10 ms·

The UK government started worrying about the same thing when Huawei won a bunch of BT 21CN contracts for network renewal. The chosen solution in that case was

by cbzbc 8y ago

The UK government started worrying about the same thing when Huawei won a bunch of BT 21CN contracts for network renewal. The chosen solution in that case was to set up a dedicated engineering facility onshore, where evaluation of the products could be performed at various levels before deployment. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2017 https://www.gov.uk/government/publications/huawei-cyber-secu...

ardy42 8y ago
> The chosen solution in that case was to set up a dedicated engineering facility onshore, where evaluation of the products could be performed at various levels before deployment. Honestly, that doesn't seem like a good plan. While such a lab is better than nothing, it doesn't protect the UK against attacks it didn't understand or think to look for. I'm reminded of this Soviet bug that was given to the American embassy in Moscow and lay undetected for seven years. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) The fact that the lab was created for Huawei tells me they're not trusted enough. The smart thing to do is to pick vendors you already trust not to bug you, and then do the extensive verification as an additional check.
- cbzbc 8y ago
  My description of what they did was not meant as an endorsement. That said; in an age where a large percentage of physical devices/device parts are made in China - protecting against attacks you don't understand or think to look for is a non trivial exercise and can't be avoided merely by changing vendor (though doing so may make an attack harder).
  - Lio 8y ago
    I think that's actually part of the problem. The choice by BT to go with Huawei for 21CN effectively killed off home grown Marconi products. BT saved a bit of money short term and Ben Verwaayen got his bonus but long term they are now dependant on products they can't really control where before they could pop down the road to Chelmsford and go and speak to the design team.

by cbzbc 8y ago

ardy42 8y ago

> The chosen solution in that case was to set up a dedicated engineering facility onshore, where evaluation of the products could be performed at various levels before deployment. Honestly, that doesn't seem like a good plan. While such a lab is better than nothing, it doesn't protect the UK against attacks it didn't understand or think to look for. I'm reminded of this Soviet bug that was given to the American embassy in Moscow and lay undetected for seven years. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) The fact that the lab was created for Huawei tells me they're not trusted enough. The smart thing to do is to pick vendors you already trust not to bug you, and then do the extensive verification as an additional check.

cbzbc 8y ago
My description of what they did was not meant as an endorsement. That said; in an age where a large percentage of physical devices/device parts are made in China - protecting against attacks you don't understand or think to look for is a non trivial exercise and can't be avoided merely by changing vendor (though doing so may make an attack harder).
- Lio 8y ago
  I think that's actually part of the problem. The choice by BT to go with Huawei for 21CN effectively killed off home grown Marconi products. BT saved a bit of money short term and Ben Verwaayen got his bonus but long term they are now dependant on products they can't really control where before they could pop down the road to Chelmsford and go and speak to the design team.