-: Supply Chain Assessment.
In this lesson,
we're going to talk about supply chain assessment
and why it's so important.
When you think about supply chain assessment,
and more largely, supply chain management,
you have to think about all the components
that go into a particular product.
So, for example, when I buy something off the shelf
and I get something like a router or a switch,
there are hundreds of different pieces inside of that.
And each of those pieces could have been tampered with
by somebody along the way.
By conducting a supply chain assessment,
you're going to be able to understand
where those parts come from,
and can you trust that end product.
Now, I'm not saying you need to go down
to the individual component here.
But you do have to understand
where do the devices
that you're putting into your network come from,
and can you trust them?
After all, we're trying to conduct secure working
in an unsecure environment.
And this involves mitigating the risks
that are caused by the supply chain.
Now, to create a trusted computing environment,
an organization really has to ensure
that the operation of every element,
which includes the hardware, the firmware, the drivers,
the operating systems, and the applications,
are all consistent and tamper-resistant.
If you can do that,
you will have created a trusted computing environment.
Now, in some organizations,
this is really, really important.
In others, it's not nearly as important.
And so, this is going to be one of those things
that the risk appetite of your organization
is going to define how much time, effort, and resources
you put into this concept of supply chain assessment.
Now, when you get a new vendor,
you should conduct due diligence.
Now, due diligence is a legal principle that says
the subject has used best practice or reasonable care
when setting up, configuring, and maintaining a system.
When you're trying to hire a vendor,
you need to ensure that they have done due diligence
on their supply chain
and you need to do your due diligence on them.
This includes things like ensuring
that their cybersecurity program is properly resourced.
You also want to make sure that they have security assurance
and risk management processes and programs in place.
And by doing this,
this will help make sure that they have a valid organization
and a way of doing due diligence within themselves.
Another thing you want to look at
is the product support lifecycle.
If you're going to buy a product, you need to make sure that
they're going to be able to support it for the long term.
For example, if you buy Microsoft Windows,
you know that they're going to give you
patches and updates and support
for a certain amount of time.
That's known as its end-of-life date.
That's part of the product support lifecycle.
If I buy a product from some brand new company,
do I know they're going to be around in five years
when I have a problem and need them to solve it?
This is all things you have to consider
as part of your due diligence.
Another thing you want to consider
is do they have the proper security controls in place
for confidential data?
If you're giving them access to your data
because they're doing something like Software-as-a-Service,
you want to make sure
they have the proper security controls in place
to ensure your data remains confidential.
Another thing you have to think about
is when things go wrong, will they be there to help you?
If you have to conduct an incident response
or do forensic investigations,
will that company be able to support you
and provide you assistance?
And finally, we want to think about
the general and historical company information.
When you look at a company,
do they have strong enough financials
that they're going to be in business next year
to support your needs?
Or are they going to be a fly-by-night organization
that's out of business in the next six to 12 months?
These are all things you want to consider
as you're doing your due diligence.
Now, your due diligence
should apply not only to your suppliers,
but also to your contractors.
If I'm going to hire people to work on my team as contractors,
I need to do due diligence on them
and make sure I can trust them.
Now, another area that we have to start talking about
is this concept of the hardware itself.
I mentioned earlier,
you have to think about where does this hardware come from?
And based on your organization,
you're going to either have more or less
of a risk appetite for hardware.
Now, one of the organization that has a very low tolerance
or low risk appetite for hardware
is the Department of Defense,
and so they create something known as the trusted foundry.
Now, the trusted foundry
is a microprocessor manufacturing utility
that's part of a validated supply chain,
one where the hardware and software
does not deviate from its documented function.
And again, this was created and operated
by the Department of Defense,
which is the US military
because if they're going to put up a microprocessor
to run a jet or a bomb or something like that,
they want to make sure
it does exactly what it's supposed to do
each and every time.
And that's what the trusted foundry program is all about.
For the exam,
you really just need to understand that trusted foundry
is a way to ensure that microprocessors
in the supply chain are secure,
and it's run by the Department of Defense.
Now, another thing we want to talk about
is hardware source authenticity.
This is the process of ensuring the hardware
is procured tamper-free from trustworthy suppliers.
Now, the idea here is
we have to know where our stuff comes from.
Now, if you need a new router,
do you buy it directly from Cisco
from one of their authorized resellers,
or do you go on eBay and buy a secondhand one?
Well, depending on which way you do,
that thing is going to be more or less trustworthy.
There is a much greater risk of inadvertently obtaining
counterfeited or compromised devices
when you purchase from secondhand or aftermarket sources.
So, whenever possible, go straight to the source.
When I look at these routers and switches,
just by looking at them,
I can't tell if they've been modified on the inside.
This is something that can be done inside of those machines.
And there's been cases where there has been malware
embedded into the firmware of these devices
or extra chips being put inside these devices.
And then they're sold at a cheap price online.
And that way, you install this
and now they have access to your entire network.
So, you have to be careful with this stuff.
And that is why supply chain assessments
are so critical to the security of your network.