Open RAN security needs identity boundaries

NIST published a report on 24 September 2026 examining security for the near-real-time Radio Access Network Intelligent Controller, or RIC, in Open RAN. A radio access network connects customer devices to an operator's core network and the internet. Open RAN seeks to standardise components and interfaces so an operator can assemble a network from multiple vendors rather than rely on one closed stack.

The RIC adds software-based control and management functions that can run on virtualised infrastructure. Specialised applications can use it to automate or optimise the network. NIST's central point is that moving from a legacy architecture to service-based components and new interfaces changes the threat surface and makes zero-trust design relevant to the RIC environment.

Dunes Bureau interpretation: procurement should map the trust decision attached to every important connection. For each network function and application, an operator should identify the requesting service, the resource it can reach, the action it may perform, the evidence used to authorise it and the event record retained afterwards. A supplier integration is incomplete if those decisions remain implicit in a broad network zone.

The business issue is not simply whether Open RAN is secure or insecure. Interoperability can widen supplier choice and allow more specialised software, while the added component boundaries create more identities, policies and update paths to manage. Operators should therefore test both normal workflows and denied requests across vendor boundaries, including what happens when an application's permission is withdrawn.

The report does not certify a particular vendor, deployment or control product. It describes the status of zero trust in Open RAN and considerations for applying it. A production decision would still require architecture review, implementation testing, operational monitoring and evidence that access policies remain correct as software and suppliers change.