ITU-T X.805 - Security Architecture for End-to-End Communications X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches: ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge

Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures. The Infrastructure Security Layer represents the fundamental building blocks of telecommunication networks - the things over which information flows. (1) Infrastructure Layer Components: (a) Transmission Facilities - copper + fibre optic + wireless including microwave + satellite + cellular + Wi-Fi + DOCSIS cable + DSL + Ethernet; (b) Network Elements - routers + switches + load balancers + firewalls + IDS/IPS + WAN accelerators + CDNs + SDN controllers; (c) Aggregation/Distribution - DSLAMs + OLTs + BNG Broadband Network Gateway + 5G UPF + MME + SAE-GW + GGSN/PGW; (d) Access Network - BTS Base Transceiver Station + NodeB/eNodeB/gNodeB + AAA + RNC; (e) Core Network - PSTN + ISDN + IP backbone + MPLS core + ATM/Frame Relay legacy + 5G Core; (f) Edge Computing - MEC Multi-access Edge Computing + Edge cloud + IoT gateways; (g) Datacenter Infrastructure - racks + power + cooling + cabling + structured cabling; (h) Cloud Infrastructure - IaaS + PaaS + IaC Infrastructure-as-Code; (i) IoT Devices + sensors + actuators + gateways + LPWAN (LoRaWAN + NB-IoT + LTE-M). (2) Infrastructure Security Per Dimension: (a) Access Control - physical access control + biometric + RFID badges + man-traps + CCTV + datacenter access control; equipment console port lockout + 802.1X for management ports; (b) Authentication - device authentication + cryptographic identity + IEEE 802.1AR Secure Device Identity + TPM-based attestation + Secure Boot; (c) Non-Repudiation - signed config commits + change management audit + configuration history; (d) Data Confidentiality - link encryption + MACsec IEEE 802.1AE + IPSec + Layer 2 encryption + optical layer encryption (OTNsec); (e) Communication Security - dedicated paths + MPLS L2/L3 VPN + traffic engineering + VLAN segmentation + microsegmentation; (f) Data Integrity - hash-based integrity for management commands + Secure Boot + Measured Boot + Remote Attestation; (g) Availability - redundant power + cooling + fibre + diverse routing + GSLB + Anycast + uninterruptible power (UPS) + generators; (h) Privacy - subscriber identifier privacy at access layer + IMSI concealment + MAC randomisation + IPv6 temporary addresses. (3) Infrastructure Physical Security: (a) Datacenter Standards (Uptime Institute Tier I-IV + TIA-942); (b) Physical access control + biometric + smart card + man-trap + tailgating prevention; (c) CCTV + Intrusion Detection + Glass-Break Sensors + Motion + PIR; (d) Environmental controls + HVAC + fire suppression (FM-200 + Inergen) + leak detection; (e) Cable management + sealed conduits + EMI/EMP shielding; (f) Hardware Security Module (HSM) datacenter for cryptographic operations; (g) Tamper-evident seals + tamper-resistant equipment per FIPS 140-3 Level 3-4; (h) Vendor diversity + Supply Chain Risk Management per NIST SP 800-161; (i) Equipment Security per GSMA NESAS + 3GPP TS 33.117 SCAS Security Assurance Specification. (4) Telecom Carrier Infrastructure Specific: (a) Lawful Intercept (LI) infrastructure per ETSI TS 102 232 + 3GPP TS 33.108 + CALEA + Network Element Manager (NEM); (b) Carrier-grade availability 99.999% + diverse routing + N+1 redundancy; (c) STIR/SHAKEN signed caller ID infrastructure; (d) IPv6 deployment + Carrier Grade NAT (CGN); (e) BGP routing + RPKI Route Origin Validation + BGPSEC; (f) DNSSEC for authoritative + recursive DNS; (g) Submarine cables + landing stations; (h) Satellite + space ground segment. (5) Cloud Infrastructure Security: (a) Hypervisor security + VM Escape prevention + side-channel mitigations (Spectre + Meltdown + Foreshadow + ZombieLoad); (b) Container security (Linux Capabilities + seccomp + AppArmor + SELinux + gVisor + Kata Containers); (c) Kubernetes security (Pod Security Standards + RBAC + Network Policies + OPA Gatekeeper + Falco); (d) Confidential Computing (AMD SEV-SNP + Intel TDX + ARM CCA + Confidential VMs); (e) Cloud Provider IaaS security (AWS Inspector + GuardDuty + Security Hub + Azure Defender + Google SCC); (f) Infrastructure-as-Code (IaC) security scanning (Checkov + Terrascan + tfsec + Bridgecrew). (6) IoT Infrastructure Security: (a) IoT device identity (X.509 + SECP256R1 + LWM2M); (b) Secure boot + secure firmware updates + TUF The Update Framework; (c) IoT gateway security; (d) LPWAN security (LoRaWAN session key + NB-IoT 5G AKA); (e) Matter/Thread/Zigbee/Bluetooth LE security; (f) ETSI EN 303 645 Cyber Security for Consumer IoT; (g) UK PSTI Product Security and Telecommunications Infrastructure Act 2022. (7) Threats per X.805 Table 1 mitigated at Infrastructure: (a) Destruction - physical security; (b) Corruption - integrity controls; (c) Removal - asset tracking; (d) Disclosure - encryption; (e) Interruption - redundancy. (8) Standards: (a) ISO/IEC 27001 A.11 / A.7 (2022) Physical Security; (b) ISO/IEC 27040 Storage Security; (c) TIA-942 Telecom Infrastructure Standard; (d) Uptime Institute Tier Standards; (e) NIST SP 800-53 PE family + PE-3 Physical Access; (f) GSMA NESAS + 3GPP SCAS; (g) ETSI TS 102 165 TVRA + EN 303 645 IoT; (h) IEEE 802.1AE MACsec + 802.1AR Secure Device Identity. Coordinates with X.805 Plane 1/2/3 + 8 Dimensions + Threats All-5 + ISO 27001 A.7 + 27040 + NIST SP 800-53 PE + GSMA NESAS + 3GPP SCAS + TIA-942 + Uptime Institute + ETSI EN 303 645. ITU-T X.805 Security Layer 1 Infrastructure applies.