2021 Annual Report

Cyber Security and Privacy Protection Challenges and Opportunities

We live in a highly interconnected world, where the physical and digital realms are converging and network boundaries are increasingly blurred. Cyber security and privacy protection are ever more important. Over the past year, a succession of critical vulnerabilities, supply chain attacks, and advanced persistent threats (APTs) emerged. Cyber security threats have become ubiquitous, arising in products, services, operations, internal IT systems, supply chains, code, and personnel. Governments around the world are paying greater attention to cyber security and privacy protection, and have adopted laws and regulations to strengthen the governance of cyberspace and protect personal data. With the rising role and importance of data in all parts of our lives, data protection and compliant data use are becoming a basic requirement.

As digital transformation accelerates across industries, the application of new technologies – such as cloud computing, artificial intelligence (AI), 5G, and big data – brings with it opportunities, but also risks. We need to consider how to meet the increasingly strict compliance requirements of regulators, and how to provide secure and trustworthy products and services that fulfill our commitments to customers. We also need to embrace a defense-in-depth approach to provide better security, ensure business continuity, and improve efficiency and customer experience while all the time protecting user privacy.

Over the past three decades, we have built more than 1,500 networks together with carriers, and helped millions of enterprises with their digital transformation. During this time, we have connected over three billion people around the world and maintained a solid track record in security. With digital transformation picking up pace, we are acutely aware that cyber security will become a cornerstone of the future digital world. Business success will not be achieved without security, trustworthiness, and privacy protection. We continue to place cyber security and privacy protection as a top priority. We are committed to confronting cyber security and privacy challenges and opportunities through management transformation, technological innovation, and open collaboration. We want to foster a better life for all in the future digital world by offering secure and trustworthy products, solutions, and services where personal data is lawfully used and always protected.

Building secure and trustworthy products, solutions, and services to help customers strengthen cyber resilience

We continuously optimize our end-to-end cyber security and privacy protection assurance system, making sure that each domain is constantly refined and up-to-date:

• Deepening trustworthiness transformation to enhance software engineering capabilities and cyber resilience, and building secure, trustworthy, and quality products and solutions

  In 2021, we improved our internal off-the-shelf components of trustworthy technologies and product design platforms, and implemented the clean code mechanism to continuously improve code quality and reduce vulnerabilities. We also enhanced threat analysis and trustworthy design, bringing improvements to the security and resilience capabilities of products and solutions. We incorporated the software engineering capability enhancements into the Integrated Product Development Lifecycle (IPD 12.0).

  In terms of organizational changes, we strengthened the integration and continuous development of common security capabilities. We set up a corporate-level vulnerability management center based on the Product Security Incident Response Team (PSIRT) to enhance common vulnerability management capabilities. We also integrated the Trustworthiness Enabling Department and IT Equipment Department at the product line level to help implement software engineering capabilities through IT systems.

• Consolidating privacy governance to respect and protect user privacy

  We comply with privacy protection laws and regulations in the countries and regions in which we operate. In 2016, we established a unified privacy governance framework in accordance with the General Data Protection Regulation (GDPR). With successive personal data protection laws – such as China's Personal Information Protection Law – being enacted and cross-border data transfer requirements being imposed in different regions and countries, we have continuously improved our governance architecture and technical capabilities, and incorporated privacy protection and cross-border data transfer requirements into R&D, services, operations, and other aspects. Based on the governance architecture and processes, we developed a series of IT tools and platforms to improve compliance effectiveness and management maturity, and provided transparent and clear compliance processes and results. We handled over 20,000 data subject requests in a timely and effective manner, protecting the rights of data subjects. We conducted 30 internal and external audits in different countries across business domains, and multiple subsidiaries have obtained internationally recognized privacy protection certifications, ensuring that our privacy policies are effectively implemented and independently validated.

• Helping customers manage security risks through technological innovation

  We continue to research, explore, and implement cutting-edge fundamental technologies, such as cryptography, AI trustworthiness, confidential computing, and differential privacy. Furthermore, we accelerate the application of security technology solutions to products, and continue to introduce vulnerability mitigation, advanced threat detection, data protection, and other technologies into ICT products, improving security and resilience.

  Take 5G base stations as an example. We deploy a wide range of functions – including software integrity check in the boot state, runtime software integrity measurement, and one-click security configuration check – providing security verification, hardening, and detection capabilities. We also build intrinsic security for 5G to enable a more efficient integrated security protection system. In this way, we have significantly enhanced cyber resilience.

  Additionally, we introduced application behavior detection and other functions under device-cloud synergy to mobile phones, further enhancing privacy protection capabilities. We released the AI situational awareness technology, which improves the attack detection and audit capabilities of AI models and protects AI model assets.

• Ensuring privacy and security of HarmonyOS users

  HarmonyOS is a next-generation operating system that can run on a wide range of smart devices. It enables different smart devices to speak the same language, facilitating better connection and collaboration, and bringing a simple, smooth, continuous, secure, and reliable interaction experience in all scenarios.

  At the outset, we emphasized the fundamental importance of consumer privacy and security and implemented a system security architecture and ecosystem management and control framework, in order to explicitly address these issues. With HarmonyOS, we have built a security architecture for the Super Device. It implements hierarchical device security management, trusted device connections, distributed access control, and a security collaboration platform, protecting the security of consumers.

  Furthermore, we have built a HarmonyOS application management and control framework to ensure that applications are protected throughout the lifecycle, including the development, commissioning, release, installation, and running phases. In this way, we protect users from malicious applications and effectively ensure their privacy and security.

• Continuously enhancing secure and trustworthy service operations

  We continue to invest in the development of IT-based capabilities for trustworthy operations and digitally ensure transparent and traceable network operations. We set up an operations trustworthiness lab to strengthen interconnection with global standards organizations and cutting-edge research and we continued to develop capabilities to address emerging cyber security challenges. Our data security management system for carrier service support passed the external System and Organization Controls 2 (SOC 2) audit, demonstrating effective lifecycle management of such data. At the same time, we continued with the Network Safety Day campaign to increase cyber security awareness and risk control, working together with our customers to enhance cyber resilience.

• Steadily boosting awareness and professional capabilities among all employees

  We encourage employees' continued participation in external professional cyber security and privacy protection certification programs. To date, more than 1,200 employees have obtained industry-recognized certifications, such as Certified Information Systems Security Professional (CISSP), Certified Information Privacy Professional (CIPP) from the International Association of Privacy Professionals (IAPP), and Certificate of Cloud Security Knowledge (CCSK). We have established a Cyber Security & Privacy Protection Knowledge Center and released more than 200 Massive Open Online Courses (MOOCs), facilitating rapid sharing and transfer of knowledge within the organization.

  In order to continuously improve cyber security and privacy protection awareness among all employees, we held the Cyber Security Awareness Month campaign, engaging about 150,000 employees online and offline through different activities. Such activities included messages from top-level management, expert lectures, knowledge quizzes, Capture the Flag competition, a cyber security technology conference, and a verification conference.

• Continuously strengthening cyber security risk management and capability building of the supply chain

  We have established a comprehensive ISO 28000 compliant supply chain security management system to identify and control security risks in the end-to-end process from incoming materials to manufacturing and delivery to customers. We have developed industry-leading material security and trustworthiness specifications, security sourcing test standards, and supplier security and trustworthiness maturity standards. Suppliers must pass the security system certification and test before they are admitted.

  In 2021, we conducted cyber security risk assessments of more than 4,000 suppliers worldwide, and recorded, tracked, and rectified the issues identified. We signed data processing or protection agreements with more than 5,000 suppliers and implemented privacy protection management requirements for suppliers to ensure compliance. We also optimized the security baselines and verification processes for manufacturing and supply availability, and implemented them in the production and delivery processes of new products.

  Given the great importance we attach to supply chain security requirements around the world, we have now obtained 35 Authorized Economic Operator (AEO) certificates in 28 countries and regions across five continents. We continue to build a thriving security ecosystem together with our partners, and 25 of our logistics service providers around the world have obtained Transported Asset Protection Association (TAPA) certificates. We continue to optimize our supply chain tracking system, which is capable of tracing software and hardware from incoming materials to customer delivery within hours, effectively supporting rapid rectification and risk mitigation.

• Increasing investment in third-party independent verification

  We continue our cooperation with industry-recognized certification bodies to test our cyber security capabilities against international standards and best practices, providing customers with internationally recognized security assurance. In 2021, we obtained more than 70 cyber security certificates. For example, our 5G base station was the first to pass the NESAS/SCAS 2.0 evaluation in the industry; HarmonyOS obtained high-level Common Criteria certification; the Intelligent Automotive Solution Business Unit (IAS BU) was the world's first to obtain ISO/SAE 21434 certification for automotive cyber security; and digital power products obtained the IEC 62443 certificate.

Shared responsibility, joint capability building, and collaboration for shared success

Cyber security and privacy are a common challenge, one that all stakeholders – including governments, industry and standards organizations, enterprises, technology suppliers, and consumers – have a shared responsibility to confront. We reiterate our commitment to communicating and collaborating with all stakeholders in an open, transparent, and responsible manner so that we can jointly improve cyber security and privacy capabilities and address the challenges through technological innovation, knowledge sharing, standards development, verification, and other measures. We strive to continually improve cyber security and personal privacy, enabling everyone to enjoy all of the benefits brought by technological advances. In 2021, we made the following key achievements in external cooperation:

• In the mobile communications field, we submitted more than 400 cyber security proposals to 3GPP and GSMA, maintaining our longstanding industry-leading position. We also submitted proposals on remote attestation security architecture, interaction models, YANG data models, and campus IoT device access security to international standards organizations, such as ETSI, IETF, ITU-T, and CCS. These are just a few examples of our many continuous contributions to the development of industry security standards.
• China Mobile and Huawei set up a joint innovation center on 5G security in Zhejiang Province. To address typical cyber security requirements of industries, such as manufacturing and power grids, this center incubates different security solutions, including network element security risk detection, multi-access control over terminals, slice security isolation, and mobile edge computing security services. In this way, the center aims to continuously enhance the security capabilities of 5G networks, safeguarding digital transformation of industries. One of the center's key innovation achievements – 5G service-based security capability safeguards to support digital transformation in manufacturing – won first prize in the application security final of China's 4th Blossom Cup 5G Application Contest. This center was selected by the Ministry of Industry and Information Technology as the 2021 innovation demonstration center for 5G application security.
• We became a member of the Organisation of the Islamic Cooperation-Computer Emergency Response Team (OIC-CERT), the world's third largest computer emergency response organization, and actively participated in the OIC-CERT 5G Security Working Group to develop a 5G cyber security framework for risk assessment and management, aiming to help member states improve their 5G cyber security management capabilities.
• In Indonesia, we renewed the Memorandum of Understanding (MoU) on cyber security cooperation with the National Cyber and Crypto Agency (BSSN), reaffirming our commitment to the sharing of cyber security knowledge, and supporting Indonesia's plan to develop cyber security and digital transformation professionals.
• In Germany, Huawei supported the Federal Office for Information Security (BSI) in the release of the AI Cloud Service Compliance Criteria Catalogue (AI C4) by providing relevant suggestions based on a use case pilot project. AI C4 is the industry's first security standard for AI cloud services. In December 2021, Huawei Cloud OCR service officially passed the AI C4 attestation conducted by an independent agency.
• In Malaysia, we worked with the national cyber security specialist agency CyberSecurity Malaysia (CSM) and mobile telecommunications provider Celcom to build a Cyber Security Test Lab (My5G), helping Malaysia improve cyber security capabilities and set the stage for 5G deployment. At the Cyber Security Malaysia Awards, Conference & Exhibition (CSM-ACE) in December, the Ministry of Communications and Multimedia Malaysia released My5G, and Huawei was awarded "Cyber Security Innovation of the Year" by CSM.
• In Thailand, we worked with the National Cyber Security Agency (NCSA) to organize the participation of more than 600 professionals in the Cyber Top Talent competition, helping identify and select local cyber security talent. As part of the partnership with the NCSA, we will assist them in building a dedicated e-lab to provide in-depth training on cyber security technologies and standards for local organizations and talent.
• In Singapore, we joined the SG Cyber Safe Partnership Programme launched by the Cyber Security Agency (CSA) as an "Advocate" partner. We will deepen our cooperation with the CSA in product and service development and community outreach activities to further boost the cyber security awareness of local businesses and the public and promote cyber security best practices and good cyber security hygiene.
• In the UAE, we deepened our cooperation with the Cyber Security Council (CSC), and played an active role in the construction of the local cyber security ecosystem and the improvement of regional cyber security awareness and capabilities. We won the "Cybersecurity Company of the Year" and "Cybersecurity CEO of the Year" awards.
  

  Huawei UAE Chief Security Officer reporting to the chairman of the CSC at the UAE Cyber Security Week

In June 2021, we opened our Global Cyber Security and Privacy Protection Transparency Center in Dongguan, China, providing a communication and collaboration platform. We are committed to strengthening communication and collaboration with stakeholders, promoting common security standards, technological innovation, security governance, testing, and verification, and more. We look forward to collaborating with all stakeholders to build cyber security and privacy protection capabilities, share value, and embrace both challenges and opportunities, to foster a better life for everyone in the future digital world.