Don’t let supply chain security risks poison your organization

There have been plenty of stark examples of that reality. Perhaps the most notorious is the 2014 breach of mega-retailer Target’s point-of-sale systems, enabled because hackers penetrated one of the company’s vendors—an HVAC contractor—via a social engineering attack that delivered malware in an email.

That compromised 41 million credit card numbers and 70 million addresses, phone numbers, and other pieces of personal information.

Unfortunately, it didn’t substantively change the world of supply chain security. Perhaps most organizations thought that what happened to a retailer wouldn’t happen to them. But now there are more than 18,000 victims from just about every industry in both the public and private sectors. At a U.S. Senate Intelligence Committee hearing on Feb. 23, 2021, Chairman Mark Warner (D-VA) acknowledged that the SolarWinds hack “highlighted a number of lingering issues that we’ve ignored for too long.”

So maybe this time will be different. Suddenly supply chain security is a hot topic—very hot. Everybody’s talking about it.

That’s good. Because the risks are real, as illustrated by SolarWinds. The company, which provides system management tools for network and infrastructure monitoring, has an IT performance monitoring system called Orion.

The thumbnail version of the story is that hackers were able to inject malware into an Orion update, and from there it spread to thousands of customers when they dutifully installed it, obeying the mantra: “Keep your software up to date!” That gave the attackers access to the data and networks of those customers. Among them are federal agencies including the departments of Homeland Security, State, Justice, NASA, FAA, Commerce, and Treasury, plus the National Institutes of Health and National Nuclear Security Administration.

But while the risks are real and the consequences can be catastrophic, solutions to those risks are real, too. Organizations don’t have to be helpless. There are mitigations available to manage and reduce supply chain risks.

No, they won’t make you bulletproof, just as seatbelts, airbags, lane assist, crumple zones, and accident-avoidance technology won’t guarantee you could never get hurt or killed in a car crash. But those measures do make driving much safer. And supply chain security measures can make an organization much more secure.

So now that we have your attention…

In most cases, organizations are both supply chain consumers and producers. As in, they receive (consume) materials, products, and services from various third parties, and also produce products and services for other organizations or for the public. But the security emphasis is a bit different for each role. The recommendations in this post focus on consumers in the supply chain. A second post will focus on producers.

The leaders of most consumer organizations of any size likely know that their supply chain is lengthy and complex. But they may not grasp just how complex.

Indeed, it’s not just the security of an HVAC contractor or other vendor that’s important. It’s also the security of the dozens to hundreds or thousands of components an organization may import while building applications or anything else powered by software.

One of the first things a consumer organization should do is track what it’s using. Compile a Bill of Materials and get credible assurances from its producers that they are also tracking what they are using and keeping it up to date.

There’s considerable advice, in great detail, available on how to do that. Here are a few useful sources.

Hold your producers responsible

Mike Ahmadi, former director of critical system security at the Synopsys Software Integrity Group (SIG) and now vice president of research at Farallon Technology Group, and George Wrenn, then CSO and vice president cyber security for Schneider Electric and now founder and CEO of ZenPrivata, offered extensive advice in a 2016 podcast on how to develop effective procurement language. That’s language designed to hold a producer or other third party contractually liable for the statements they make about the quality, reliability, and—most of all—security of the software they are providing.

That ought to be fundamental since, as we all know, when people sign something, they tend to take it more seriously.

Manage your open source with automated security testing tools

Second, it’s well-known (the annual Open Source Security and Risk Analysis (OSSRA) report by Synopsys has been documenting it for years) that software today is assembled—up to 90% of the final code comes from a combination of open source and third parties.

An organization that doesn’t know, and test, what’s inside that code is asking for supply chain problems. And, as Ahmadi pointed out, an automated software composition analysis tool will examine it more accurately and much faster than any manual method.

“You could manually comb through and create test cases that could fuzz something at a protocol level,” he said. ”Or you could connect them to our automated testing tools, push the button, and wait.”

Learn what others are doing and what works

The Building Security In Maturity Model (BSIMM) is an annual report that helps organizations grow and improve their software security initiatives by documenting what other organizations in their industry vertical are doing and what works. The authors of that report also provide the BSIMMsc (formerly called vBSIMM), focused on software supplied by third parties.

Sammy Migues, principal scientist at the Synopsys SIG and a coauthor of the BSIMM, noted in a white paper that the BSIMMsc “leverages attestation and automation to function as a foundational security control for software supply chain risk management.” Put a bit more simply, it helps organizations avoid software vendors that are less vigilant.

Michael Fabian, principal consultant at the Synopsys SIG, recommends that consumers “engage in a risk discovery and framing exercise, following frameworks outlined by international standards bodies.”