ITU-T X.805 - Security Architecture for End-to-End Communications X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches: ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge

Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures. The Infrastructure Security Layer is made up of the basic components of telecommunication networks - the things over which information flows. (1) Infrastructure Layer Components: (a) Transmission Facilities - copper + fibre optic + wireless including microwave + satellite + cellular + Wi-Fi + DOCSIS cable + DSL + Ethernet; (b) Network Elements - routers + switches + load balancers + firewalls + IDS/IPS + WAN accelerators + CDNs + SDN controllers; (c) Aggregation/Distribution - DSLAMs + OLTs + BNG Broadband Network Gateway + 5G UPF + MME + SAE-GW + GGSN/PGW; (d) Access Network - BTS Base Transceiver Station + NodeB/eNodeB/gNodeB + AAA + RNC; (e) Core Network - PSTN + ISDN + IP backbone + MPLS core + ATM/Frame Relay legacy + 5G Core; (f) Edge Computing - MEC Multi-access Edge Computing + Edge cloud + IoT gateways; (g) Datacenter Infrastructure - racks + power + cooling + cabling + structured cabling; (h) Cloud Infrastructure - IaaS + PaaS + IaC Infrastructure-as-Code; (i) IoT Devices + sensors + actuators + gateways + LPWAN (LoRaWAN + NB-IoT + LTE-M). (2) Infrastructure Security Per Dimension: (a) Access Control - physical access control + biometric + RFID badges + man-traps + CCTV + datacenter access control; equipment console port lockout + 802.1X for management ports; (b) Authentication - device authentication + cryptographic identity + IEEE 802.1AR Secure Device Identity + TPM-based attestation + Secure Boot; (c) Non-Repudiation - signed config commits + change management audit + configuration history; (d) Data Confidentiality - link encryption + MACsec IEEE 802.1AE + IPSec + Layer 2 encryption + optical layer encryption (OTNsec); (e) Communication Security - dedicated paths + MPLS L2/L3 VPN + traffic engineering + VLAN segmentation + microsegmentation; (f) Data Integrity - hash-based integrity for management commands + Secure Boot + Measured Boot + Remote Attestation; (g) Availability - redundant power + cooling + fibre + diverse routing + GSLB + Anycast + uninterruptible power (UPS) + generators; (h) Privacy - subscriber identifier privacy at access layer + IMSI concealment + MAC randomisation + IPv6 temporary addresses. (3) Infrastructure Physical Security: (a) Datacenter Standards (Uptime Institute Tier I-IV + TIA-942); (b) Physical access control + biometric + smart card + man-trap + tailgating prevention; (c) CCTV + Intrusion Detection + Glass-Break Sensors + Motion + PIR; (d) Environmental controls + HVAC + fire suppression (FM-200 + Inergen) + leak detection; (e) Cable management + sealed conduits + EMI/EMP shielding; (f) Hardware Security Module (HSM) datacenter for cryptographic operations; (g) Tamper-evident seals + tamper-resistant equipment per FIPS 140-3 Level 3-4; (h) Vendor diversity + Supply Chain Risk Management per NIST SP 800-161; (i) Equipment Security per GSMA NESAS + 3GPP TS 33.117 SCAS Security Assurance Specification. (4) Telecom Carrier Infrastructure Specific: (a) Lawful Intercept (LI) infrastructure per ETSI TS 102 232 + 3GPP TS 33.108 + CALEA + Network Element Manager (NEM); (b) Carrier-grade availability 99.999% + diverse routing + N+1 redundancy; (c) STIR/SHAKEN signed caller ID infrastructure; (d) IPv6 deployment + Carrier Grade NAT (CGN); (e) BGP routing + RPKI Route Origin Validation + BGPSEC; (f) DNSSEC for authoritative + recursive DNS; (g) Submarine cables + landing stations; (h) Satellite + space ground segment. (5) Cloud Infrastructure Security: (a) Hypervisor security + VM Escape prevention + side-channel mitigations (Spectre + Meltdown + Foreshadow + ZombieLoad); (b) Container security (Linux Capabilities + seccomp + AppArmor + SELinux + gVisor + Kata Containers); (c) Kubernetes security (Pod Security Standards + RBAC + Network Policies + OPA Gatekeeper + Falco); (d) Confidential Computing (AMD SEV-SNP + Intel TDX + ARM CCA + Confidential VMs); (e) Cloud Provider IaaS security (AWS Inspector + GuardDuty + Security Hub + Azure Defender + Google SCC); (f) Infrastructure-as-Code (IaC) security scanning (Checkov + Terrascan + tfsec + Bridgecrew). (6) IoT Infrastructure Security: (a) IoT device identity (X.509 + SECP256R1 + LWM2M); (b) Secure boot + secure firmware updates + TUF The Update Framework; (c) IoT gateway security; (d) LPWAN security (LoRaWAN session key + NB-IoT 5G AKA); (e) Matter/Thread/Zigbee/Bluetooth LE security; (f) ETSI EN 303 645 Cyber Security for Consumer IoT; (g) UK PSTI Product Security and Telecommunications Infrastructure Act 2022. (7) Threats per X.805 Table 1 mitigated at Infrastructure: (a) Destruction - physical security; (b) Corruption - integrity controls; (c) Removal - asset tracking; (d) Disclosure - encryption; (e) Interruption - redundancy. (8) Standards: (a) ISO/IEC 27001 A.11 / A.7 (2022) Physical Security; (b) ISO/IEC 27040 Storage Security; (c) TIA-942 Telecom Infrastructure Standard; (d) Uptime Institute Tier Standards; (e) NIST SP 800-53 PE family + PE-3 Physical Access; (f) GSMA NESAS + 3GPP SCAS; (g) ETSI TS 102 165 TVRA + EN 303 645 IoT; (h) IEEE 802.1AE MACsec + 802.1AR Secure Device Identity. Coordinates with X.805 Plane 1/2/3 + 8 Dimensions + Threats All-5 + ISO 27001 A.7 + 27040 + NIST SP 800-53 PE + GSMA NESAS + 3GPP SCAS + TIA-942 + Uptime Institute + ETSI EN 303 645. ITU-T X.805 Security Layer 1 Infrastructure applies.