战略与国际研究中心-Issue-the-Executive-Order_46页_540kb

HUAWEI CYBER SECURITY EVALUATION CENTRE (HCSEC) OVERSIGHT BOARD ANNUAL REPORT 2019 SUMMARY

Core Content

The Huawei Cyber Security Evaluation Centre (HCSEC) Oversight Board Annual Report 2019 outlines the performance and findings of the Oversight Board over its fifth year of operation. The report is directed to the National Security Adviser of the United Kingdom and is based on the work of HCSEC, a facility in Banbury, Oxfordshire, operated by Huawei Technologies (UK) Co Ltd, a subsidiary of the Chinese-based Huawei Technologies Co Ltd, one of the world's largest telecommunications providers.

Main Highlights

1. Overview of HCSEC and Oversight Board

• HCSEC has been operational since November 2010 and provides security evaluations for products used in the UK telecommunications market.
• The Oversight Board, established in 2014, is chaired by Ciaran Martin, CEO of the National Cyber Security Centre (NCSC), and includes a senior executive from Huawei as Deputy Chair.
• The Board ensures independence, competence, and effectiveness of HCSEC and advises the National Security Adviser on the risk management of Huawei's involvement in UK critical networks.

2. Key Developments in 2018

• New secure premises for HCSEC were completed in November 2018, with no significant impact on operations.
• The NCSC Technical Competence Review confirmed that HCSEC's technical capability improved in 2018 and staff quality remained stable.
• A fifth independent audit of HCSEC's independence from Huawei HQ was conducted, with no high or medium priority findings, though a low-rated issue related to SLA compliance was noted.
• Technical issues in Huawei's engineering processes were identified, leading to increased risks in UK telecom networks.
• No material progress was made by Huawei in remediating previous issues, and the Oversight Board remains unconvinced of Huawei's ability to address long-term security risks.

3. Board's Key Conclusions

• HCSEC fulfilled its obligations in 2018 by providing security evaluations and assurance artefacts to the UK government and operators.
• However, concerning issues in Huawei's software development continue to be found, requiring ongoing management.
• The Oversight Board provides only limited assurance that long-term security risks from Huawei's equipment in the UK can be mitigated.
• Remediation efforts by Huawei have been deemed inadequate, and no credible plan has been presented to reduce the risk of using an old, third-party real-time operating system.
• The $2 billion transformation plan proposed by Huawei is not yet detailed enough to offer confidence in its ability to improve software engineering and cyber security processes.

Key Information

• Staffing: HCSEC staff increased to 38 by the end of 2018. Security clearances (DV) are required for all staff, and some candidates were removed due to clearance failures.
• Technical Work: In 2018, HCSEC completed 39 product evaluations and 3 solution evaluations, with one solution evaluation pending.
• Security Issues: HCSEC identified several hundred vulnerabilities in Huawei products, including stack overflows, denial of service flaws, logic errors, cryptographic weaknesses, and default credentials.
• Remediation Efforts: Huawei's remediation plans have been found inadequate, and no significant progress has been made in addressing underlying software engineering and cyber security issues.
• Future Concerns: The Oversight Board warns that without remediation of software engineering and cyber security processes, it will be difficult to manage risks for future Huawei products in the UK.

Summary of Findings

• HCSEC continues to perform technical evaluations and security assurance for Huawei products in the UK.
• The Oversight Board remains unconvinced of Huawei's ability to address long-term security risks.
• Limited assurance is provided due to ongoing technical issues and lack of progress in remediation.
• The new facility has been completed, enhancing evaluation capacity and security infrastructure.
• The $2 billion transformation plan is not yet sufficient to offer confidence in Huawei's ability to improve.

Conclusion

The Oversight Board's fifth annual report confirms that HCSEC remains effective in its role, but Huawei's software engineering and cyber security processes continue to pose significant risks to UK national security. The Board maintains limited assurance and emphasizes the need for Huawei to address these issues through transparent and effective remediation. Until then, the UK government will continue to monitor Huawei's activities closely.