US DoD And Huawei Officials Cross Swords At Cybersecurity Panel

  • The US Department of Defence official, Katie Arrington insisted that it had good reason to remove Huawei products from government use.

  • Huawei USA Chief Security Officer Andy Purdy however said the government was following a policy of "rip and replace."

  • The panel on stage were discussing supply chain security.


Things were tense at the RSA Conference in San Francisco on Wednesday, when a Huawei executive and US Department of Defense official got into a heated argument on stage. Katie Arrington, an official in charge of acquisition at the Defense Department, insisted that lawmakers and President Donald Trump had good reason to remove Huawei products from government use. Huawei USA Chief Security Officer Andy Purdy said the decision was the wrong approach.


Purdy said the government was tearing useful technology from the hands of government workers serving US citizens by following a policy of "rip and replace." He also said that the government can observe the manufacturing process more closely to build trust.


Arrington countered that removing Huawei technology from government use was the only option, "because the risk is so high." The US can't consider conveying control of sensitive information to another country, Arrington said, "end of story, period."


The panel on stage was discussing supply chain security, or the process of making sure security flaws don't get introduces into tech during the manufacturing process. There are countless ways bugs can wind up in your tech since phones, computers and other devices are made in overseas factories, overseen by complex contractors. The question of whether the bugs were put there on purpose, and by whom, can lead to an international relations crisis.


READ MORE: US turns up heat on Huawei with 23-count indictments


Moderating the panel was Craig Spiezle, a consultant at Agelight Advisory Group who focuses on increasing trust in tech and addressing ethics. Tech policy experts Bruce Schneier of the Harvard Kennedy School and Kathryn Waldron of the R Street Institute think tank was also on the stage.


Schneier said, until recently, the US government didn't mind that devices were insecure because its spy agencies were the best at using those vulnerabilities to gain intelligence. As other countries came to match the United States' ability to spy, the government has become more concerned with patching up flaws. That's going to decrease everyone's ability to spy, he said.



“Security will come at the expense of surveillance."

- Bruce Schneier, Tech Policy Expert, Harvard Kennedy School


Waldron said that Chinese tech companies are closely tied to the Chinese government and the US government's decision to ban Huawei tech has cemented that idea and the association can't be undone at this point.


"All countries are engaged in spying. I don't think that's a surprise to anyone."

- Kathryn Waldron, R Street Institute

The US has its history if putting vulnerable communication devices out into the world.  A recent report from the Washington Post detailed how the CIA secretly ran a cryptography company, selling machines with backdoors to governments around the world under the auspices of Crypto AG.


READ MORE: US charges Huawei with stealing trade secrets

Spotlight

Other News
Data Security

GuidePoint Security Announces Portfolio of Data Security Governance Services

GuidePoint Security | January 30, 2024

GuidePoint Security, a cybersecurity solutions leader enabling organizations to make smarter decisions and minimize risk, today announced the availability of its Data Security Governance services, which are designed to help customers address the challenges of unstructured data and data sprawl through a proven process and program to meet their unique needs. GuidePoint’s Data Security Governance services consist of policies, standards, and processes leveraging the newest technologies to meet organizations’ data governance goals in both on-prem and cloud environments. Once the right strategy is determined with the customer, GuidePoint Security consultants will review program requirements, assess current policies and controls, perform gap analysis, design and develop/enhance the program, recommend and implement supporting technologies, and create operational processes and metrics. “Whether an organization is just beginning to build their data security governance program or needs help assessing and improving an existing program, our team and service capabilities are built to meet them at their current maturity level,” said Scott Griswold, Practice Director - Security Governance Services, GuidePoint Security. “We work side by side with the customer to conduct the necessary data discovery in their environment and provide tailored recommendations for solutions and processes to ultimately build/improve upon the data security governance program.” GuidePoint’s Data Security Governance Services include: Sensitive Data Cataloging: For organizations just getting started in the process of protecting their sensitive data, GuidePoint offers Data Identification workshops to identify sensitive data types in the environment, including trade secrets, intellectual property, and sensitive business communications. Data Security Governance Program Assessment: For organizations with existing Data Security Governance or Data Protection programs, GuidePoint Security experts will assess the program to identify policy non-compliance, gaps in data protection requirements—whether legal, regulatory, contractual, or business—and program maturity levels. Data Security Governance Program Strategy Development: The GuidePoint team will work with an organization's key stakeholders to design a program strategy aligned with relevant requirements. The outputs of this effort include delivering ongoing sensitive data discovery, automated classification and labeling, the application of required sensitive data protections, restrictions on where sensitive data can be stored and sent, and data retention policy enforcement. Merger and Acquisition Data Identification: This offering provides the ability to identify sensitive data within an M&A target or recent acquisition (including locations, amounts, and access rights) and then perform penetration testing on the storage repositories where that sensitive data exists to determine the risk of data compromise. About GuidePoint Security GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions that minimize risk. Our experts act as your trusted advisor to understand your business and challenges, helping you through an evaluation of your cybersecurity posture and ecosystem to expose risks, optimize resources and implement best-fit solutions. GuidePoint’s unmatched expertise has enabled a third of Fortune 500 companies and more than half of the U.S. government cabinet-level agencies to improve their security posture and reduce risk. Learn more at www.guidepointsecurity.com.

Read More