HP Enterprise lets Russians review Pentagon cyber security software: Report
03 Oct 2017
A Russian defence agency got to review the inner workings of Pentagon's cyberdefence software, which guards its computer networks, thanks to Hewlett Packard Enterprise, Reuters reported.
The HPE system, called ArcSight, is integral to much of the US military cybersecurity, and alerts analysts when it detects that computer systems may have come under attack. The private sector also uses ArcSight in its cyber defence sytems.
The Russian review of ArcSight's source code, the closely guarded internal instructions of the software, formed part of HPE's effort to win the certification required to sell the product to Russia's public sector, according to the regulatory records which Reuters claimed to have seen. It was also confirmed by a company spokeswoman.
According to six former US intelligence officials, and former ArcSight employees and independent security experts, the source code review could help Moscow identify weaknesses in the software, potentially helping attackers to blind the US military to a cyber attack.
''It's a huge security vulnerability,'' said Greg Martin, a former security architect for ArcSight. ''You are definitely giving inner access and potential exploits to an adversary.''
According to Reuters, no one it spoke with was aware of any hacks or cyber espionage that could be linked to the review process.
''HPE has never and will never take actions that compromise the security of our products or the operations of our customers," the company said in a statement.
"In the past, HPE worked with select third parties to test a narrow set of products for backdoor vulnerabilities before selling into the Russia market. This is a years-old requirement for all companies that has not changed recently. All testing was done in HPE controlled sites and entirely under the supervision of HPE's Cyber Security specialists, to ensure that our source code and products were in no way compromised," it added.
