done until a point of time at which the software becomes unsupported, usually referred to as 'end-of-life.' Ciphering and authentication algorithms are only effective if the applied algorithms are classified as safe and are used properly. Certifications (such as FIPS) can be required for deployment in secure environments. 212 Open Radio Access Network (O-RAN) Systems Architecture and Design Some applications temporarily require elevated permissions. Care must be taken that the lowering of the privilege level always is executed correctly. Applications should run at the minimum access level required for correct operation. A webserver should for instance never run as "root." This limits the level of access gained by an attacker in case of a compromised service or component. File permissions on operating system level should be configured as restrictively as possible. Especially configuration files and data store deserve careful configuration. An application (or extension/plugin that integrates into the application) could use (bundled) binary files for its working. If so, the integrity of the code that is executed within these binary files cannot easily be reviewed, forming a risk for the user that executes the plugin. Monitor and manage all third-party components (Linux Kernel, Open Source Software (OSS) projects, etc.). Know what components are included in the release package (BOM). Know what CVE numbers may be assigned by MITRE and monitor MITRE for any new CVEs. Know the security risks associated with the third-party components. 3GPP and International Electrotechnical Commission security requirements Security aspects of 3GPP are defined by the SA3 Working Group and specified in the 3GPP 33.401 for 4G/LTE (Table 5-2) and 33.501 standard for 5G/NR (Table 5-3). It covers mid/ backhaul, DU internal, and fronthaul security aspects. Mid/Backhaul. The support of security associations is required between the Evolved Packet Core (4G/LTE) or Next Generation Core (5G) and the base station as well as between base stations. Th