verizon’s Chief Information Security Officer. She is responsible for setting information security strategy, policy, standards, architecture and operations.

Q: 5G sounds incredibly exciting, but isn’t something new always a risk?

A: Verizon was the first provider in the world to launch a commercial 5G service, but we would never have launched until we knew  we were ready. Our reputation is too important to us for that.

While our 5G network provides a whole new experience for our customers, it’s an evolution of our state-of-the-art  4G  LTE  technology. It leverages security measures that exist today in the 4G environment,  but also ushers in new innovations such as sophisticated encryption and authentication features, as well as a new Security Edge Protection Proxy that helps prevent threats from less- secure interconnected networks from harming 5G networks.

Q: But doesn’t 5G increase the attack surface and introduce all kinds of new opportunities for cybercriminals?

A: Verizon has a long history of protecting against threats to customers’ security and maintaining the reliability and resilience of communications services against all manner of hazards, including cyberthreats. Our 5G network builds on our decades of experience and technological leadership.

We’re deploying our 5G network with full awareness of the threats, and we are building it to account for them. This builds upon the innovations we’ve made in 4G LTE and leverages the unique benefits of 5G technology to develop and operate an even more secure network.

And our efforts aren’t just limited to the technology itself. For example, as part of our 5G development, we’ve created detailed new vetting and compliance programs for vendors so we can be confident that every component we add to the network meets our exacting standards.
 

Q: With so many new devices and types of applications, how can companies ensure that the latest exciting new thing doesn’t compromise the security of their network?

A: We use threat modeling to evaluate the potential risk of new applications and devices. Based on specifically identified threats, we conduct internal and third-party security testing on device and application layers to identify vulnerabilities that could be exploited, either by a nefarious internal actor or an external hacker.

This risk assessment determines whether any changes are required before we move forward with the product or service in question. We then work with the product or platform vendor to confirm that we have resolved identified issues prior to launch and that we have properly and securely configured the equipment and devices in question.

Q: This is just the start for 5G, and as we’ve seen throughout this paper, as fast as operators  and customers innovate, so do the attackers. How does Verizon plan to stay ahead of the threats and keep its network and its customers' data secure?

A: Verizon actively participates in the standards development process to identify potential new security features that could be implemented in our network. And we plan to continue to lead the development of innovative security service concepts and capabilities for 5G. We’re developing how we use AI, security automation, virtualization and other proactive security measures to accelerate the identification and mitigation of threats.

One of the most interesting things that we’re working on is using a software- defined perimeter (SDP) to create a “zero-trust” security layer over a 5G network. This offers big benefits for customers with complex networks and security needs.

Finally, we’re investing in our people too. From talent recruitment to career development, we’re investing in building a robust cybersecurity workforce pipeline to ensure our customers’ needs are met today and tomorrow.