While the 400 year old John Donne poem, No Man is an Island, is about the interconnectedness of the individual to humanity, it could just as easily had been written about the nature of cybersecurity and modern technology.
Just as we’re all connected, interdependent, all modern technology is likewise interconnected and interdependent. And as we see so often, a vulnerability in one software can easily mean vulnerabilities across many other programs, infrastructures, and organizations.
One need look no further than the Heartbleed vulnerability made possible by a flaw in OpenSSL that affected 17% of all SSL servers, or the recent breach of international outsourcer Wipro and the light that breach shines on third-party risk.
As the National Institute of Standards and Technology (NIST) recently put it, the supply chain security of information and communications technology (ICT) relies on a complex, globally distributed, and interconnected ecosystem that is deep, consists geographically diverse routes, and numerous levels of outsourcing relationships. This supply chain “ecosystem” consists of vendors, system integrators, services suppliers and other third-parties, plus the entire services and technology stack that contributes to the design, manufacturing, distribution, deployment, and consumption of information and communications technologies and services.
If that sounds very complex it is because it is very complex. The same is true for the technology stack of every business. It doesn’t matter what size the organization, from a small or mid-sized business, large corporation, or the U.S. federal government — every business is dependent on open source and commercially provided hardware and software and their security depends to varying degrees on trusting every entity that is involved throughout the entire supply chain.
Taking in the complexity — and the associated challenges on cybersecurity — can be mind-boggling. To remain reasonably secure, enterprises must consider the complexity of not only their own architectures, the products and services they run, but also all of the third-parties their vendors and suppliers rely upon as well as all of the third-party software dependencies. A bad actor anywhere along the chain can potentially place any organization at increased risk.
No organization is an island, so there’s no easy way to contend with this — no one can build their own hardware, software, operating systems (although some have tried) and provide all of their own support services. Organizations need to find a way to mitigate the risks associated with supply chain security. That’s where a recent update from NIST comes in.
The Best Practices in Cyber Supply Chain Risk Management, based on the 1.1 Cybersecurity Framework. Essentially the guide stresses that cybersecurity best practices call for the cybersecurity supply chain to be viewed as a function that touches sourcing, vendor management, supply chain continuity and quality, transportation security and many other functions across the enterprise and require a coordinated effort to address.
Here are the cybersecurity supply chain principles as they are laid out by NIST:
Develop your defenses based on the principle that your systems will be breached. When one starts from the premise that a breach is inevitable, it changes the decision matrix on next steps. The question becomes not just how to prevent a breach, but how to mitigate an attacker’s ability to exploit the information they have accessed and how to recover from the breach.
Cybersecurity is never just a technology problem, it’s a people, processes and knowledge problem. Breaches tend to be less about a technology failure and more about human error. IT security systems won’t secure critical information and intellectual property unless employees throughout the supply chain use secure cybersecurity practices.
Security is Security. There should be no gap between physical and cybersecurity. Sometimes the bad guys exploit lapses in physical security in order to launch a cyber-attack. By the same token, an attacker looking for ways into a physical location might exploit cyber vulnerabilities to get access.
Examples of Cyber Supply Chain Best Practices: Companies have adopted a variety of practices that help them manage their cyber supply chain risks. These practices include:
The best practices also call for reviewing the security of suppliers by reviewing hardware/software vendor’s security processes, their mitigation techniques, ongoing Vulnerability management, and more.
Enterprises have long focused on the security of their internal systems, but flaws within widely-used opensource applications as well as attacks on services providers like Wipro show that enterprises are going to have to start paying more attention to the security of their third-party providers as well as the security of their third-party software dependencies within their commercially acquired software.
tags
George V. Hulme is an internationally recognized information security and business technology writer. For more than 20 years Hulme has written about business, technology, and IT security topics. From March 2000 through March 2005, as senior editor at InformationWeek magazine, he covered the IT security and homeland security beats. His work has appeared in CSOOnline, ComputerWorld, Network Computing, Government Computer News, Network World, San Francisco Examiner, TechWeb, VARBusiness, and dozens of other technology publications.
View all postsDon’t miss out on exclusive content and exciting announcements!