Huawei to America: You're not taking cyber-security seriously until you let China vouch for us
- Reference: 1627884903
- News link: https://www.theregister.co.uk/2021/08/02/huawei_security_advice_to_usa/
- Source link:
A [1]post from Huawei's CSO for the USA, Andy Purdy, rates President Biden's sweeping May 2021 [2]Executive Order on Improving the Nation's Cybersecurity as "the bare minimum that companies should be doing".
Purdy, a former White House adviser on cyber security, makes some decent points – especially when pointing out that the Executive Order is only binding on federal agencies and their private sector suppliers.
[3]
"For companies that don't do business with the government, they're simply guidelines," Purdy wrote. The CSO therefore called for the USA's Securities and Exchange Commission to force businesses to adopt sound security frameworks like that offered by the National Institute of Standards and Technology.
[4]
[5]
Purdy also called for robust public/private partnerships "on a global scale".
Which means – surprise! – chatting to China.
[6]
"The US and other countries must work together more closely and share information more openly than they do now," Purdy stated. "Governments and companies must also leverage the decades-long effort to develop norms of cyber conduct.
"This is an opportunity for the US to work collaboratively – not only with its G7 and the G20 partners, but with China and Russia and other countries – to build a more rules-based order for cyberspace that has requirements steeped in standards and best practices, transparency and conformance mechanisms, and meaningful accountability."
[7]Huawei says its latest flagship smartphones lack 5G, blames US sanctions
[8]UK.gov's Huawei watchdog says firm made 'no overall improvement' on firmware security but won't say why
[9]Australian government in talks to buy Pacific Islands' top telco
Fine words, but also words it's hard to imagine sparking action.
The USA and China already have a [10]mutual non-hacking pact but each nation regularly names the other as a source of hostile electronic attack. US President Biden has accused Russia of [11]doing far too little to curb the activity of ransomware gangs operating from its soil.
While Purdy mentioned the [12]UN's Group of Governmental Experts on Advancing Responsible State Behaviour in the Context of International Security as an effort that could stop nation-state cyber-skirmishes if only big nations signed up, major powers aren't exactly enthusiastic participants in its development. They have also avoided engaging with similar entities like the [13]Global Commission on the Stability of Cyberspace .
[14]
Why is Purdy tilting at diplomatic cyber-windmills? The following extract from his piece may explain why:
It would be a major step forward if governments and global companies would subject themselves to auditable testing and verification processes for critical components and legal processes in the countries with whom mutual trust agreements are signed.
To The Register 's mind, that's Huawei arguing that if the USA and China had better infosec agreements, China would vouch for Huawei and the USA could therefore shop with confidence.
Which sounds great in theory, but also naïve – we know the USA [15]targeted Cisco and Juniper devices to improve its intelligence prospects. And once the USA, or any other nation, knew the rules, they'd also know how to step around them. ®
Get our [16]Tech Resources
[1] https://huaweihub.com.au/the-u-s-needs-a-stronger-commitment-to-cybersecurity/
[2] https://www.theregister.com/2021/05/17/in_brief_security/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQfCXqNPwYYeeG8pI@Pg9gAAAII&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQfCXqNPwYYeeG8pI@Pg9gAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQfCXqNPwYYeeG8pI@Pg9gAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQfCXqNPwYYeeG8pI@Pg9gAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/07/29/huawei_announces_its_latest_flagship/
[8] https://www.theregister.com/2021/07/20/huawei_hcsec_oversight_report_muted_criticism/
[9] https://www.theregister.com/2021/07/20/telstra_government_funded_digicel_purchase/
[10] https://www.theregister.com/2015/09/25/us_china_promise_to_stop_hacking/
[11] https://www.theregister.com/2021/06/17/biden_putin_summit_cybersecurity_discussion/
[12] https://www.theregister.com/2021/06/11/uk_ungge_cyber_norms_submission/
[13] https://www.theregister.com/2018/03/22/global_commission_on_the_stability_of_cyberspace/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQfCXqNPwYYeeG8pI@Pg9gAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2016/08/17/cisco_two_shadow_brokers_vulnerabilities_real/
[16] https://whitepapers.theregister.com/
"The US knows China is the major threat to it's flaky technical and economic dominance of the world"..
"It is hopelessly praying that sanctions and no trade rules will hold China back."
"However, the crumbling stable door fell of a long time ago as no-one took care of the bolt.."
Wasn't it the horse that bolted?
Wasn't it the horse that bolted?
Re: Wasn't it the horse that bolted?
If the doors and bolt were Chinese, likely the horse bolted with leaving the bolt intact...
"once the USA [..] knew the rules"
The US only has one rule : USA first and everyone else is fair game.
Share information more openly ? The US will readily agree - to recieve shared information. Giving it out ? No so much.
Trust China to vouch for Huawei ? Okay, not even I would trust that one, but hey, why should the US do so ? It knows very well what the NSA can do and there's no reason China shouldn't be doing the same.
Contrary to the US Government - which can't seem to get a grip on its super spy agency, China's government will have no trouble keeping its spy agency on a tight leash - which will tighten even more if there is something China's rulers don't like.
Evolutionary dead-end
As the saying goes, a cyber attacker only has to be successful once whereas people trying to defend against attacks have to be successful every time. As more and more countries become dependent on their IT infrastructure just to function as countries, more and more countries become vulnerable to Keystone-like events (and worse). Consequently, the appetite for mutual non-cyberaggression pacts will increase (with pacts covering both active attacks and passive attacks in the sense of letting ransomware gangs use the own territory as an operating base).
The hard part is to figure out who to negotiate with ... it won't be enough to assemble the big powers round the table in a recap of 80s nuclear disarmament talks
Icon because the overall geostrategic situation is surprisingly similar.
Do not trust China. China is asshole.
Same old
It's like a Soviet Union company saying that you are only safe if apparatchiks vouch for you.
The US sees China as a major threat to it's apparent technical snd economic dominance of the world, it wants and hopes that sanctions and no trade rules will hold China back.
However, they seem to have only just realisrd there is a stable door and that it has a bolt on it.