Huawei Criticised for Potentially Compromising UK Infrastructure with Old Third-Party Software
Huawei is using software that will be unsupported from 2020, in hardware that will be used for years to come
Huawei is drawing ire in the UK over its use of third-party software in its products, which will come to end-of-life long before the hardware itself does.
As reported last month, the Oversight Board of the Huawei Cyber Security Evaluation Centre (HCSEC) - a company-funded body that examines and test Huawei products to be used by UK telcos - said that ‘security critical third-party software used in a variety of products' are not ‘subject to sufficient control'.
It added that Huawei hardware contains third-party software, including security-critical components, that will cease long-term support in 2020, even though the Huawei products in question will be in service for much longer.
The Oversight Board is a government organisation that publishes an annual report about HCSEC's work.
A Reuters report says that Huawei buys the software in question from Wind River Systems, based in the USA - where, ironically, the Chinese vendor has also been facing increased scrutinyover security concerns.
Three sources told Reuters that Wind River Systems is responsible for developing the VxWorks operating system, and that it will not receive security updates and patches past 2020. As British telecom operators will still be using the Huawei hardware with VxWorks at that point, their networks could become vulnerable to attack.
The sources did not suggest that the software itself is a security risk - only the upcoming lack of support.
A Wind River spokesperson told Reuters that the company often helps customers to upgrade to newer versions. A Huawei spokesperson said the vendor would address ‘any areas for improvement' that are raised by the British authorities (although the Oversight Board's report does not specifically mention VxWorks).
Huawei supplies equipment to UK telcos including BT and Vodafone.
Source: computing
Latest Jobs
-
- Contact 12 month- Security Operations- Crowdstrike Falcon Insight EDR / Analyst.
- United Kingdom
- Dependent on experience
-
Security Operations engineer / Analyst with Crowdstrike Falcon Insight EDR experience for a 12 month contract. Experienced Contractor with Crowdstrike Falcon Insight: Endpoint detection and Response (EDR) experience needed - 12 month rolling project. Implementation, configuration and Analyst experience needed with Crowdstrike Falcon Insight: (EDR) Migration project- relocating capability internationally. technically implementing, configuration of that that migration and then transition to BAU role monitoring. DCL Search exclusive associate Project.
-
- SailPoint Consultant
- London
- Upto £75,000 plus benefits
-
SailPoint Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying both IAM and PAM solutions and this consultant will form a key part of the IAM team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · Engage in the Identity & Access Management project to deliver SailPoint IdentityNow and Privileged Access Management · On-board applications and users into IAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify and SailPoint users Key experience required: Previous experience with SailPoint, including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- Centrify Consultant
- London
- Upto £75,000 plus benefits
-
A Privileged Access Management Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying a Centrify PAM solution,, this consultant will form a key part of the team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · On-board applications and users into PAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify users You would also gain expsoure with the IAM toolset as part of an Identity Access deployment. Key experience required: Previous experience with a PAM tool (Centrify would be an added bonus but not essential) including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- SOC team lead- Deputy SOC manager - Managed Security Services, Bradford. Exclusive
- Bradford
- £70,000 +
-
SOC team lead- Deputy SOC Manager - Managed Cyber Security Services, Bradford. Exclusive Identifier project. Technical team lead needed to join a Managed Cyber Security Services business. The role will be a hands on lead role and technical escalation point for the team. You will also be responsible for leading, mentoring, growing and developing the team. You will be the deputy SOC manager and be involved in the strategic growth of the capability. A managed security services background is essential, specifically within a managed security operations capability. Current hands on support experience across Firewall, SIEM, Incident Response is essential.