It's almost nine years since Chinese networking and telecommunications giant Huawei entered into an agreement with the UK government to permit extensive security reviews of Huawei’s hardware and software—a move intended to allay fears that the company posed a security risk to the UK’s networks. Since then, the Huawei Cyber Security Evaluation Centre (HCSEC) has given UK officials a window into the company’s information security practices. And UK officials haven’t necessarily liked what they’ve seen.
In a report last week, the HCSEC Oversight Board, which comprised officials from the National Cyber Security Centre, GCHQ and other agencies, as well as a senior executive from Huawei, warned that Huawei had failed to make long-promised changes to its software development and engineering practices needed to improve security.
“HCSEC’s work has continued to identify concerning issues in Huawei’s approach to software development bringing significantly increased risk to UK operators,” board members noted. “No material progress” had been made in correcting those problems since they were noted last year.
In addition, audits and reviews by the HCSEC had found “further significant technical issues in Huawei’s engineering practices,” the board noted. While Huawei had promised to make major investments in correcting its problems and promising to invest $2 billion in security engineering improvements over five years, the board remained unconvinced based on their review:
At present, the board has not yet seen anything to give it confidence in Huawei’s capacity to successfully complete the elements of its transformation programme. The board will require sustained evidence of better software engineering and cybersecurity quality verified by HCSEC and NCSC. Overall, the board can only provide limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks can be sufficiently mitigated long-term.
The full oversight board report can be seen here.
Secure Working From Home During Coronavirus
In the wake of the coronavirus, many organisations internationally are allowing people to work from home to lessen the risk of contagion, but is this wise from a cybersecurity point of view? While companies generally have a cybersecurity policy in place that governs the use of anti-virus and firewall protection, individuals without any tech knowledge could fall foul of cybercriminals.read more
Crypto Miners, Targeted Ransomware Dominate the Threat Landscape
Twenty-eight per cent of all organisations worldwide were impacted by malicious multi-purpose botnets and targeted ransomware attacks rose by 20% according to Check Point Research, the Threat Intelligence and Research arm of Check Point Software.read more
Kaspersky's Top 7 Mobile Security Threats in 2020
Mobile device security threats are on the rise. In 2014, Kaspersky detected almost 3.5 million pieces of malware on more than 1 million user devices.read more
SEC Releases Guide To Combat Cybersecurity Threats
The Securities and Exchange Commission has released a guide to best practices to combat cybersecurity infractions, data loss and privacy breaches.read more