Securing the federal supply chain

The current global pandemic is laying bare a whole host of national problems related to education, health care, and more. Supply chain security is no exception. It’s become more apparent than ever that a global supply chain is accompanied by innate vulnerabilities, the number of which has grown while “software eats the world,” as Marc Andreessen famously put it.

In 2018, a report by the U.S.-China Economic and Security Review Commission warned that software supply chain attacks would become easier and more prevalent over time. This year, when Federal Chief Information Security Officer Grant Schneider outlined the Federal Acquisition Supply Chain Council goals, he noted that supply chain security was a top priority.

Schneider emphasized the need for agencies to gain a more holistic overview of “what’s inside the box, who built it, what was their intent.” While this is a commendable goal, it’s perhaps too broadly idealistic. In today’s global world, the tough reality is that just as malware infections are inevitable, so is a compromised supply chain. This may be difficult to accept. But we do not live in a utopia, and accept it we must.

A complex attack surface

A car manufactured in the 1960s would be challenging to compromise from a security perspective. Now, nearly everything either is a computer or relies on some form of one —whether we’re talking about a car, a laptop or a coffee maker.  Blackhawk helicopters, for example, are equipped with autonomy software and sophisticated sensors.  Every component of those computers now comprises part of the overall attack surface.

Many suppliers have extensive access to sensitive resources and assets -- an inherent risk. Additionally, bad actors can and do insert malicious software at any point in the global chain sabotage, slow down national programs or exfiltrate classified data and intellectual property. The inescapable reality is that there is no way to comprehensively tighten and secure supply chains from beginning to end. They are simultaneously too complex and too global.

Securing the supply chain

The Defense Department’s Cybersecurity Maturity Model Certification, or CMMC, requires the Defense Industrial Base and the DOD’s 300,000+ contractors to comply with one of five levels of verification. Even the lowest level includes a physical audit to check foreign ownership and ensure basic cyber hygiene -- such as the protection of unclassified but still controlled information. This is an extremely promising step, one that is likely to trickle down to enterprises much in the same manner as the Federal Risk and Authorization Management Program for cloud security certification has. It will raise the cybersecurity capabilities of America’s suppliers, but it’s not an all-encompassing silver bullet.

Supply chains are already compromised today, an unfortunate reality that’s expected to get worse, not better. Thus, agencies must also implement stringent controls ranging from network segmentation to analytics and threat intelligence. Even after suppliers have been selected and verified, organizations must be able to determine whether humans, systems, and/or processes across the supply chain are doing what they are supposed to be doing.

This level of verification can only materialize by understanding what normal behavior looks like, from the beginning of the supply chain to the end use of products. Highly customized analytics platforms can supply granular patterns of internal and external-facing network and application behavior, as well as user and group profiling for target analysis. Abnormal data patterns -- deviant sensor readings, computational anomalies, and uncharacteristic high-risk behavior -- should trigger alerts, much like unusual spending on credit card accounts, and prompt an immediate response. Once we understand that breaches are inevitable and already occurring, such technology becomes critical and non-negotiable.

The bottom line

There has been significant discussion around bringing supply chains back within our national borders in the name of security. This, too, is a noble goal, but it has its own challenges. Meanwhile, the pace of data breaches and intrusions into computer systems continues to accelerate at an alarming rate.

As perpetrators evolve to become more sophisticated, supply chain vendors are immensely vulnerable to advanced attacks and may be unintentionally housing bad actors themselves. Federal agencies must be prepared. CMMC represents important progress, but other steps should be in place to respond to an eventual and inevitable breach. We must begin to think differently and assume that the supply chain is compromised and change our operating procedures accordingly.