5G Cyber Red Team / Blue Team Workshop

5G Cyber Red Team / Blue Team Workshop by Tonex

Fifth-generation (5G) networks combine subscriber authentication, service-based core functions, radio access infrastructure, cloud-native workloads, and programmable operational interfaces. This workshop examines the interaction between authorized security assessments and continuous defensive operations across those components. Participants review identity controls, network function interfaces, configuration exposure, management-plane access, and network slice boundaries. Red team activities are framed through documented permissions and service-protection requirements; blue team work centers on telemetry, corroborated detections, and coordinated remediation. Professionals learn to separate plausible attack paths from verified exploitation, prioritize operator-specific risks, and produce assessment reports that strengthen protection without interrupting essential mobile services.

Cybersecurity collaboration between assessors and defenders reduces exposed trust boundaries and detection gaps. Effective cybersecurity outcomes depend on lawful scope, accurate technical evidence, and production-safe operational decisions.

The workshop uses a practical training approach that includes exercises, real-world case studies, and examples of processes and documentation used in 5G security assessment projects, including scope approvals, service dependency maps, detection matrices, and remediation plans.

Learning Objectives

• Describe relevant 5G radio, core, transport, and cloud security boundaries.
• Create authorized assessment scopes that preserve subscriber and service availability.
• Identify control weaknesses affecting identity, interfaces, and management functions.
• Compare assessment evidence with defensive monitoring and alert coverage.
• Define collaborative prioritization for remediation and configuration hardening.
• Document defensible outcomes without claiming unverified attacker capabilities.
• Improve cybersecurity assurance through coordinated offensive review and defensive validation.

Audience

• Cybersecurity Professionals
• 5G Security Assessment Specialists
• Mobile Network Defense Engineers
• Authorized Telecommunications Red Team Members
• Telecom Blue Team Analysts
• 5G Core Security Architects
• Operator Security Assurance Managers

Course Modules

Module 1: 5G Systems and Trust Boundaries

• Map radio access, core, transport, and edge responsibilities
• Identify service-based network functions and their protected interfaces
• Review subscriber authentication and credential protection relationships
• Identify network slice and shared infrastructure isolation assumptions
• Explain operator and vendor administrative security responsibilities
• Document service availability constraints for approved assessment activities

Module 2: Authorized Assessment Governance

• Define security assessment objectives and written operating permissions
• Exclude intrusive activity that threatens active subscriber services
• Agree on emergency contacts and operational stop conditions
• Identify approved records needed for technical validation
• Prioritize review targets through documented risk and exposure
• Maintain accountable findings, approvals, and assessment evidence

Module 3: 5G Core and Identity Review

• Assess protection of service-based application programming interfaces
• Review network function identity and mutual authentication controls
• Evaluate service authorization and token handling assumptions
• Identify risky privileged access and configuration management practices
• Check network function communication policy segmentation requirements
• Document findings with corroborating configuration and access records

Module 4: RAN Edge and Transport Defense

• Review radio management access and configuration integrity expectations
• Identify transport encryption and trusted interconnection requirements
• Assess workload identity protections in distributed edge platforms
• Compare radio anomalies with maintenance and fault history
• Evaluate shared infrastructure boundaries across virtualized functions
• Record service impact limits and defensive monitoring dependencies

Module 5: Red Blue Detection Coverage Reviews

• Map authorized observations to relevant defensive alert sources
• Correlate identity logs with network function authorization events
• Assess missing visibility across supplier managed components
• Differentiate test observations from production security incidents
• Identify detection tuning actions for repeatable suspicious patterns
• Prioritize remediation by operational impact and evidence confidence

Module 6: Hardening Validation and Executive Reporting

• Review configuration improvements against architecture security requirements
• Assign responsible owners and deadlines for control deficiencies
• Record residual risks and proposed compensating safeguards
• Validate improved alert workflows through approved evidence review
• Prepare technical findings and leadership summaries without exaggeration
• Update joint assessment plans after major network changes

Connect security assessment with sustainable defense in 5G Cyber Red Team / Blue Team Workshop by Tonex. Build coordinated controls across mobile network environments.