US DoD Comments on Huawei, Hikvision, Dahua Cyber Security Concerns

Harnessing Tech for Military Purposes

The final concern Schriver raised is of China potentially integrating these cyber capabilities "into military plans and contingency plans", hence the importance of "understanding better how the Chinese may use cyber in their own future war fight".

though Schriver seems to say as well that the U.S. strategy is similar:

...as I said in the previous comment if you if you really want to understand pillar one of the national defense strategy, pillar one of our Indo Pacific strategy, increasing the lethality of our force, look at where we're going to make investments for the future, where we're doing research and development, but where we're trying to acquire capabilities as quickly as we can and cyber is at the top of that list.

Once we acquire the greater capability, and also ourselves, we need to think about how it integrates into contingency planning. [Emphasis and commas added]

IPVM is so political. I mean it's not like politics relates to security. *wink* *wink*

Of course...

If we know we would do it in the time of war we have to assume that our enemies would as well. It is a smart move to protect your home land. Just ask China, they have effectively banned foreign tech products as well.

The US SIA has provided a response to IPVM on the DoD's quote:

SIA trusts the U.S. government to make decisions (based on information available to U.S. intelligence and homeland security agencies) that will protect its networks from cyber-attacks. SIA also strongly supports efforts by federal agencies to protect supply chains. In fact, SIA supported the enactment last year of the Federal Acquisition Supply Chain Security Act of 2018.

This law, which I recommend IPVM review, created the Federal Acquisition Security Council. Criteria and procedures will be established for recommending exclusion from agency procurements and the removal of software and equipment from agency information systems when it determines that those items present a supply chain risk regardless of the source. The law permits any federal agency to exclude an item from procurement where it determines that the item poses a significant supply chain risk. We expect the implementing rules to be published by the end of the year.

Cybersecurity - Technical Only or Foreign Control?

Defiantly both

of course, for our trusted allies, cyber security cooperation is to be expected ;)

Russia says it is starting to resume U.S. cyber cooperation: TASS

Politics and business should stay well apart, I know this is easier sad than done.

If security is a concern for China products, i would wonder about the implementation of the system, I run a large network of cameras from China, to ensure that there is no chance of hacking or unauthorized access the whole network is completely isolated from the internet on its own private fibre network. Simple solution if it is not plugged into public networks it cant be hacked.

Why is nobody asking why the network security is not up to scratch, like routers and access points? or at a basic level of has the equipment been installed properly.

Politicians hand pick scenarios that they can manipulate, banning a product that was used by a government that has abused human rights leaves the field wide open for many products, knowingly or unknowingly.

simple example, does the rest of the world ban the CCTV systems that were used at

Guantanamo Bay detention camp or in the Gaza strip?

All i know for certain is that when politics gets involved with business then business is on the losing end and so are the consumers.

Security installers should disclose risks to clients, in reality any device connected to a public network could be hacked, this is not limited to Chinese products. If my client understands the risk they can make an informed decision whether to have their system on a public or private network.

Any system connected to the public networks can be hacked.

If remote viewing is enabled, be it via a dedicated IP and ports opened on the firewall, or via a cloud host that keeps ports open for the remote user, this allows a bad actor to access the system and load firmware that compromises the system.

VPN technology can resolve this in most cases, but there are workarounds known to the hacker community (and if not by them, to governments) for VPN solutions.

However, in the majority of cases it comes down to the humans that operate these networks. We find this to be the biggest vulnerability, and the hardest to control.

Once the camera or NVR/DVR is compromised, the hacker has root privilege's with admin access on your network, with a working Linux (or other) device to which he can send very damaging commands.

If for no other purpose, this access to your network can be used to observe the workings of secured areas, such a laboratories, industrial plants, water treatment facilities, utility installations, cell towers, and more.