While 4G is speeding up its steps toward global markets, 5G has initiated its full development to satisfy an increasing demand on mobile data traffic and big data bandwidth. Centralized data processing, collaborative radio, real-time cloud infrastructure, and cloud radio access network (C-RAN), along with their excellent advantages are being sought by more and more operators to meet end-user requirements. As a promising mobile wireless network architecture, compared with traditional RAN, C-RAN has incomparable advantages in terms of low power consumption, reduced base station (BS) numbers, and economic capital and operating expenditure. It can also improve network capacity and BS utilization rate. Recently, C-RAN security has aroused special attention and concern. However, the literature still lacks an overall review on it in order to guide current and future research. In this paper, we first overview the architecture, deployment scenarios, and special characteristics of C-RAN. We then provide a thorough review on the existing security studies in the field of C-RAN based on its three logic layers and corresponding security threats and attacks. Particularly, we discuss whether the current literature can satisfy the expected security requirements in C-RAN. Based on this, we indicate open research issues and propose future research trends.