The latest annual report from the UK's Huawei Cyber Security Evaluation Centre (HCSEC) Oversight Board warns that no material progress has been made by Huawei to remedy issues reported in 2018. The Oversight Board said that it cannot change the level of assurance from 2018 or comment on potential future levels of assurance.
The Oversight Board also reports that further significant technical issues have been identified in Huawei's engineering processes, leading to new risks for UK telecoms networks. As a result, it can still only provide limited assurance that the long-term security risks can be managed in Huawei network equipment currently deployed in the UK.
UK operators Vodafone, EE and Three already work with Huawei on their mobile networks. They are awaiting the outcome of the official government review, due in March or April, that will decide whether they can use Huawei equipment on 5G networks.
The NCSEC Board advises that it will be difficult to risk-manage future products appropriately in the context of UK deployments until Huawei resolves the underlying defects in its software engineering and cyber security processes. It also said that it was not confident that Huawei can successfully complete the parts a transformation programme it has proposed to address these issues; and that it will need sustained evidence of improved cyber security and software engineering quality verified by HCSEC and the National Cyber Security Centre (NCSC).
Huawei noted in a statement that the report did not find that UK networks were more vulnerable than last year, and it started a group-wide programme in November 2018 to resolve the concerns about its software engineering capabilities. Huawei said it "understands these concerns and takes them very seriously" and will continue to work with UK operators and the NCSC to ensure implementation of the required improvements.
The company underlined that the HCSEC's report itself called the UK oversight process "arguably the toughest and most rigorous in the world". Huawei called on regulators, governments and the industry to work together on higher common standards for cybersecurity assurance and evaluation.
