Huawei is facing fresh criticism after a UK government-led report found “serious vulnerabilities” in its 5G technology – but it’s not all doom and gloom for the Chinese telecommunications giant, a former British intelligence officer has said.
Yesterday a report carried out by the UK’s National Cyber Security Centre (NCSC), which is part of GCHQ, warned of the challenges of managing long-term security risks in its 5G tech deployed in the UK.
Go deeper with GlobalData
The Chinese firm provides telecoms technology for UK telecoms companies and is seen as a key player in the race to set up next-gen 5G networks in the UK, but it has faced repeated allegations of espionage because of its ties to the Chinese Communist Party.
No evidence has been provided of spying – and Huawei has strongly refuted the allegations – but that has not stopped the US from pressuring allies into rejecting Huawei.
Huawei report: Cybersecurity concerns, not espionage
Yesterday’s report will come as a big blow to Huawei’s attempts to shake off these allegations. But crucially, the NCSC criticisms were all technical, rather than political – it found no evidence of espionage in its review.
And despite the negative publicity, there are aspects of the report that Huawei can take some solace from, says former GCHQ officer Malcolm Taylor.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“I can’t see the Huawei leadership being best pleased, to say the least,” the now director cyber advisory at cybersecurity company ITC Secure told Verdict.
“But one interesting point here seems to be that the discussion has shifted somewhat, from one of alleged espionage to one of competence or, at best, willingness to address the issues raised in the original report by the UK.”
The 46-page report said that Huawei had made “no material progress” in remedying issues raised in its previous review, issued last year.
“That latter part is particularly tricky for a company with Huawei’s obvious technological capabilities; it is less and less acceptable to be not dealing with cybersecurity for anyone, never mind a company in this sector,” Taylor continued.
The Huawei report found a number of poor cybersecurity procedures, including source code flaws, “end-to-end integrity” and use of an old version of a third-party operating system, among others.
Poor software practices could “expose major security risks”
Echoing these concerns, Joseph Carson, chief security scientist at cybersecurity firm Thycotic, said the biggest problem for Huawei is the “continued poor software development practices and cybersecurity competence”.
More specifically, the major concern with the software development practices is “the failure with the build process and integrity validation, which exposes Huawei to potentially malicious code being introduced and updated into Huawei’s products,” said Carson.
He added that such security risks could be similar to that of the recent ASUS software update that inadvertently distributed malware across devices.
“This poor software development practice could expose major security risks, especially as it is being used for critical infrastructure.”
Ed Williams, EMEA director at cybersecurity firm Trustwave told Verdict that he welcomed the “level of rigour” shown by the NCSC.
“The NCSC is right to look at the fundamentals of the way their products are produced. If they don’t use a Secure Development Lifecycle (SDLC) then they will continue to produce products with low levels of assurance that leave the UK open to exploitation,” he said.
“Would any consumer drive a car or buy a product that isn’t deemed safe or doesn’t use tested components? It’s a similar analogy.”
Williams added that “it’s a common misconception” that an SDLC increases costs or engineering time. “In reality, with an SDLC, long term costs can be reduced along with engineering efforts, as best practice guidelines and libraries can be followed and used.”
“As we increasingly see elsewhere, good cybersecurity is a differentiator; companies win by being secure as well as proficient,” added Taylor.
UK decision to ban Huawei could go “either way”
The British government is expected to make a decision on whether or not to ban Huawei’s telecoms equipment by early April. Last month, the NCSC recommended that the Chinese tech giant should not be banned.
It reflects the UK’s risk management approach to what Taylor describes as a “complex issue”, and he sees yesterday’s report as “further vindication of that approach”.
At its core, the NCSC report has determined that Huawei needs to do more to satisfy the UK that it is addressing previously raised security vulnerabilities.
“Huawei will not have helped its case through failure to respond in the way a client requires,” says Taylor.
“But I do think Huawei will take a little satisfaction from the debate having shifted slightly away, for now at least, from espionage – this is in one sense a much more normal commercial situation and one Huawei can still choose to fix.
“It’s in their gift, and the decision about using Huawei can still go either way.”
Huawei: We take the concerns “very seriously”
In a statement, A Huawei spokesperson said that it takes the concerns raised in the report “very seriously” and pointed to a $2bn investment in enhancing its software engineering that was announced last November.
It stressed that the report does not “suggest that the UK networks are more vulnerable than last year”.
Taylor said that Huawei needs to “get to grips” with the issues raised in the previous report.
“If nothing else this is a commercial requirement; the UK is a Huawei client, and has required them to make these changes in order to maintain this relationship,” he said.
“Such commercial disputes arise frequently – just not always with this backdrop or publicity. I wouldn’t see it any differently, were it not for the publicity.”
Read more: Is Huawei too big to ban?
