Feeds

The web needs globally backed, verifiable security standards – says Huawei

The Chinese government ain't the boss of us, telecoms kit giant asserts ... again

Reducing the cost and complexity of web vulnerability management

Chinese networking hardware behemoth Huawei has issued its second annual cybersecurity white paper and is calling for manufacturers around the world to set up testable security standards that will ensure everyone's reading from the same hymn sheet.

"The biggest hurdle is that the technology industry doesn't want mandatory global standards. Because governments and big enterprises are not using their buying power to really demand the highest level of security from network equipment suppliers, vendors are not putting their investment dollars into security unless they really need to," John Suffolk, Huawei's global cyber security officer, told The Wall Street Journal.

"Governments are big spenders in the information technology industry, so if many governments got together and demanded certain security standards from all vendors, the whole industry will then shift to those new standards. And once the governments do that, enterprise clients will follow and do the same."

There are almost no common security standards being enforced and regularly tested across the industry, Suffolk said, and this piecemeal approach to security – with each vendor (including Huawei) handling just their own products – was a recipe for failure. Global standards that are verifiable, frequently tested, and fully audited, are needed to secure traffic going forward he suggested.

Suffolk, who was the UK's CIO before heading to the Middle Kingdom, flatly denied that his employers give any data to the Chinese government and their agencies. As for moves in the US to ban the Chinese manufacturer's kit, he pointed out that around 70 per cent of the components in Huawei's hardware come from third-party suppliers, most of which are US firms.

As for software there's no single programmer writing code for its stack who would be able to add in spying code he said, and the multitude of different ways companies configure their networks would make such an approach largely useless, he argued. Any hacker would be much more effective using phishing or malware attacks to spy rather than trying to subvert a whole company's processes, he said.

The biggest change companies and governments could make to secure their networks wasn't picking a specific, supposedly secure supplier, Suffolk said, but better overall security practice. Patching vulnerabilities, training staff to be more switched on, and limiting root privileges on the network would solve about 80 per cent of common security problems, he reckoned.

Suffolk didn't go as far as to call out the NSA directly for weakening encryption standards and similar practices, but the white paper does point out that governments buying up zero-day security bug exploits and hoarding them wasn't helping matters on the cyber-security front.

"Among the global vendors, the spotlight has been on Huawei more than anyone else, because we are quite unique being a Chinese-headquartered business. And therefore we have to go the extra mile when it comes to security, and we are pleased to go the extra mile. But there's no point in Huawei improving its security on its own if nobody else in the ecosystem improves their security," he concluded. ®

Choosing a cloud hosting partner with confidence

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.