SIA And USA National Security Threat Hikvision Co-Present Cybersecurity

The US Security Industry Association worked with US national security threat Hikvision on a cybersecurity webinar. After questioning by IPVM, SIA canceled the webinar and refused to comment on the record.

In this note, we examine the effort, what Hikvision is intending to accomplish and why this undermines US national security efforts.

Webinar

The SIA webinar advocated the adoption of a zero trust strategy and was being presented by Chuck Davis, senior director of cybersecurity, Hikvision, and Michael Kim, vice president, Imperial Capital. Caption from the archived SIA link:

See IPVM's report: Zero Trust and Video Surveillance for a backgrounder on this topic.

The webinar was promoted by Hikvision's director, as shown below:

Canceled

The webinar is now canceled and the webpage, like SIA's sense of national security, says it "doesn't seem to exist":

SIA Refuses Comment

SIA CEO Don Erickson refused to comment on the record and his unilateral, not agreed to, off-the-record statement avoided addressing why SIA choose to have this webinar and promoted it, in the first place.

Hikvision As National Security Threat

The timing of this event was particularly interesting as the FCC just passed a plan to ban Hikvision as the US government has deemed Hikvision a national security threat emphasizing that "network security is national security". See: FCC Explains Why They Plan To Ban Dahua And Hikvision.

Tactic - Don't Trust Anything, Not Just Us

If no one can or should be trusted, then Hikvision should be treated the same as any other company, is the implication here, even though Hikvision declined to comment. Hikvision's marketing of zero trust counters the lack of trust the US government has in Hikvision, specifically, as an entity created and controlled by the PRC government.

While zero trust, as a philosophy and aspiration, is a positive for security, it is not a solution to not being able to trust specific entities. Zero trust is difficult to effectively implement and maintain. Moreover, even if one does implement it, one would still need to be able to trust that their specific providers (like Hikvision) did not abuse their access, especially as cloud-controlled offerings grow, to their devices and the recorded surveillance and information they contain.

SIA Avoids Responsibility

SIA avoided responsibility by failing to address why they choose to hold this webinar. If SIA believes, contrary to the US government, that Hikvision is not a national security threat, they should declare and provide their reasons why. Otherwise, SIA should have the good sense to not provide legitimacy to Hikvision in Hikvision's attempt to surreptitiously and, without public evidence, counter the US government's efforts to ensure national security.

Otherwise, SIA risks further exacerbating the zero trust that many in the industry have for the organization.