Feeds

The web needs globally backed, verifiable security standards – says Huawei

The Chinese government ain't the boss of us, telecoms kit giant asserts ... again

Next gen security for virtualised datacentres

Chinese networking hardware behemoth Huawei has issued its second annual cybersecurity white paper and is calling for manufacturers around the world to set up testable security standards that will ensure everyone's reading from the same hymn sheet.

"The biggest hurdle is that the technology industry doesn't want mandatory global standards. Because governments and big enterprises are not using their buying power to really demand the highest level of security from network equipment suppliers, vendors are not putting their investment dollars into security unless they really need to," John Suffolk, Huawei's global cyber security officer, told The Wall Street Journal.

"Governments are big spenders in the information technology industry, so if many governments got together and demanded certain security standards from all vendors, the whole industry will then shift to those new standards. And once the governments do that, enterprise clients will follow and do the same."

There are almost no common security standards being enforced and regularly tested across the industry, Suffolk said, and this piecemeal approach to security – with each vendor (including Huawei) handling just their own products – was a recipe for failure. Global standards that are verifiable, frequently tested, and fully audited, are needed to secure traffic going forward he suggested.

Suffolk, who was the UK's CIO before heading to the Middle Kingdom, flatly denied that his employers give any data to the Chinese government and their agencies. As for moves in the US to ban the Chinese manufacturer's kit, he pointed out that around 70 per cent of the components in Huawei's hardware come from third-party suppliers, most of which are US firms.

As for software there's no single programmer writing code for its stack who would be able to add in spying code he said, and the multitude of different ways companies configure their networks would make such an approach largely useless, he argued. Any hacker would be much more effective using phishing or malware attacks to spy rather than trying to subvert a whole company's processes, he said.

The biggest change companies and governments could make to secure their networks wasn't picking a specific, supposedly secure supplier, Suffolk said, but better overall security practice. Patching vulnerabilities, training staff to be more switched on, and limiting root privileges on the network would solve about 80 per cent of common security problems, he reckoned.

Suffolk didn't go as far as to call out the NSA directly for weakening encryption standards and similar practices, but the white paper does point out that governments buying up zero-day security bug exploits and hoarding them wasn't helping matters on the cyber-security front.

"Among the global vendors, the spotlight has been on Huawei more than anyone else, because we are quite unique being a Chinese-headquartered business. And therefore we have to go the extra mile when it comes to security, and we are pleased to go the extra mile. But there's no point in Huawei improving its security on its own if nobody else in the ecosystem improves their security," he concluded. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Cutting cancer rates: Data, models and a happy ending?
How surgery might be making cancer prognoses worse
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?