Today, we have a ubiquitous reliance on information and communications technology (ICT), and the integrated networks through which we live, work, play and learn. We are embracing advancements in mobility, cloud and collaboration, delivered by the Internet of Everything (IoE): the connection of people, processes, data and things.
Coincident with a mobile life impacted by the IoE is an ever-changing and increasingly complex threat landscape. That landscape includes hardware tampering, gray market, counterfeit, espionage, and software manipulation effected by individuals and groups. The result: an increasing need for security. But not just end point security, rather, a comprehensive approach to security.
Strong security solutions like trusted hardware anchors, firewalls, intrusion detection, web security, email security, etc., which protect networks are plentiful. Securely embedding such technologies into the fabric of the network is essential to protection from disruption. But it isn't where security starts and is only the tip of the iceberg.
Embedding Security in the Supply Chain
From an ICT original equipment manufacturer’s (OEM’s) perspective, a secure network requires protecting the essential elements of the network before they ever become a part of a customer's solution. And that protection can only start with the supply chain. Without a secure supply chain, technology can be modified or substituted—potentially allowing a third party to learn confidential information or manipulate a customer's information systems.
So, how do you begin that process? Addressing the ICT threat landscape requires an end-to-end approach to securing the supply chain. That approach must comprehensively cover the entire ICT product lifecycle:
- The design and development of products.
- Planning, sourcing, manufacturing and distribution of hardware or software, including obtaining components for printed circuit board build and test, final assembly, and final test of finished products, storage, and delivery.
- Post-delivery (also called sustainment), including upgrading and servicing products.
- Handling technology at the end of its useful life (also called disposal), including product return, destruction and/or refurbishment.
To embrace that product lifecycle, we must define, embed, and monitor the technologies and processes that have security at their core, and then deploy them in the right node of the supply chain at the right time.
Defining Your Threat Landscape
ICT OEMs interact with a complex ecosystem of suppliers, including logistics, electronic manufacturing services (EMS), original design manufacturing services (ODMs) and commodity suppliers for components, such as printed circuit boards, semiconductor chips and memory. Committing to driving security comprehensively across the nodes of the supply chain requires that you identify your key security threats. While supply chains vary, they all share three common threats—manipulation, espionage and disruption.
These common threats give rise to exposure to taint, counterfeit and intellectual property (IP) misuse:
- Taint is alteration allowing unauthorized control or content visibility.
- Counterfeit means raw materials or finished goods that are not authentic.
- IP misuse leads to IP knowledge, allowing for unfair business competition.
An Approach to Driving Supply Chain Security
Once you identify your threats and map your end-to end supply chain, you are prepared to develop an approach to drive your security mission. Three key principles can help you get started:
- First, make sure your supply chain organization is at the table with engineering, and actively participating in the design and development process. Supply chain practitioners can add real value by specifying secure design requirements, techniques, and practices with raw material, build and logistics partners.
- Second, develop and clearly communicate customized security requirements to your suppliers in each of the supply chain nodes.
- Finally, don’t forget what happens after delivery. Establish monitoring security practices beyond the delivery stage. Ensure that those practices are embraced by your suppliers to cover the use, service, upgrade and ultimate end-of-life management of products.
Next, consider mixing and matching from among the various types of security, and apply them to the right node of the supply chain as appropriate. Establish and deploy a three-dimensional approach:
- Physical security practices that include physical aspects of security, such as camera monitoring, security checkpoints, alarms and biometric access controls.
- Logical security processes that include systematic, repeatable, and auditable security processes designed to target areas of security risk, and the threats of counterfeit or tainted products or misused IP. Examples include ensuring that data is transmitted in encrypted form, as permitted by local law, establishing and validating adherence to scrap handling processes.
- Security technology that includes applying technological innovation to enhance counterfeit detection, terminate functionality, or identify a non-authorized component or user. Examples include smart chips, data extracting test beds and tamper-resistant security labels.
Here are some concrete disciplines you can use to achieve your supply chain security goals:
- Secure development—a controlled set of practices and technologies deployed throughout the vendor’s product development methodology, including product design requirements and policies that prohibit the inclusion of “back doors” to gain unauthorized access;
- Information exchange and access control—controls on how information is shared, by what means, in what format and who may have access to it;
- Physical plant security—physical security requirements for the places where suppliers engage in warehousing, transport, manufacturing, repair, and recycling or destruction services;
- Talent security and integrity—practices to ensure that global supply chain personnel are screened (as permitted by law) upon hire, supplier ethics, and practices to understand and monitor information exchange throughout the supply chain, including with customers;
- Protection of high-value intellectual property containing components and finished goods—practices focusing uniquely on this high-risk subset of raw materials and final products;
- Supplier resiliency and crisis management—comprehensive review, monitoring and assurance of suppliers’ capabilities to swiftly react to natural disaster, geo-political disturbance and financial volatility, and ensure continuity of supply;
- Logistics security—transport, storage, cargo handling and loss avoidance practices;
- Fabrication security—those aspects of security relating to the obtaining of components for, build and test, final assembly, and final test of ICT products and solutions;
- Scrap management—all aspects of managing production scrap that may contain intellectual property or key components or information within each stage of the ICT OEM’s supply chain (such as design documents, printed circuit board assemblies that failed quality testing and defective security labels);
- Service and end-of-life security management—practices to ensure security during the provision of repair or upgrade services, take-back and return of product, and product disassembly, destruction and non-functional element recycling (such as metal and plastics); and
- Supplier accountability—embedding security and adherence to the ICT OEM’s security practices into its own measurement of its supply chain performance and into the relevant operations of its suppliers.
Security Innovation for the Supply Chain
As with all supply chain capabilities, consistent and relentless focus on innovation drives improvement. A collaborative partnership across development, supply chain and supplier organizations lies at the heart of security innovation throughout the network. Areas of innovation abound.
One area worthy of exploration is the use of photographic component capture on manufacturing lines. This information can be used to identify the unauthorized alteration of electronic assemblies or finished goods. Of course, like all data, the volume of such information can grow exponentially. The use of automated big data techniques that alleviate the burden of human analysis is an essential corollary to render such information usable.
Factories of the future may wish to consider leveraging sensor data to identify potential security anomalies. Early detection of potential anomalies can serve as a weapon in the fight to prevent maliciously altered ICT solutions from reaching the hands of end users. Thoughtful collaboration with members of your ICT supply is an essential part of this vision. Determining what sensors, placed where in the process, to gather what data lies at the heart of architecting a secure factory plan. Careful consideration is required to ensure that expenditures are cost-effective and that the data gathered provides meaningful security insight.
A number of other areas are ripe for consideration by ICT OEMs and their supply chain partners. Some of those include:
- Securing access and investigating securing Joint Test Action Group (JTAG) standard test access port architecture (see IEEE 1149.1) as a key point of central processing unit (CPU) entry.
- Software watermarking.
- Data extracting test beds.
- In-test identity injection.
Together, we can set a security strategy for the supply chain. Our collaborative efforts to weave physical security practices, logical security processes and security technology through the right node of the ICT supply chain is essential to our success.
Edna Conway is the chief security officer of global supply chain at Cisco Systems.