Cyber Security and Privacy Protection-Courseware-20210907

PACD Basic Knowledge Course
Overview of Cyber Security and Privacy Protection
Public Affairs and Communications Dept

June 2021
1 Huawei Confidential
Contents
1. Why – Importance of cyber security and privacy protection

2. What – Essence of cyber security; PACD's role and objectives
3. How – PACD's plan for communications about cyber security

3.1 Global public action plan map
3.2 Country-specific insights
3.3 Key stakeholder management
4. How – PACD's practices for communications about cyber security

4.1 Confident communications
4.2 Trust building
4.3 Knowledge map
5. Overview of privacy protection
Huawei Confidential 2
More emphasis on cyber security
Cyber security is no longer just a technical issue, but a legal and political as
well. We must address the political risk and legal consequences caused by
cyber security issues which could lead to harm the company.
Cyber security issues may create customer concerns about Huawei products
and solutions, affecting sales. We need to ensure customer trust in Huawei's
security, address their concerns, and remove sales barriers.
Cyber security issues are becoming more complex in the new era, presenting
more complex challenges. There is an increasing need for public and private
partnerships. Huawei is engaging governments more broadly on the topic of
cyber security.
Cyber security and privacy protection trends in the new era
There are huge differences

EU, US, Russia, and China work
between developed and
Polarized Closer ties more closely on cyber security
developing countries in terms
through dialogs and cooperation,
of their cyber security between
spanning cyber security law
concerns, goals, and technical countries enforcement, security assurance,
capabilities.
etc.
More and more governments
are putting cyber security on
its national strategic agenda Regulators and law makers in
and taking stronger controls US, EU, UK, France, and
Politicized New tech
through legislation and Title concerns
Australia shifting focus to critical
information infrastructure (CII)
executive orders.
and new tech such as IoT, AI, and
With the development of 5G, big data
IoT, and other new More complex political
technologies and vertical environments and stricter data
industries, the notion of cyber privacy regulation: More
security has been broadened countries are introducing GDPR-
Data like regulations to ensure
to "broad security", covering Broad-based
national, social, and protection adequate protection with cross-
infrastructure security, as well border data transfers. For the
as personal safety. Meanwhile, consideration of national
state sovereignty also extends sovereignty, more countries
into the realm of digital require that national security
sovereignty . related data be localized.
US containment of Huawei's 5G: Painting Huawei as a security threat through
political and diplomatic actions
The US government's The US's actions
views on Huawei against Huawei
Diplomacy
Congress and the rest of the Ongoing attacks in all aspects
strategy
government share the same
Energy Defense worldviews and hold a consistent 1. Strategy: Included Huawei on
strategy strategy attitude towards Huawei. national security agenda
2. Politics: Pressed allies to
1. Huawei equals China. exclude Huawei (the key goals
2. The rise of China is a threat to
Cyber National national security of the US.
of local embassies and military
Military bases)
security security strategy 3. Both the Chinese government 3. Legislation: Abused legal
strategy and its companies wish to
strategy procedures
dominate the world by 2049. 4. Economy: Excluded Huawei
from its supply chain
Note: Michael Pillsbury's book – The 5. Technology: Blocked the
Strategy Other
Hundred-Year Marathon: China's Secret inflow of innovation elements
promotion strategies
Strategy to Replace America as the Global 6. Reputation: Defamed Huawei
Technology Superpower – reveals the worldviews of in terms of business ethics and
development most members of the Congress. legitimacy
strategy
Geopolitics and 5G: Tougher external environment and mounting security
challenges
• Mar 26, 2019: European Commission released its "Recommendation •
South Korea
The Ministry of Information and Communication has • Nov 2019: The Globe and Mail reported
EU on Cybersecurity of 5G networks" had substantial interference in 5G projects. SKT and that the federal government said it would
• Mar 12, 2019: European Parliament passed the European KT have excluded Huawei from the 5G vendor list. not rule out barring Huawei from supplying
Cybersecurity Act, establishing an EU framework for cybersecurity
equipment for Canada's next-gen 5G
certification • Dec 2019: Ministry of Internal Affairs and Canada mobile networks
Denmark • Mar 2019: TDC picked Ericsson over Huawei for its 5G network and Communications essentially banned the government • Dec 2019: Trudeau Government again
will replace Huawei's 4G network with Ericsson's equipment from purchasing telecom products from Chinese dismissed US security warnings against
Japan
vendors using Huawei equipment in Canada's next-
• Chairman of the Norwegian Communications Authority (Nkom) said • Mar 29, 2019: Chief Cabinet Secretary: "We will not gen wireless networks
Norway whether or not to ban Huawei like its allies was a political issue require that specific countries and enterprises be • Mar 2020: US-Canada trade tensions
excluded from the next-gen 5G technology" intensified
• Closely monitors Huawei's improvements on the problems identified in

the last OB report and requires Huawei to provide proof of progress Vietnam • Negative media coverage circulates, but the • Jul 2018: US and its allies agreed to
• Dec 2019: BT excluded Huawei from 5G core government has not made any statement contain Huawei at a Five Eyes meeting
UK • Mar 28, 2019: 2019 OB report released • Aug 2018: Trump signed the National
• Sep 27: Government invited Huawei to be a part of Defense Authorization Act which prohibited
US
India's 5G trials US government agencies from purchasing
India
• Cellular Operators Association of India endorsed Huawei equipment
• Nov 2019: Bonn Security Innovation Lab (in cooperation with BSI) Huawei • Oct 2018: Two US senators urged the
opened Canadian Prime Minister to bar Huawei
Germany • BMI/BSI believes that it is not an appropriate protection mechanism to • Aug 2019: Government banned Huawei from 5G from Canada's 5G networks
bar some vendors from the public network infrastructure Australia • Mar 2019: New ambassador to China appointed; • Feb 2019: US Vice President and
• Mar 2019: Angela Merkel postponed the Huawei ban (which would AUD$44 million invested to establish the National Secretary of State called on its European
otherwise prohibit Chinese companies from providing equipment for Foundation for Australia-China Relations that replaces allies to ban Huawei
Germany's 5G networks) the long-standing Australia-China Relations Council • At 2019 MWC: The Federal
• Mar 7, 2019: BNetzA announced that it would update the catalog of Communications Commission (FCC)
security requirements for telecom operators delegation called for exclusion of Huawei
• Nov 2018: GCSB rejected Spark's proposal to use
Huawei's 5G equipment from 5G networks
• Feb 2019: New Zealand said China's Huawei was
• ANSSI tightened up 5G test on Huawei and planned to conduct
France not excluded from 5G, and GCSB began to
security certification for 5G systems to be commercially used in
New Zealand communicate with Spark about the security risk
France
control mechanism for 5G
• Dec 2018: Czech cyber watchdog NCISA warned network operators • Apr 1, 2019: New Zealand's PM Jacinda Ardern
against using products made by Chinese telecom equipment stated her position in an interview with China
Czech
suppliers Huawei and ZTE Central Television during her visit to China. The
• Dec 21: Czech National Security Council issued a statement visit also led to an upgrade in bilateral trade
correcting the false warnings against Huawei relations with China
Contents



4.2 Trust building
4.3 Knowledge map
Huawei's cyber security vs. baseline of industry-standard cyber security
In the industry, cyber security is understood as carrying and protecting data/privacy with robust
networks and defending against hacking. Huawei extends cyber security baseline to cover evidences
proving that we are not a security threat
Business continuity
Exploiting vulnerabilities and network Suspected of exploiting "backdoors"
Hackers Huawei
robustness
Confidentiality Data/User Political aspect: dispel doubt
Integrity privacy Legal aspect: prove Huawei is not a security threat
Availability
Traceability
Counterattack
Industry-standard cyber security Prove that Huawei is not a security threat
Huawei's cyber security

Cyber security refers to the practices designed to protect products, solutions, and services against cyber attacks to ensure data availability, integrity,
confidentiality, traceability. This includes protecting user communications, personal data, privacy, and flow of public information.
Achieving cyber security will:
1) Protect Huawei and its customers' reputation and prevent economic losses;
2) Exempt a doer or Huawei from undertaking civil, administrative or criminal liabilities;
3) Prevent cyber risks from being an excuse for trade protectionism or a trigger for international political crisis.
Cyber security milestones at Huawei
Providing trustworthy
products and solutions to
E2E security assurance help customers build
system resilient networks
• Made cyber security Huawei's top
• Issued Mr. Ren's Statement on
priority
Establishing a Global Cyber
Security Assurance System • Released Mr. Ren's open letter to all
Product security Security mgmt in Huawei employees: Comprehensively
• Established the Global Cyber
& solution R&D processes Enhancing Software Engineering
Security and User Privacy
Capabilities and Practices to Build
security • Established the Network Protection Committee (GSPC)
Trustworthy, Quality Products
Security Engineering • Appointed the Global Cyber
• Released 1st batch of • Opened the Huawei Cyber Security
Technology Committee Security Officer (GCSO)
security technical Transparency Centre in Brussels
to build security into
specifications. Started to • Established the Internal Cyber
focus on product security.
R&D • Initiated the software engineering
Security Lab (ICSL)
transformation program
• Established the Network • Released the CERT process
Security Solution Dept
• Built the E2E security assurance
under R&D to design
system, incl. strategies, policies,
security solutions.
processes, baseline, etc.
1999–2005 2006–2009 2010–2017 2018–
Cyber Security 2.0: Security as part of our business competitiveness to create
value for customers
Comply with laws and regulations. Lead standards development and increase trust. Translate
security into a core competitive advantage of Huawei products, solutions, and services.
Cyber Security 1.0 (reactive) Cyber Security 2.0 (proactive)
Building basic quality and Proactively creating and sharing
ensuring Huawei is secure value
Compliance Business value
End-to-end security and

Solution competitiveness
quality
Product security design,

development, and Solution resilience
deployment
Management- and control- Capability-based

based governance model governance model
Value to customers: We share the same goal as our customers, which is to build cyber security
and resilience, address cyber security risks, and ultimately contribute to a fully
connected, intelligent, and secure world.
Huawei's Cyber Security Framework 2.0: Helping customers build
network resilience by using trustworthy and independently verified
products and solutions
Help customers build network resilience

Governance, Risk, and Audits
A holistic approach
Trustworthy products/solutions with network resilience • Top down
• Bottom up
Customer requirements and insights
Customer value and communication

Security management Security control Security analysis • E2E
the media, supply chain partners, etc.

platform platform platform
Customers, governments,
Resilience & trustworthiness
Customers, governments
technology, industry,
supply chain, etc.
5G Cloud IoT Video Safe city Device • NIST CSF IPDRR and BSI trustworthy
Ecosystem software model
service
partners • Invest US$2 bn to improve software
engineering capabilities
… Collaboration
Wireless Switch Transmission Server Storage Smartphone … • Work with the best partners to deliver the
most comprehensive security solutions
Basic quality, engineering, and technology and services
• Strengthen cooperation and trust with key
Culture, organization, and talent external stakeholders
Compliance
PACD's objectives, role, and responsibilities in cyber security
Objectives: Gain the trust in countries; partner with Responsibilities of the PACD GA CSPP team
governments and industries to explore new ways to tackle • Planning: Generates insights into CSPP trends in key
security risks posed by new technologies; identify countries and regions; develops PACD's annual plans on
discriminatory provisions/hidden rules; remove sales the CSPP topic.
barriers; and support business growth. • Policy: Develops Huawei policies, position papers,
presentations, and other documents on CSPP for
government stakeholders; helps local teams develop
solutions for trust around CSPP with their government
Role: PACD is the owner for managing relationships with stakeholders.
the media and governments, including government- • Ecosystem: Engages with standards organizations,
backed industry organizations. We need to win industry associations, think tanks, etc. Makes them an
government and media's trust in Huawei's cyber security and effective alliance to influence policy on CSPP and
privacy protection. catalyzes consensus between Huawei, governments, and
the broader industry.
• Public opinion: Develops messaging materials for the
Responsibilities: Manage PR risks, earn government trust, media on CSPP, including text, videos, and websites.
build a positive image, and establish competitive advantages. Actively promotes Huawei's messages at international
Take responsibilities for the results of business forums and in the media, proactively presenting a positive
environment improvement for rep offices. image of Huawei on the CSPP issue.
Three aspects of PACD's role: (1) gaining insights into policy • Crisis communications: Develops messages for crisis
environments (similar to Marketing roles); (2) managing communications for governments and the media, and
stakeholder relationships (similar to account manager roles); coordinates with other departments on strategies to control
(3) managing solutions (similar to solution manager roles). the spreading and escalation of crises.
Contents



4.2 Trust building
4.3 Knowledge map
Country classification Country-specific insights Stakeholder mgmt
Global public relations action plan map
Country PR Goal Owner

First priority: tier-1 Addressing
countries that are UK, France, Germany, Japan/South Western political
Led by PACD
more challenging but Korea, Canada, US, EU, China and public
more crucial opinion issues
West Europe: Italy, Spain

Northeastern Europe: Turkey, Poland
Eurasia: Russia
Second priority: tier- Middle East: Saudi Arabia, UAE, Pakistan Fostering the
2 countries that have Northern Africa: Egypt business Led by regions with support from
regional influence Southern Africa: South Africa, Nigeria, environment • Subsidiary BODs
and are major Kenya, Zambia and supporting • PACD (training, etc.)
sources of revenue Southeast Asia: India, Thailand sales
South Pacific: Indonesia, Philippines,
Malaysia
Latin America: Brazil, Mexico
Third priority: tier-3 Internal and

Profit-making countries in Asia Pacific, Latin Led by subsidiary BODs
countries that are external
America, Middle East, Africa, Latin America, Supported by PACD, including providing
also big sources of compliance and
Europe, and Eurasia training
revenue sales support
PACD's key tasks regarding cyber security
Cyber security goals in the next 3–5 years

Cyber security goals in the next 12–18 months
Assessment and
Maintenance and
preparation Execution and monitoring
enhancement
1. External environment
insights
Y
① Local govt's strategic
requirements and concerns
② Local cyber security
maturity level 3. Develop a 6. Maintain customer
5. Develop a comms relationships
comms strategy 4. Determine
plan and content ① Clarify customer requirements
(obtain AT/ST comms objectives
①The plan should include by customer segment and meet
N approval) ① Stakeholder their requirements wherever
comms time, audiences,
① map possible.
2. Internal cyber security key steps, and expected ② Establish a customer
insights Proactive/reactive ② Stakeholders' relationship database and maintain
outcomes.
① Does Huawei meet local response attitude towards good customer relations.
② Comms content should ③ Fully communicate with
strategic requirements? ② Local or global Huawei
include KMs. customers to avoid
② Is cyber security an communication misunderstanding.
advantage or disadvantage
for Huawei in the country? Y
Externally: Be competent to communicate on cyber security matters and build trust

Internally: Improve awareness and support employee competence
Insights into the external environment: Political sensitivity of the

government of your country with Cyber security
Item for assessment Description
1. Which departments are concerned with cyber security? What are they concerned about?
2. Does the government of your country conduct auditing, inquiry, or investigation on cyber security of companies?
Government concerns over 3. Is the government of your country part of a cross-nation political coalition that might have impact on cyber security?
cyber security 4. Has the government raised concerns over Huawei or has Huawei been involved in any crisis?
5. Does the opposition party use cyber security as a leverage and potentially impact Huawei?
6. Do candidates running for new government positions use cyber security as a leverage and potentially impact Huawei?
1. Do customers change their requirements on cyber security during bidding and communication? What are the concerns?
Customer concerns over cyber
2. Do customers audit or plan to audit suppliers' cyber security?
security
3. How do local tier-1 carriers cooperate with the government on cyber security?
1. Do leading local media outlets comment on cyber security? What do they focus on and what is the tone? Are there negative
Media climate
comments on Huawei in terms of cyber security? Please give examples.
1. Do local industry organizations have standards, forums, or proposals concerning cyber security?
2. How much influence can industry organizations exert on customers, the government, and media? Please give examples.
Industry organizations, think
3. Are there cyber security evaluation organizations urging the government and customers to create barriers against Huawei?
tanks, KOLs
4. Are local think tanks and opinion leaders concerned about cyber security? What are their concerns? What is their attitude
towards Huawei?
1. What actions are competitors taking in terms of cyber security?
Competitors
2. Is there any local (country/region) competitor facing operational difficulties and exerting influence on the government?
1. Do local values conflict with Western values?

2. Is there trade protectionism?
Political environment
3. Does the government of your country have political or military conflicts and disputes with China?
4. Is there any hot issue concerning cyber security locally?
Insights into the external environment: Cyber security maturity of the

government of your country
01 02 03 04 05 06 07
Strategy Organization Policy Law Methodologies Technical International
& Measures strength cooperation
Has your Does your Has your Has your country Has your How much has Has your country
country or country or country or or organization country or your country or or organization
organization organization organization passed a law on organization organization maintained open
established a have a developed a cyber security? Is identified risks invested in dialogues,
cyber security dedicated team policy on cyber it effectively and taken technology and communications,
strategy? Is it of responsible for security? What enforced? necessary capacity and collaboration
strategic cyber security? content is methodologies building? globally or with
importance? Who do they included in this or measures? external
report to? policy? organizations?
Insights into the external cyber security environment: Legislation,

competitors, industry, and the media
 Insight into government

How sensitive is the government in your host country to cyber security? What about local cyber security
maturity? Are there any discriminatory provisions against Huawei?
 Insight into competitors

What are the goals regarding cyber security and privacy of the competitors in your country? What measures
have they taken? How do they influence public opinion?
 Insight into the industry

In which areas are Huawei's cyber security and privacy practices receiving the most attention or facing the
biggest challenges in your country?
 Insight into public opinion

What are the public perceptions of Huawei and its competitors in terms of cyber security and privacy in your
country? What are your next steps to improve public perceptions of Huawei?
Insights into the internal Cyber security environment: Status quo of

local business, requirements, and future development
Business Purpose Description
Identify and analyze opportunities Penetration rate and user base: mobile, fixed-line, MBB, and FBB
Identify high-value customers Market share, revenue, and financial condition of major carriers
Status quo of the ICT industry
in the country
Identify product lines with high Development of major technologies: wireless and wired networks and
growth potential transmission
ICT market size and trends in 5–10 years (Carrier BG, Enterprise BG, and
Where do opportunities lie
Consumer BG)
Huawei's presence in the local The current market share and the Carrier, Consumer, Enterprise BGs: size, market share, investment,
market target market share competitors, and Huawei's position
Setting cyber security and privacy goals at the regional/national level

based on internal and external insights and business goals and gaps
Goal
Effectively communicate to build advantages or remove barriers
Support
External: Government attitude and Internal: Impacts of cyber security on business

Insight
preparedness development
(1) Proactive or reactive communications?

Methodologies Decision-making (2) Local or global communications?
Y N
Implementation Develop and execute strategy Continue to monitor the policy environment
WHO: Identify stakeholders, create a stakeholder map, and identify key roles
Develop
Manage and Build
Identify
stakeholder implement mutual
stakeholders
relationships communica trust
tion plans
Key stakeholders
• Cabinet, parliament, congress, federal government, state

Government governments, ministry of the interior, legislature
and legislature
• Law enforcement agencies, ruling coalition leaders, powerful sectors
• Carriers (private/government-owned), named accounts/channels of
Customers enterprise business
• Consumers
• Industry associations, mainstream media, trade media, certification

Other third bodies, standards organizations
parties
• Think tanks, academia, government advisors, partners
Best practice sharing: Cyber security stakeholder relationship

management in Germany
Comments:
 Summary: Build robust customer relationships through systematic
planning; work with the government to jointly explore how to
collaborate to alleviate concerns; translate customer relationships
into real productivity.
 Systematically review customer organization structure to identify key
stakeholders in cyber security and privacy protection.
 Analyze relevant rules and identify the stakeholders based on project
and compliance requirements. Then develop a feasible customer
communication plan.
 Ensure that the plan is well executed; establish a regular communication
mechanism; build trust on an ongoing basis to support business growth.
Contents



4.2 Trust building
4.3 Knowledge map
Confident
Trust building Knowledge map
communications
Goals and strategies for cyber security communications: Addressing customer

concerns to build foundations for trust and execute a comprehensive strategy of
defense and challenge
How does the US shape the policy
PACD's key tasks for 2021
environment around security
Alleviate
Stage 1: Thoughts and concepts Public
opinion 1. Create a climate for rational discussion
Influence Security concerns
Sway public opinion pressure
• Conflate different concepts and hype the
public
and development • Build a security ecosystem, communicate with target
opinion audiences, and create a de-politicized and rational climate.
security and privacy risks of 5G requirements of the
• Create rules to exclude "untrusted" local government
suppliers at the Prague 5G Security
Conference
• Department of State's Clean Path Alleviate
statement political
pressure 2. Establish a mutual trust mechanism
• Push for regional organizations and countries to sign mutual
Phase 2: Consensus and norms Political trust agreements to mitigate political pressure.
pressure
Bilateral/Multilateral agreements and joint
statements
• MoUs/joint statements on 5G security
• Joint statement on Clean Network Carrier decisions
Alleviate
3. Advocate non-discriminatory standards
policy
pressure • Increase investment in countries where conditions are
Phase 3: Policies and regulations
favorable; promote NESAS/SCAS as global cyber security
Push for national legislation around standards; establish and maintain strong foundations for
security Legislative trust and support.
• Spectrum auction conditions restrictions
• 5G supplier risk management
• Removal of Chinese suppliers from key
networks
24 Huawei Confidential
Confident
communications
WHAT (1): Cyber security is not just a crucial corporate strategy; it is the
company's top priority
"Building and fully implementing a global, end-to-end cyber security assurance system will be one of Huawei's
crucial strategies…Huawei will work with governments, customers, and industry partners in an open and
transparent manner to tackle cyber security challenges...In addition, Huawei guarantees that its commitment to
cyber security will never be outweighed by commercial interests."
—Statement on Establishing a Global Cyber Security Assurance System
As a company, cyber security and privacy protection are our top priorities. We are committed to building
trust and high quality into every ICT infrastructure product and solution we develop.
—An open letter to all Huawei employees
Over the past 30 years, Huawei's products have been used in more than 170 countries and regions, serving more than 3 billion users in
total. We have maintained a solid track record in security. Huawei is an independent business organization. When it comes to cyber
security and privacy protection, we are committed to siding with our customers. We will never harm any nation or any individual.
Confident
communications
WHAT (2): An E2E cyber security assurance system that covers

everything we do at Huawei
Legal & regulatory BCG signing rate: Trustworthiness ABC: Assume nothing,
Security as a top 100%
Best practices compliance US$750 million Believe nobody, Check
priority
Accountability system US$2 bn for everything
enhancing software
GSPC 800+ legal experts Key position "Many hands and many
Security-by-design engineering
management eyes"
capabilities
Strategy,
Standards and Laws &
governance, and HR R&D Verification
processes regulations
control
Personnel, technologies, and processes
Problem and
Delivery service Manufacturing and
Auditing Traceability vulnerability Third-party suppliers
security logistics
solving
Internal audits Software: 1 hour Product Security 3 approvals ISO 28000, C-TPAT, Security agreements
Incident Response Secure remote access TAPA, etc. with 3,855 suppliers
Third-party audits Hardware: 4 hours
Team (PSIRT) platform Auto test equipment
Supplier qualification
Customer audits Responsible disclosure Cyber security work (ATE)
certificate Digital signature Testing of incoming
materials
Confident
communications
WHAT (3): Cyber security is in every aspect of corporate governance
CEO GSPC (Global Cyber Security and User Privacy Protection

Ren Zhengfei Committee)
• Approves the company's cyber security strategy, plan, policy,
GSPC roadmap, and investments.
Chaired by Ken Hu • Resolves conflicting strategic priorities and conducts audits.
GSPO (Global Cyber Security & Privacy Officer)
GSPO
• Leads the team in developing a security strategy.
John Suffolk • Internal: Implements the cyber security assurance system.
• External: Supports GR/PR and relationships with global customers.
GSPO Office
GSPO Office
Cyber Security Internal Cyber • Coordinates efforts to develop detailed operational plans.
Transparency Centers Security Lab • Supports strategy development and execution.
• Conducts audits and oversees implementation.
Regional/BG/BU CSOs
Cyber Security and Privacy
PACD
P&S / 2012 Labs Cyber
Protection Lab (CSPL)
Supply Chain Cyber
• Develop regional/BG/BU cyber

Procurement Cyber
Netherlands CSO
Legal Carrier BG
Germany CSO
Australia CSO
Security Office
Security Office
Security Office
Canada CSO
France CSO
MKT Cyber Security Office security strategies and plans and drive
UK CSO
US CSO
implementation.
……
Regions Enterprise BG
CHR
Cyber Security Office • Work with the GSPO to identify
Consumer BG changes to departmental/BG/BU
BP&IT Cyber Security Office processes so that the cyber security
Audit strategy and its requirements are fully
embedded into their processes.
3,800+ full-time security personnel
Confident
communications
WHAT (4): Cyber security strategies, plans, governance mechanisms, accountability system,
and supporting technologies that are integrated, seamless, replicable, and auditable
 Use the right security Common

standards, requirements and Criteria
best practice Closed Loop Management Design, build, and test
BSIMM FIPS PCI NESAS/SCAS
with security in mind
Establish Baseline Execute Baseline Audit Baseline
OR Process
ISO 27034 IPD Process
Charter
Concept
Long-term ISO 21434 ISO 17025
requirements
Plan
SPs/BPs
requirement Develop Verify Release Lifecycle Process
ISO 30111 BC IA
Collect
Owner
Security Verification
Roadmap ISO 29147
Standards/ Security Best Practice
Mid-term
requirement Planning
Customer
Customer
Process
Design
ISO 27001
Sell it right. Legally LTC Process
(SOD/KCPs)
Risk
compliant
R&D security baseline Compliance
Acceptance
Manage Lead Manage Opportunity Manage Contract Fulfillment Testing
Set requirement
ISO 22301
SD /ITR Process Sales mgmt
baseline
Monthly
Sales management Consulting & ISO 27017
Network Design, Roll-out and System Assessment
 Install, serve, and

requirement Assessment
CSA STAR
Network & Planning
Integration
ISO 27018
Service security Customer Support &
support in a secure way
baseline
Assurance
Learning & Education Managed Service SACA
Supply chain and

procurement security Supply Chain and Procurement Processes
baseline Audit Committee
Order Plan Manufacture Logistics
C-TPAT Delivery TAPA
Reverse logistics
Manufacture with secure, tamper- ISO 28000

Audit: Assume
TL 9000 nothing, believe no-
proof components one, check everything (ABC)
OR: Offering Requirement LTC: Lead to Cash IA: Internal Audit
IPD: Integrated Product Process SD: Service Delivery CT: Compliance Test
BC: Business Controller SACA: Semi-annual Control Assessment
Confident
communications
Fact based communications on cyber security:

Independent in 3 aspects & 10 KMs
Independent from the government: Huawei has never
and will never attempt to harm any country. We have never
used our equipment to acquire national data, business We are a global leader in terms of traceability in
1 secrets, or IPs from any country. We will never support or 6 software and manufacturing.
tolerate such activities, and we will never engage in
such activities at anyone' request.
We have established a PSIRT that communicates
We have designed, established, and implemented with our customers when a vulnerability is
2 E2E cyber security processes, governance, policies, 7 discovered. We have built a CERT-to-CERT channel
and standards. with our customers.
We are the only vendor that has signed a security

3 We can show the results of measurement and audit
of every part of Huawei.
8 agreement with suppliers, increasing the security of
the parts they provide to Huawei.
We can proactively showcase our best practices in

We have greatly enhanced our cyber security
4 security design, development, and testing by our
9 awareness, BCG requirements, and HR policies and
R&D and security competence centers.
processes.
We can demonstrate a high level of testing independent
from R&D (Internal Cyber Security Lab, UK Cyber Independent and dedicated cyber security audits:
5 Security Evaluation Centre, and Canada Cyber Security 10 We ensure that our engineering delivery and services
Lab). None of our competitors has done this. are secure, not tampered on, and fully audited.
Confident
communications
Cyber security Message House (for communication with governments and

the media)
Security, we do more.
Cyber security and user privacy protection are Huawei's top priorities. Huawei works with all
stakeholders openly and transparently to address cyber security challenges.
Rational approach High-quality, trustworthy Collaboration on network-wide, end-to-end
Independent operations
to risk mgmt products cyber security
Understanding the Serving customers is the only reason Huawei has a robust cyber security assurance Governments and industry organizations should work together to develop
complexities of networks is Huawei exists. Huawei is committed to system and a proven track record in cyber unified security standards to ensure all network-based equipment and
essential. working with customers to ensure stable security. services reach the same level of security.
and secure network operations in all
Huawei conducts objective, Huawei invests US$20 billion annually in R&D Operators and vertical industries should determine their own required
circumstances – earthquakes, tsunamis,
evidence-based analysis of to build high-quality, secure, and trustworthy levels of security certification based on agreed security standards, the
social conflicts, and cyber attacks.
threats and makes informed products. The operational quality and defining characteristics of their industry, and the implications these have
decisions based on risks. Huawei will never try to harm any country performance of Huawei products on live on security. Operators and vertical industries should also require all
or any individual. We would rather shut networks are top in the industry. equipment and services to meet requisite levels of security certification in
There is no linkage between
Huawei down than submit to any such order to ensure network-wide, end-to-end cyber security.
suppliers' country of origin and Huawei has allocated a US$2 billion budget
requests.
where cyber attacks stem from. for a 5-year transformation program to Equipment vendors need to improve their capabilities in cyber security
Chinese law doesn't require companies enhance trustworthiness and software design so that their products can meet all relevant security standards and
to install backdoors or collect intelligence engineering capabilities and practices. the security certification requirements of their customers.
from other countries.
Huawei always remains customer-centric. We Both for industries and the general public alike, we need to build trust in
Huawei is willing to sign a "No-Backdoor, work with them closely so that they can the ability of third-party evaluators to independently certify network
No-Spying" agreement with countries. always make a return on their investment. equipment and services based on agreed security standards. There
needs to be trust in their ability to produce fair results.
Huawei has built 7 network security centers around the world. Through
these centers, Huawei will work with governments and operators to
manage any potential network security risks.
Confident
communications
Several models for building customer trust in cyber security: Increasing

government trust through practical cooperation
Product Guide policy &
security standards PPP
evaluation outcomes
• Jointly established the Huawei • Security strategy: Helped governments develop national cyber security • Maintained dialogues and cooperation
Cyber Security Evaluation Center strategies and white papers. by proactively engaging with the
(HCSEC) with the UK government
• Security policies and standards: Worked with customers and industry governments of Malaysia, Indonesia,
and carriers.
peers to develop cyber security policies, standards, and whitepapers and Spain.
• Costly and not replicable
for a specific domain. • Cost-effective and replicable
• Agreed with governments and • Germany: Joined the government-led Industry 4.0 work group; co-
carriers in New Zealand and • Introduced Huawei's security
authored a white paper on cyber security in Industry 4.0.
Denmark to use evaluation reports capabilities, experiences, and
produced by HCSEC in these two • France: Contributed to the 2016 report on information threats and practices in new tech such as cloud,
countries. However, it's also not security practices (MIPS) led by CLUSIF, the largest cyber security 5G, and IoT.
suitable for wide replication due to association in France. Huawei's contributions were recognized by
high cost and coordination difficulty. • Communicated with government
Clusif and the Ministry of the Interior.
cyber security regulators (e.g. ANSSI
• Used evaluation reports produced • Spain: Huawei and INCIBE jointly released a whitepaper titled
by Huawei's internal cyber security of France, BSI of Germany, CIC of
"Building a Trusted and Managed IoT World" at the MWC 2017. Australia, GCSB of New Zealand)
lab for Telefonica and India. This
practice may incur some cost, but is • Focused on critical infrastructure security; worked with government multiple times on the security of new
replicable in a controllable manner. regulators for specific industries and industry customers to discuss technologies such as 5G, SDN/NFV,
• Third-party evaluation reports: CC security solutions for finance, transportation, electricity, and other cloud computing, IoT, and trusted
certification sectors and build security systems. computing.
Sharing product
CII security/enterprise Exchanges on new
evaluation
security services ICT technologies
reports
Confident
communications
Global Initiative on Data Security: Encouraging more countries to sign

mutual-trust agreements with China to offset political pressure
⑦ Find the right timing & Key Roles and Responsibilities
occasions
① Find the right topic ⑥ Identify risks
Support MTA signing by leveraging
Front-end
Discuss the Global appropriate platforms and operations
Initiative on Data Security opportunities through meetings of Monitor in real-time and Country
promptly eliminate any
Identify key
(GIDS) with local heads of state, high-level visits,
government stakeholder bilateral or multilateral government risks that may impede MTA stakeholders with
to understand whether summits/forums, etc. signing. power
they are willing to sign the
MTA. Intermediary
Embassy support
⑤ Build consensus Obtain support from
the ambassador
② Find allies MTA signing
Work with key
stakeholders on the Beijing
Collaborate and discuss cyber
design and guidance of
security topics with local Office &
government stakeholders and
overall strategy and Back-end
seek support from key
agreement content. GA relationship
stakeholders.
③ Find the right actors ④ Find the right teams support
Bridge HQ and local
Persuade the Chinese Frontline teams for joint
Work with PACD's Beijing
embassy into supporting and
preparing for MTA signing, and
Office which will discuss MTA PR staff operations
signing with the Ministry of
report the matter to the Ministry
Foreign Affairs and the
of Foreign Affairs and the
Cyberspace Administration of
China.
China.
Confident
communications
Best practice sharing: Signing agreements with Indonesia and the Arab
League
On March 29, 2021, the Ministry
On January 12, 2021, the
of Foreign Affairs of China
signed the
China signed an
China-League of Arab
MoU on cyber security States Cooperation
cooperation Initiative on Data Security
with the Cyber and the Encryption with the General Secretariat of
Agency of Indonesia the League of Arab States
(LAS)
〉 Regulators on both sides are encouraged to share cyberspace 〉 States should handle data security in a comprehensive, objective and
governance information, including cyberspace-related laws, legislation, evidence-based manner, and maintain an open, secure and stable
regulations, and governance policies. supply of global ICT products and services.
〉 China and Indonesia share ideas, experiences, and best practices on 〉 States should stand against ICT activities that undermine other States'
critical information infrastructure protection, data security management, security and public interests, and oppose unauthorized collection of
personal information protection, and cyber threat responses and personal information of other States with ICTs as a tool.
cooperation. 〉 States should respect the sovereignty, jurisdiction and governance of
〉 The two nations engage in dialogs, mutual visits, and capacity building on data of other Sates, and shall not obtain data located in other States
cyber security issues among stakeholders, including governments, through companies or individuals without those other States'
institutions, academia, and businesses to promote mutual trust and permission.
cooperation in terms of data security.
Takeaway: Creating social value and strengthening Takeaway: Member states are willing to sign agreements at the
relationships with local governments is the foundation of our LAS level, but are hesitant to sign them individually.
work.
https://www.fmprc.gov.cn/mfa_eng/wjdt_665385/2649_665393/t1865098.shtml
Confident
communications
Promoting NESAS/SCAS as international standards to prevent

politicization of cyber security
What Why International standards make cyber security just a matter of
managing the physical properties of products, and not an excuse
to exclude us.
NESAS/SCAS – Cyber security standards for
the mobile industry
Standards?
(Network Equipment Security Assurance
Scheme/Security Assurance Specifications)
US actions
 Embassy lobbying through visits and
Power shift to the state MoUs
NESAS/SCAS  1G, 2G, 3G, and 4G equipment selection:  Pressure on IMF and other orgs through
aid and cooperation arrangements
Carriers have the final say
 Defines cyber security evaluation standards  5G: States have the final say  Creating panic through FDPR and other
 Inadequate regulation/legislation in many restrictions
 Jointly defined by GSMA and 3GPP
countries and regions
 Customized for the mobile communications industry
 Shared by carriers, equipment vendors, regulators, and industry
partners How Country offices proactively promote NESAS/SCAS and nurture a fair and
transparent business climate.
Insight Promotion Influence

1. Audit
NESAS Audit report
NESAS covers the  Regulators  Presentations  Suggestions on legislative and
Methodology
security auditing of  State-owned key  Topic planning for summits technical standards proposals
product development and accounts  Remote visits to the  Communicating through local
+ lifecycle processes.  Tier-1 and tier-2 transparency centers associations
2. Testing Test report carriers  Inviting stakeholders to visit  Steering customer requests for
SCAS  Local think tanks (Brussels) proposals
SCAS provides test  Legal consultancies  CC-certified lab for NESAS certification
Specifications cases for network
 Proactive media
 National labs communications  Providing NESAS/SCAS training for
equipment security
evaluation.  Design institutes local cyber security review agencies
Confident
communications
Proactive messaging at international and regional events

(Example: An overview of global cyber security events in 2020)
 Jan: Switzerland – World Economic

Forum – HQ PACD
 Feb: RSA Conference – US PACD  Feb: Bulgaria – ITU Regional Cybersecurity Forum – CEE & Nordic European
 Feb: Germany – Munich Security
 Apr: US Critical Infrastructure Protection and Resilience – PACD
Conference – HQ PACD
US PACD  May: Czech Republic – Prague 5G Security Conference – CEE & Nordic European
 Feb: Spain – MWC 2020 – Canceled
 May: SC Chamber of Commerce Cyber Security Summit  Apr: Netherlands – CFCE – HQ PACD Region + PACD + GSPO
– US PACD  May: Czech Republic – GlobSec – CEE & Nordic European PACD
 Apr: Switzerland – ITU WSIS Forum –
 Jun: National Cyber Summit – US PACD  Nov: Latvia – Annual Baltic Sea Region 5G Ecosystem Forum "5G Techritory" –
HQ PACD
 Jun: National Homeland Security Conference – US CEE Nordic & European PACD
 Jun: Germany – Potsdam Conference
PACD  Nov: Poland – CyberSec Forum – CEE & Nordic European PACD
on National Cybersecurity – Berlin
 Aug: Black Hat USA 2020 – US PACD Office
 Aug: DEF CON® Hacking Conference – US PACD
Northeast Europe Japan & South Korea
West Europe
US  Apr: South Korea – NetSec-KR 2020 – and South
Middle East
Korea PACD
 Jan: Saudi Arabia – Global Cyber Security Forum –  Aug: South Korea – WISA 2020 – South Korea PACD
Middle East PACD  Sep: Japan – International Conference on Emerging
 Mar: UAE – ISNR Abu Dhabi – Middle East PACD Network Technologies – Tokyo Office
Latin America  Mar: Saudi Arabia – Intersec – Middle East PACD  Nov: South Korea – ICISC 2020 – South Korea PACD
 Apr: UAE – Gulf Information Security Expo &  Dec: South Korea – Asiacrypt 2020 – South Korea
Conference (GISEC) – Middle East PACD PACD
 Jul: Brazil – Cybersecurity Summit Brazil –
 Oct: UAE – Government 5G Conference – Middle East
Latin America PACD
PACD
 Oct: Mexico – Mexico National Asia Pacific
 Oct: Qatar – Milipol 2020 – Middle East PACD
Cybersecurity Week – Latin America PACD
 Nov: UAE – National Cyber Security Summit – Middle
East PACD  Apr: Thailand – Cybersecurity Forum – Southeast Asia
PACD
 Oct: Singapore – International Cyber Week (SICW) –
South Pacific PACD
 Dec: India – Cybersecurity Summit – Southeast Asia
PACD
Confident
communications
Cyber security resources available for customer visits
Executive Support
 Company CEO/vice presidents
 Global Cyber Security & Privacy Officer (GSPO)
 Director of the Global Government Affairs Dept
 Director of the GSPO Office
 Cyber Security Officers (CSOs) in local offices
Resources for Customer Tours Topics for Discussion

 Huawei's cyber security vision, strategy, and approach
 Global Cyber Security and Privacy Protection Transparency Center in
Dongguan, China  Huawei's best practice in R&D security – Design and build secure
products
 Cyber Security Transparency Centre in Brussels
 ICSL – Product security verification independent of R&D
 Shenzhen F1 T-Centre
 Third-party independent product security verification and
 Galileo and Columbus exhibition halls in Section K, Shenzhen
assurance
 Darwin Exhibition Hall in Section F, Shenzhen
 Protecting complex transnational supply chains
 Shenzhen J5 EBG exhibition hall
 Introduction to PSIRT and vulnerability management
 Supply Chain Production Line of Dongguan Southern Factory
 Additional tailored topics
Confident
communications
Huawei cyber security and transparency centers

Open communication and cooperation with key stakeholders
Brussels, Belgium
Banbury, UK
Bonn, Germany
Toronto, Canada
Rome, Italy
Dongguan, China
Dubai, UAE
Global
Regional
Communication, Innovation, and Verification
Confident
Knowledge map
communications Trust building
PACD cyber security knowledge map (1/3)

Category Content Link
• Corporate Presentation_Cyber http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=-
Security at Huawei (for overseas 100&fileId=72423&fileType=5&selectAttId=584822&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&source=file&ke yWord=Corporate%20Presentati
on_Cyber%20Security%20at%20Huawei&uniStr=null
governments)
Key content • Huawei cyber security message
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=28186&f ileType=5&selectAttId=23391
for govt. house (for communication with 5&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=message&clsca=5003
communicati governments and the media)

ons • Huawei Cyber Security – Strategy http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=-
100&fileId=25945&fileType=5&selectAttId=198521&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&source=file&keyWord=Huawei%20Cyber%20Secu
and Approach rity%20%E2%80%93%20Strategy%20and%20Approach%20%E2%80%93%20PACD&uniStr=null
• Huawei's Position Paper on Cyber https://www-file.huawei.com/-/media/Corp/facts/PDF/2019/Huaweis-Position-Paper-on-Cyber-Security.pdf?la=en

Security
• KM House for the 2019 hearing in http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=45490&fileType=5&selectAttId=36000
1&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=%E5%90%AC%E8%AF%81%E4%BC%9A&clsca=5003,5
France 027
• Q&A for the 2019 hearing in France 6&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca
Cyber • KMs for the 2019 hearing in France 0&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca=5003,5027
security http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=68330&f ileType=5&selectAttId=56930
hearings • Q&A for the hearing in South Korea 4&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca=5003,5027
• KM list for the 2019 hearing in Brazil 9&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca=5003,5027
• Q&A list for the 2019 hearing in Brazil 3&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca=5003,5027
• Communication materials regarding https://onebox.huawei.com/v/14386f91fe629034c3d7dd6bb76a4d4f/list

EU 5G EU 5G security risk assessment
security
• EU 5G Toolbox https://onebox.huawei.com/v/d574139ca6165902d08e9ebec40c0d59
Confident
Knowledge map

• 2012: 21st century technology and security – a difficult marriage https://www.huawei.com/ucmf/groups/public/documents/attachments/hw_187368.pdf
• 2013: Making cyber security a part of a company's DNA – A set of

https://www-file.huawei.com/-/media/corporate/pdf/cyber-security/hw-cyber-security-wp-2013-en.pdf?la=en
integrated processes, policies and standards
• 2014: 100 requirements when considering end-to-end cyber security

https://www-file.huawei.com/-/media/corporate/pdf/cyber-security/hw-cyber-security-wp-2014-en.pdf?la=en
with your technology vendors
• 2016: It is time for real progress in addressing supply chain risks https://www-file.huawei.com/-/media/corporate/pdf/cyber-security/the-global-cyber-security-challenge-en.pdf?la=en
Cyber security
white papers
• Huawei 5G Cyber Security White Paper (the fourth one released on https://www-file.huawei.com/-/media/corporate/pdf/trust-center/huawei-5g-security-white-paper-4th.pdf
May 31, 2019)
• AI Security White Paper_201810 https://www-file.huawei.com/-/media/corporate/pdf/trust-center/ai-security-whitepaper.pdf
• Huawei Cloud Security White Paper_201709 https://www-file.huawei.com/-/media/corporate/pdf/trust-center/cloud-security-white-paper-2017-en.pdf
• White Paper for HUAWEI CLOUD Data Security_20180927 https://res-static1.huaweicloud.com/content/dam/cloudbu-site/archive/china/en-us/securecenter/security_doc/Security_en_20181008.pdf
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=-
100&fileId=21558&fileType=5&selectAttId=167968&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&source=file&ke yWord=Communication%
• Communication with Government on 5G Security (slide deck) 20with%20Government%20on%205G%20Security%20(slide%20deck)&uniStr=null
• Key Messages and Q&A Regarding Huawei's 5G Security http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=-
100&fileId=21558&fileType=5&selectAttId=167971&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&source=file&ke yWord=Key%20Message
s%20and%20Q%26A%20Regarding%20Huawei's%205G%20Security&uniStr=null
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=23625&f ileType=5&selectAttI
• Communication with Government on Cloud Security (slide deck) d=196158&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027, 5055
• Key Messages and Q&A Regarding Huawei's Cloud Security http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=23626&fileType=5&selectAttI
New tech
d=196166&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027, 5055
security
communication http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=23622&f ileType=5&selectAttI
guides • Communication with Government on IoT Security (slide deck) d=196134&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027, 5055
• Key Messages and Q&A Regarding Huawei's IoT Security http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=23623&f ileType=5&selectAttI
d=196142&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027, 5055
• Communication with Government on AI Security (slide deck) http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=23624&f ileType=5&selectAttI
• Key Messages and Q&A Regarding Huawei's AI Security d=196150&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027, 5055
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=-
100&fileId=23621&fileType=5&selectAttId=196126&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&source=file&ke yWord=%E7%BB%88%E
• Key Messages and Q&A Regarding Huawei Device Security Huawei Confidential 39
7%AB%AF%E5%AE%89%E5%85%A8%E6%94%BF%E5%BA%9C%E6%B2%9F%E9%80%9A%E4%B8%BB%E6%89%93%E8%83%B6%E7%89%87%E5%8F
%8A%E6%B2%9F%E9%80%9A%E5%8F%A3%E5%BE%84&uniStr=null
Confident
Knowledge map

• 20190328 Government Communications
Policy and Message for the 2019 OB 41&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=OB&clsca=5003,5027
Report
• 20190414 Analysis of the NATO
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=44571&fileType=5&selectAttId=3561
Analysis CCDCE's paper: Huawei, 5G, and China 42&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=&clsca=5003,5027,5056
reports as a Security Threat
• Analysis and recommendations in
response to the article by DHS & CISA: http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.html?jalorNode=documentManager&codeItem=102&fileId=44700&f ileType=5&selectAttId=3566
Overview of Risks Introduced by 5G 88&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=OB&clsca=5003,5027
Adoption in the United States
• Cyber security at Huawei 99&isDoc=2&propertyId=111&attType=other&activeId=&selDisplay=true&isActDoc=false&source=file&keyWord=&clsca=5003,5027,5061,60 83
• #1 Secret lover's code 2.0 https://www.youtube.com/watch?v=leL6UPvPdCs&list=PLCuu5t_nsFKDVjiKZNNh8SXu0ePS18pAd&index=1
• #2 Public key, private message https://www.youtube.com/watch?v=mLjui3ar-R8&list=PLCuu5t_nsFKDVjiKZNNh8SXu0ePS18pAd&index=2
Videos
• #3 Your key is your ID https://www.youtube.com/watch?v=CpC2nNEeOEU&list=PLCuu5t_nsFKDVjiKZNNh8SXu0ePS18pAd&index=3
• #4 Will computers outsmart us? https://www.youtube.com/watch?v=W0rFFMdWRsA&list=PLCuu5t_nsFKDVjiKZNNh8SXu0ePS18pAd&index=4
• #5 Upping the game with 5G https://www.youtube.com/watch?v=KYo1uqGhhzY&list=PLCuu5t_nsFKDVjiKZNNh8SXu0ePS18pAd&index=5
• PACD Cyber Security Package for
Visits Customer Visits
61&isDoc=1&propertyId=111&attType=other&activeId=&selDisplay=false&isActDoc=false&source=file&keyWord=%E6%8E%A5%E5%BE%85%E5%A 5%97%E9%A4%9
0&clsca=5003,5027
• Cyber security and privacy protection

CSPP course approaches_Overview
http://ilearning.huawei.com/edx/next/#/courses/HuaweiX+CNE051501000079/about
Confident
Knowledge map
PACD presentation on cyber security at Huawei (for overseas

governments)
 Huawei strives to maintain stable, reliable, and secure

network operations in any situations such as natural
disasters, conflicts, or hacker attacks.
 Huawei sees security and trustworthiness as a strategic
priority throughout product lifecycles and will never relax
Corporate Presentation_Cyber Security at Huawei (for requirements for product trustworthiness for any reason, be
overseas governments) (201903) it cost, schedule, or function.
http://w3.huawei.com/mypacd/#!pacd/document/view/showOnlineBrowser.h  Huawei complies with GDPR and protects user privacy.
tml?jalorNode=documentManager&codeItem=103&fileId=38056&fileType=5
&selectAttId=397351&isDoc=1&propertyId=111&attType=other&activeId=&s  Huawei is committed to jointly building E2E network-wide
elDisplay=true&isActDoc=false&source=file&keyWord=&clsca=2010 security and advocates independent and equitable cyber
security certifications.
Confident
Knowledge map
Huawei cyber security white papers – Learn about Huawei's cyber

security practices from these white papers
21st century Making cyber 100 requirem It is time for
technology security a ents when co real progress
and security – part of a nsidering end in addressing
a difficult company's -to-end cyber supply chain
marriage DNA – A set security with risks
of integrated your technolo
processes, gy vendors
policies and
standards
2012 2013 2014 2016
Shares Huawei's perspectives on Explains how Huawei resolves Provides customers with Focuses on supply chain security
cyber security with the industry issues through its end-to-end suggestions on how to manage
and the general public cyber security assurance system and improve cyber security
https://www.huawei.com/ucmf/groups/ https://www-file.huawei.com/- https://www-file.huawei.com/- https://www-file.huawei.com/-

public/documents/attachments/hw_18 /media/corporate/pdf/cyber- /media/corporate/pdf/cyber- /media/corporate/pdf/cyber-
7368.pdf security/hw-cyber-security-wp-2013- security/hw-cyber-security-wp-2014- security/the-global-cyber-security-
en.pdf?la=en en.pdf?la=en challenge-en.pdf?la=en
Confident
Knowledge map
Huawei's Position Paper on Cyber Security
 Huawei encourages all stakeholders in the digital ecosystem to

evaluate risks in a rational, objective, and evidence-based way. If
we focus our attention on irrelevant factors like vendors' country of
origin, it will only delay the resolution of security issues.
 Cyber security involves many elements and stakeholders. An all-

industry, full-society approach to collaboration is essential to
enhancing systematic cyber security governance for everyone.
 Governments and industry organizations should work together on

unified cyber security standards. These standards should be
technology-neutral and apply equally to all companies and
networks.
 Once clear, unified cyber security standards are developed, we

need independent, comprehensive verification processes that
apply these standards. As a global community, we need to
establish third-party cyber security verification mechanisms for all
industries and companies so that trust and distrust are based on
Huawei's Position Paper on Cyber Security (201911) facts, not feelings. Facts must be verifiable and verifications must
https://www-file.huawei.com/-/media/Corp/facts/PDF/2019/Huaweis-Position- be based on unified standards.
Paper-on-Cyber-Security.pdf?la=en
Confident
Knowledge map
Huawei's position paper on EU 5G networks: Towards a

trustworthy foundation to enhance the security of EU 5G networks
 5G technology presents several cybersecurity challenges due to its innovative,

software-driven nature and its use in a wide range of services. It is essential to
drive towards a trustworthy foundation to enhance the security both of EU 5G
networks and of technology built upon them in a reliable, secure, and resilient
manner.
 On October 9, 2019, the EU Network and Information Security (NIS)
Cooperation Group published its EU coordinated risk assessment of the
cybersecurity of 5G networks, which highlights shared technical and non-
technical concerns. No matter whether it is a technical risk or a non-technical
risk, we must make judgments and decisions based on facts.
 This paper details existing and forthcoming measures and industry best
practices to enhance the security of EU 5G networks. Cyber security is
increasingly entangled with geopolitical issues, trade negotiations, and
diplomatic dialogue between nations. Politically motivated suspicion does not
address the challenges to enhance cyber security.
 Risk evaluation for European telecommunications networks should focus on the
greatest risks, including: system failure and human error. The potential risks
inherent in any given product should be evaluated based on factors that have a
material effect on security, such as security architecture, controls, and features.
Mitigation measures must aim to reinforce cross-sector cooperation between
telecommunications suppliers, network operators, and service providers, and
also to raise transparency and openness of suppliers.
Towards a trustworthy foundation to enhance the
 Huawei continues to collaborate with governments, customers, and partners to
security of EU 5G networks (201912) drive towards a trustworthy foundation to enhance security of EU 5G networks.
https://www.huawei.eu/publication/towards-trustworthy-foundation-
enhance-security-eu-5g-networks
Contents



4.2 Trust building
4.3 Knowledge map
New technologies and innovative business models present more
challenges to privacy protection
Big data IoT
Big data, AI & machine learning

IoT 5G
algorithms
Major implications of big data analytics on data Privacy and data protection build the foundation of Customers will not adopt 5G-enabled services if
protection: trust. Major challenges: adequate privacy protocols are not in place.
 Use of algorithms  Lack of control and information asymmetry  Wide-ranging impact on modern life
 Using all data  Quality of the user's consent  Robust and fit for purpose security
 Opacity of processing  Inferences derived from data and repurposing of architecture needs to be at the center of 5G
 Repurposing data original processing development to ensure privacy and customer
 Intrusive bringing out of behavioral patterns and
security.
 Data controller or processor?
profiling
 Limitations on the possibility to remain anonymous
when using services

 Security risks: security vs. efficiency
Privacy legislations around the world are modeled after GDPR
Omnibus coverage
Countries that have single or multiple national privacy
or data protection laws that result in comprehensive
coverage. These laws do not exclude the possibility of
additional sector-specific privacy regulations.
Sectoral coverage
Countries that have sectoral privacy or data
protection laws, for example, in the public sector,
financial sector, and telecommunication sector.
None
Countries that do not have privacy or data protection laws
but may have some coverage in their constitution or other
laws.
Source: Nymity Research
Updated on August 23, 2018
The legal concepts and basic principles of personal data protection provided
Countries/regions with dedicated privacy protection
in GDPR are widely accepted worldwide. After the EU released GDPR in 2016,
laws: 118
Argentina, New Zealand, Canada, Japan, Brazil, Turkey, and China all referred
Countries/regions with laws which cover privacy
to GDPR when developing or amending their own personal data protection
protection requirements: 28
laws.
Basic concepts about privacy protection
Concepts Implications for companies
• The data subject (natural person) is the owner of his or her data. • Each data controller (a company may have more than one data
• The data subject decides (except under special circumstances) controller) must maintain a complete list of personal data that it
who can obtain and access their personal data, and how their stores and/or processes, including legal basis, retention period,
personal data will be used and processed. transfer, etc.
• The data subject is entitled to multiple rights. The data controller • Best practices (not explicitly defined in GDPR) must be adopted to
(company or individual) must respect these rights, such as the protect all personal data.
right to request access or the deletion of their data (i.e. the right • All data controllers must demonstrate the company's highest level of
to be forgotten). effective personal data governance, policies, processes, capabilities,
• The data controller cannot use personal data for purposes without awareness, and oversight.
valid legal basis (valid legal basis includes consent, contract • The data controller must fulfill its legal obligations.
fulfillment, etc.). • The response to data subjects' requests must strictly comply with the
• The data controller is legally obligated to protect data. SLA.
• Cross-border transfers of personal data (or access data from a • Violations or non-compliance in some areas may result in serious
foreign country) may be restricted or have special prerequisites. consequences.
Data controller Data processor

The data controller is the natural person, legal entity, public authority, The data processor is the natural person, legal entity, public authority,
government agency or any other organization, which individually or government agency, or other organization that processes personal data,
collectively, determines the purpose and means of processing as instructed by a data controller. For example, Huawei is the data
personal data. For example, Huawei is the controller of users' processor when it provides maintenance services as instructed by a
registration information on Vmall. telecom operator.
Huawei's privacy protection framework: Setting differentiated privacy
protection objectives to meet various privacy expectations
Privacy Protection in a Digital World
Lawfulness, fairness, and

Purpose limitation Data minimization Storage period limitation Integrity and confidentiality Accuracy Accountability
transparency
Data Controller (employees)

Data Controller (users: CBG + other) Data Processor (CNBG + EBG + other)
Make personal data processing transparent to enhance Huawei
Observe laws to proactively safeguard consumers' privacy, Ensure data security and comply with customers' instructions.
employees' trust; process employees' personal data according
enhance consumer trust, and facilitate business success Avoid becoming the Data Controller.
to legitimate business purposes and necessity.
Notification to Data subject's Notification to Data subject's Notification to Data subject's

data subjects choice and consent data subjects choice and consent data subjects choice and consent High risk area
identified by PIA
Mainly Mainly
consumer carrier & enterprise Employee
business business
Management Security Quality Monitoring and Enforcement
Policies and Organizations and Standards, laws, Law enforcement

Access control Record and verification Complaint handling
processes resources and regulations investigations and litigation
Risk assessment Employee awareness and Data breach incident

Business continuity Assessment and rectification Audit and accountability
(PIA etc.) capability response
Huawei privacy protection Message House
Respecting and protecting privacy to let people embrace a fully
connected, intelligent world
We collaborate openly with stakeholders to protect
Huawei is a responsible and trustworthy global We adopt a Privacy by Design/Default approach to ensure privacy protection
personal data and privacy in the digital world and
provider of ICT infrastructure and smart devices. requirements are embedded into all our business processes and activities. enable the digital transformation process.
• Protecting privacy is part of our social responsibility. • We adopt the Privacy Impact Assessment (PIA) methodology to evaluate and mitigate privacy • Carrier & enterprise customers: Privacy protection
We are committed to protecting customer data. risks in our products and services. is an integral part of Huawei's solutions, helping
We never sell customer data. • We have maintained a comprehensive personal data inventory to record all personal data customers successfully go digital.
• Data is the most important resource in the digital processing activities, legal bases, security and control measures, and cross-border data transfers. • Consumers: Huawei aptly protects all private
world and privacy protection is the foundation of This helps us achieve legal compliance in a transparent and effective way and provide better consumer data stored on Huawei's devices and
the development of digital technologies. Working customer services. cloud. Consumers are made aware of all
with regulators, partners, and customers, we • At Huawei, we have established privacy protection organizations with clearly-defined roles activities that collect personal data, and can
understand what privacy protection is about and and responsibilities. These organizations are managed by our long-standing Global Cyber control the collection, processing, and sharing of
embed it into everything we do. Security & User Privacy Protection Committee which is chaired by Huawei's Rotating Chairman. their personal data.
• Privacy legislation is an effective way to address All business departments have dedicated personnel or organizations for privacy protection. In • Cloud service customers: Huawei strictly complies
public concerns about privacy breaches and addition, we have appointed an EU Data Protection Officer (DPO) who leads a team that with the boundaries of services and never
helps companies better protect personal data. As independently oversees Huawei's privacy activities to ensure they are GDPR compliant. monetizes customer data. Huawei never uses
a leading global ICT infrastructure solutions and • We continue to train and test all our employees on privacy protection. In addition, privacy customers' personal data without explicit consent.
smart devices provider, Huawei fully complies with all protection requirements are included in the company's Employees Business Conduct Guidelines • Industry partners, governments, and regulators:
applicable laws and regulations. (BCGs) to ensure all employees correctly understand and abide by privacy protection rules and Privacy protection requires joint efforts across
• Huawei remains open, and our approaches and requirements. the industry and is an ongoing process. Huawei
practices for end-to-end privacy protection are • Huawei adopts a comprehensive approach to supplier privacy protection management, is committed to working with industry stakeholders
transparent to regulators, customers, and which ensures that data processing agreements (DPAs) are signed, privacy protection and partners to understand and address privacy
consumers. responsibilities are clearly defined, and privacy protection requirements are strictly enforced. challenges in the digital world. We aim to do our part
Based on a risk-informed model, we conduct audits on suppliers to ensure their compliance. to deliver a better connected world.
• By referring to best practices, we protect personal data and have strict control over cross-
border personal data transfers. In cases where cross-border data transfers happen, we ensure
that data receiving countries can provide the adequate protection level required by GDPR. In
addition, we make sure that necessary processes and resources for privacy protection are in place
so that we can meet any reasonable request from regulators or data subjects.
Privacy protection course on iLearning
Privacy Protection Awareness and Basic Capabilities – For General

• Course objectives:
 Have a thorough understanding of the key clauses in GDPR
 Be familiar with Huawei's privacy protection framework, organizations, and
documentation
 Design corresponding privacy requirements for the seven links of the data processing
lifecycle during business operations; undertake privacy protection responsibilities in
daily work
 Drive the implementation of the company's privacy policies, methodologies, and
measures for better privacy protection
• http://ilearning.huawei.com/edx/next/courses/HuaweiX+ENE051101000021/about
GDPR Introduction
• Course objectives:
 Understand the basic roles and data processing principles under GDPR and the major
changes in the legislation
• http://ilearning.huawei.com/next/learnCourse.html?courseId=23997#/video/110195
Thank you. 把数字世界带入每个人、每个家庭、
每个组织，构建万物互联的智能世界。
Bring digital to every person, home and
organization for a fully connected,
intelligent world.
Copyright©2018 Huawei Technologies Co., Ltd.

All Rights Reserved.
The information in this document may contain predictive

statements including, without limitation, statements regarding
the future financial and operating results, future product
portfolio, new technology, etc. There are a number of factors that
could cause actual results and developments to differ materially
from those expressed or implied in the predictive statements.
Therefore, such information is provided for reference purpose
only and constitutes neither an offer nor an acceptance. Huawei
may change the information at any time without notice.

Cyber Security and Privacy Protection-Courseware-20210907

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cyber Security and Privacy Protection-Courseware-20210907

Uploaded by

Copyright:

Available Formats

PACD Basic Knowledge Course

Overview of Cyber Security and Privacy Protection

Public Affairs and Communications Dept

1. Why – Importance of cyber security and privacy protection

3. How – PACD's plan for communications about cyber security

4. How – PACD's practices for communications about cyber security

5. Overview of privacy protection

There are huge differences

• Closely monitors Huawei's improvements on the problems identified in

1. Why – Importance of cyber security and privacy protection

3. How – PACD's plan for communications about cyber security

4. How – PACD's practices for communications about cyber security

5. Overview of privacy protection

Huawei's cyber security

1999–2005 2006–2009 2010–2017 2018–

Compliance Business value

End-to-end security and

Product security design,

Management- and control- Capability-based

Help customers build network resilience

Customer value and communication

the media, supply chain partners, etc.

Resilience & trustworthiness

1. Why – Importance of cyber security and privacy protection

3. How – PACD's plan for communications about cyber security

4. How – PACD's practices for communications about cyber security

5. Overview of privacy protection

Global public relations action plan map

Country PR Goal Owner

West Europe: Italy, Spain

Third priority: tier-3 Internal and

PACD's key tasks regarding cyber security

Cyber security goals in the next 3–5 years

Externally: Be competent to communicate on cyber security matters and build trust

Insights into the external environment: Political sensitivity of the

1. Do local values conflict with Western values?

Insights into the external environment: Cyber security maturity of the

Insights into the external cyber security environment: Legislation,

 Insight into government

 Insight into competitors

 Insight into the industry

 Insight into public opinion

Insights into the internal Cyber security environment: Status quo of

Business Purpose Description

Setting cyber security and privacy goals at the regional/national level

External: Government attitude and Internal: Impacts of cyber security on business

(1) Proactive or reactive communications?

• Cabinet, parliament, congress, federal government, state

• Industry associations, mainstream media, trade media, certification

Best practice sharing: Cyber security stakeholder relationship

1. Why – Importance of cyber security and privacy protection

3. How – PACD's plan for communications about cyber security

4. How – PACD's practices for communications about cyber security

5. Overview of privacy protection

Goals and strategies for cyber security communications: Addressing customer

WHAT (2): An E2E cyber security assurance system that covers

Personnel, technologies, and processes

WHAT (3): Cyber security is in every aspect of corporate governance

CEO GSPC (Global Cyber Security and User Privacy Protection

Supply Chain Cyber

• Develop regional/BG/BU cyber

3,800+ full-time security personnel