Trust your vendor? Not really: report

Peter Dinham
Wednesday, 24 June 2009 10:14

Business IT - Technology

According to Titterington these attacks can have serious consequences for enterprises, but when they attack carrier networks, he says they also have implications for national security, and “they threaten the commercial health of the communications service provider and its major customers.”

“The risk is much greater in this age of IP-based communications than it was with traditional telecommunications networks because network control and payload are not segregated.”

Titterington also says there must be a relationship of trust between vendors and their customers, ideally based on a culture of partnership.

“Customers, in both the service provider and enterprise communities, need to place trust at the top of their criteria when selecting suppliers.”

Ovum says its report highlights the fact that enterprises and carriers alike are dependent on the integrity of their suppliers and the trust relationship is crucial to both parties.

Titterington says vendors who fail to establish their integrity should be struck off supplier short lists, and he suggests that enhanced network audit procedures would uncover this “spook account type of exploit”, but that a vendor hacker could turn to embedding the spyware in the code of the product, making it much more difficult to detect.

“Insofar as this threat impacts on critical national infrastructure and national security we can expect governments to take an increasing interest in this issue. However any response will be fragmented due to the limits of jurisdiction of any government.

Titterington concludes that the United States is likely to lead the way in government oversight, and that President Obama’s recent announcement on cyber security shows that the current administration is “giving a much higher priority to the problem than previous administrations.”