2

IMHO, It is in Huawei's (and all other equipment manufacturer's) best interest to preclude \ prevent any party from remotely breaching security. All government actors monitor communications by compelling ISP & Telco's via force.

How can equipment manufacturer's provide assurances that intentional remote access vulnerabilities are not designed into systems for their native government?

  • Attacks always get better; they never get worse. – kelalaka Dec 9 '18 at 9:36
2

Providing fully verifiable security assurance is impossible with today's complex systems. Even if the full source code is offered for audit (which Huawei seems to offer) this might catch the obvious backdoors but it will not catch bugs that can lurk deep inside and which might also be used to provide backdoors into the system. And it will also not catch explicit or implicit (i.e. bugs) which were added in patches unless these patches are again audited - which is costly and time consuming. And this only covers software - there is also the hardware and firmware which is complex too and might also have explicit or implicit backdoors.

Still, providing the software and design documents for audit might actually add enough trust that the system does not have explicit backdoors. When doing common criteria evaluations it is common that the auditor has access to software and design documents - at least for the higher levels of certification like EAL4. Thus, while not being fully verifiable secure or formally verified it might be considered sufficiently secure for the purpose and the vendor might be considered trustable.

But of course, this means that not only the vendor has to offer all this access (many do) but that there is actually an interest in even considering the vendor as trustable. There are several factors which can play against this: political and economic factors but also the goal to reduce potential risks. The first ones should be clear, i.e. one can use trade restrictions as a political weapon and one can also want to favor local vendors against foreign vendors for economic reasons.

But reducing the risk is also relevant: one does not want to have a vendor with potential ties to or dependency on a political, economic and military foo to have control over sensitive or critical infrastructure. The vendor might be considered trustable now. But this might change if conflicts increase and in this case the foo has an advantage if it could control an essential part of your infrastructure - like the mobile network, communication equipment, electric power stations etc. This is especially true with vendors which are located in countries where it is likely that the government will lure or pressure the vendor to play in the states interest, i.e. China, Russia but also (as also the Snowden affair has shown) the USA and Israel (which has known tight connections between cyber-security companies and the military).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.