In partnership with
The National Institute of Standards and Technology published IR 8625 on September 24, covering security for Open Radio Access Network intelligent controllers.
The report examines the Near Real Time RAN Intelligent Controller, or RIC, and the applications that run through it. It addresses a network architecture built from interoperable components and software interfaces.
Open RAN separates radio functions that were traditionally delivered through a more unified system. Operators can combine components from different vendors and place software on virtualized infrastructure.
Learn AI in 5 minutes a day
You don't have to scroll every AI thread, track every new tool, or watch every demo.
The Rundown AI breaks it all down for you — the latest AI news, tools, and tutorials in one free 5-minute email every morning.
Trusted by 2M+ professionals at Apple, Google, and NASA.
That flexibility changes the security problem. A RIC can monitor network conditions, apply policies, and modify radio behavior through software applications. The same control path can therefore affect availability, data, and configuration.
NIST describes two RIC forms. The Near Real Time RIC handles more immediate control for a subset of cells. The Non Real Time RIC works across broader data and slower control cycles.
The report identifies the A1, E2, and R1 interfaces as important parts of this arrangement. The E2 interface connects Near Real Time control with network elements. The A1 interface coordinates with the Non Real Time RIC. The R1 interface supports applications that configure or modify the RAN.
The software applications have separate names and operating roles. rApps run in the Non Real Time RIC. xApps run in the Near Real Time RIC. An rApp can analyze measurements from several locations and pass policies to xApps that make faster adjustments.
NIST organizes threats using the STRIDE model. The categories include impersonation, tampering, repudiation, information disclosure, denial of service, and unauthorized privilege.
The risks are not limited to outside attackers. A compromised or misconfigured application can send excessive traffic, request data outside its purpose, or alter policies created by another application.
Third party applications create another boundary to inspect. They may collect information from the RAN and transmit it to systems outside the network. Proprietary interfaces can also create threats that are not fully covered by shared specifications.
The report connects these concerns with a zero trust approach. In this context, each request must be authenticated and authorized according to policy, regardless of where the request originates.
NIST is careful about what this means. Zero trust is a security strategy, not one protocol or a single product. The O RAN Alliance can specify component requirements, but it cannot mandate an operator’s complete operating model.
Can Robotics Make Regenerative Farming Scalable?
Greenfield Robotics is on a mission to give farmers alternatives to herbicide-dependent weed control. BOTONY is the beginning of a broader robotic farming system designed for a wider range of applications in the field.
The Reg A+ offering is now live for investors who want to be part of what comes next.
This Reg A+ offering is made available through StartEngine Primary, LLC, member FINRA/SIPC. Please read the Offering Circular and related disclosures before investing. This investment is speculative, illiquid, and involves a high degree of risk, including the possible loss of your entire investment.
The report discusses identity, authentication, authorization, and communication policies. It notes that operators may use cloud based security technologies beneath the application layer, but these alternatives are not specified by the O RAN Alliance.
That distinction prevents a common mistake. Meeting a component requirement does not prove that an entire deployment operates with zero trust. Network design, logging, policy, application behavior, and incident response remain operational decisions.
NIST’s related IR 8623 draft applies the Cybersecurity Framework to federal agency Open RAN deployment. It describes resources for evaluating threats and mapping O RAN security specifications to framework outcomes. The draft was published September 17, with comments due November 2.
Together, the two documents show a technical transition from component security toward deployment review. The question is not simply whether a RIC has an identity mechanism. It is whether every application, interface, and data path has a defined purpose and a limited authority.
The report is a reference for architects and operators, not proof that any deployment is secure. Its value is in making the control surfaces visible before a flexible radio architecture becomes difficult to examine.
Built for Product Teams moving at AI Speed.
Your teams are moving fast, burning tokens, and shipping more than ever.
But more output doesn’t mean more impact.
Jira Product Discovery brings your ideas, customer insights, and business context together so product teams can weigh the evidence, make the tradeoffs, and decide what’s actually worth building. Then connect those decisions directly to delivery in Jira, so everyone knows what you’re building and why.
Jira Product Discovery. For better product decisions in the AI era.
