It's almost nine years since Chinese networking and telecommunications giant Huawei entered into an agreement with the UK government to permit extensive security reviews of Huawei’s hardware and software—a move intended to allay fears that the company posed a security risk to the UK’s networks. Since then, the Huawei Cyber Security Evaluation Centre (HCSEC) has given UK officials a window into the company’s information security practices. And UK officials haven’t necessarily liked what they’ve seen.
In a report last week, the HCSEC Oversight Board, which comprised officials from the National Cyber Security Centre, GCHQ and other agencies, as well as a senior executive from Huawei, warned that Huawei had failed to make long-promised changes to its software development and engineering practices needed to improve security.
“HCSEC’s work has continued to identify concerning issues in Huawei’s approach to software development bringing significantly increased risk to UK operators,” board members noted. “No material progress” had been made in correcting those problems since they were noted last year.
In addition, audits and reviews by the HCSEC had found “further significant technical issues in Huawei’s engineering practices,” the board noted. While Huawei had promised to make major investments in correcting its problems and promising to invest $2 billion in security engineering improvements over five years, the board remained unconvinced based on their review:
At present, the board has not yet seen anything to give it confidence in Huawei’s capacity to successfully complete the elements of its transformation programme. The board will require sustained evidence of better software engineering and cybersecurity quality verified by HCSEC and NCSC. Overall, the board can only provide limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks can be sufficiently mitigated long-term.
The full oversight board report can be seen here.
Cyberattacks: Preparing For The Inevitable
It is generally accepted that it is when, not if, large organisations will be the target of malicious cyberattacks. The importance of being prepared has been laid out in a blog post Sweat In Peace, Don't Bleed In War, written by Meredydd Hughes, a former UK chief constable with substantial crisis management experience.read more
Varonis Blog Highlights 110 Cybersecurity Statistics
Cybersecurity company Varonis has issued its predictions for the forthcoming year with a blog post entitled 110 Cybersecurity Statics For 2020. The blog states that cybersecurity issues are becoming a day-to-day struggle for businesses. Recent trends and cybersecurity statistics reveal a huge increase in hacked and breached data from sources that are increasingly common in the workplace, like mobile and IoT devices.read more
UK To Go On The Cyber Offensive
The UK Government is about to launch a new proactive and offensive cybersecurity team that will wage cyberwarfare against hostile nation-states and online crime organisations. It would be naive to believe that the UK has not launched cyberattacks against third parties, but the killing of Qassem Soleimani has brought this out into the open.read more
Are You Ready For Iranian Revenge Cyberattacks?
Following the killing of Qassem Suleimani no-one can be sure of what military action Iran will take, but experts agree that its cyberattacks will increase against countries and governments it sees as hostile.read more