Feeds

The web needs globally backed, verifiable security standards – says Huawei

The Chinese government ain't the boss of us, telecoms kit giant asserts ... again

Application security programs and practises

Chinese networking hardware behemoth Huawei has issued its second annual cybersecurity white paper and is calling for manufacturers around the world to set up testable security standards that will ensure everyone's reading from the same hymn sheet.

"The biggest hurdle is that the technology industry doesn't want mandatory global standards. Because governments and big enterprises are not using their buying power to really demand the highest level of security from network equipment suppliers, vendors are not putting their investment dollars into security unless they really need to," John Suffolk, Huawei's global cyber security officer, told The Wall Street Journal.

"Governments are big spenders in the information technology industry, so if many governments got together and demanded certain security standards from all vendors, the whole industry will then shift to those new standards. And once the governments do that, enterprise clients will follow and do the same."

There are almost no common security standards being enforced and regularly tested across the industry, Suffolk said, and this piecemeal approach to security – with each vendor (including Huawei) handling just their own products – was a recipe for failure. Global standards that are verifiable, frequently tested, and fully audited, are needed to secure traffic going forward he suggested.

Suffolk, who was the UK's CIO before heading to the Middle Kingdom, flatly denied that his employers give any data to the Chinese government and their agencies. As for moves in the US to ban the Chinese manufacturer's kit, he pointed out that around 70 per cent of the components in Huawei's hardware come from third-party suppliers, most of which are US firms.

As for software there's no single programmer writing code for its stack who would be able to add in spying code he said, and the multitude of different ways companies configure their networks would make such an approach largely useless, he argued. Any hacker would be much more effective using phishing or malware attacks to spy rather than trying to subvert a whole company's processes, he said.

The biggest change companies and governments could make to secure their networks wasn't picking a specific, supposedly secure supplier, Suffolk said, but better overall security practice. Patching vulnerabilities, training staff to be more switched on, and limiting root privileges on the network would solve about 80 per cent of common security problems, he reckoned.

Suffolk didn't go as far as to call out the NSA directly for weakening encryption standards and similar practices, but the white paper does point out that governments buying up zero-day security bug exploits and hoarding them wasn't helping matters on the cyber-security front.

"Among the global vendors, the spotlight has been on Huawei more than anyone else, because we are quite unique being a Chinese-headquartered business. And therefore we have to go the extra mile when it comes to security, and we are pleased to go the extra mile. But there's no point in Huawei improving its security on its own if nobody else in the ecosystem improves their security," he concluded. ®

Eight steps to building an HP BladeSystem

More from The Register

next story
Sysadmin Day 2014: Quick, there's still time to get the beers in
He walked over the broken glass, killed the thugs... and er... reconnected the cables*
SHOCK and AWS: The fall of Amazon's deflationary cloud
Just as Jeff Bezos did to books and CDs, Amazon's rivals are now doing to it
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
The triumph of VVOL: Everyone's jumping into bed with VMware
'Bandwagon'? Yes, we're on it and so what, say big dogs
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.