{"id":7654,"date":"2018-10-05T13:41:33","date_gmt":"2018-10-05T17:41:33","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=7654"},"modified":"2018-10-05T13:57:43","modified_gmt":"2018-10-05T17:57:43","slug":"chinese-microchip-story-importance-supply-chain-security","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/chinese-microchip-story-importance-supply-chain-security\/","title":{"rendered":"Chinese Microchip Story underscores importance of supply chain security"},"content":{"rendered":"

Bloomberg\u2019s bombshell report shows how a supply chain attack can wreak havoc<\/h2>\n

Yesterday morning Bloomberg released a report<\/a> that detailed how Chinese spies had been inserting microchips no bigger than the size of rice on to SuperMicro motherboards. At least 30 companies and organizations that use those motherboards were affected. In many ways this epic failure in supply chain security feels like something out of a spy movie.<\/p>\n

Suffice it to say this is a big deal.<\/span><\/p>\n

\"supplyThere are myriad questions this incident raises: How will the US government view this provocation? What and how much data was compromised? Should other companies be worried about the potential for sabotage if they outsource any part of they supply chain to China?<\/p>\n

And while I could give you my opinion on any one of those, I\u2019d be a little out of my depth so instead I\u2019m going to focus on one takeaway that I do know about: supply chain security has never been more important.<\/p>\n

So, let\u2019s do a quick rundown of the Chinese Spy Chip Scandal and then talk a little bit about supply chain security.<\/p>\n

What happened with China and the tiny microchips?<\/h2>\n

Yesterday Bloomberg dropped a major report on how Chinese spies were planting tiny microchips on the motherboards of servers made in SuperMicro\u2019s Chinese production facility.<\/p>\n

The chips had been inserted during the manufacturing process, two officials say, by operatives from a unit of the People\u2019s Liberation Army. In Supermicro, China\u2019s spies appear to have found a perfect conduit for what U.S. officials now describe as the most significant supply chain attack known to have been carried out against American companies.<\/p><\/blockquote>\n

As Bloomberg explains, there are generally two methods that intelligence agencies can use to alter the physical hardware of a device. The one favored by the US, which we know thanks to Edward Snowden, is called interdiction. It\u2019s also a form of supply chain attack, but it focuses more on the logistics, intercepting the hardware at some point en route to one destination or another so that it can modify it and then let it continue along its way.<\/p>\n

\"supplyChina doesn\u2019t have to do that, owing to the fact that so many of the devices they would potentially want to modify are manufactured within its borders: 75% of the world\u2019s mobile devices and 90% of its computers. This kind of supply chain attack is called a seeding attack, and up until this point it seemed like more of a hypothetical than something that could be done with any practicality.<\/p>\n

Obviously, Bloomberg\u2019s report would indicate that line of thinking was wrong.<\/p>\n

This came to light because Amazon was considering the acquisition of a company called Elemental that sold video compression services. The motherboards that Elemental servers used were made by a San Diego-based company called SuperMicro, that had its production facility in China where the seeding attack took place.<\/p>\n

During the ensuing top-secret probe, which remains open more than three years later, investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.<\/p>\n

This attack was something graver than the software-based incidents the world has grown accustomed to seeing. Hardware hacks are more difficult to pull off and potentially more devastating, promising the kind of long-term, stealth access that spy agencies are willing to invest millions of dollars and many years to get.<\/p><\/blockquote>\n

Already today, Apple and Facebook have admitted that they were targeted, though Apple did initially issue a denial. And I\u2019m sure over the coming days and weeks this story is going to continue to develop.<\/p>\n

Here\u2019s a visualization of how the hack worked, as provided by Bloomberg<\/p>\n

\"\"
Visualization by Bloomberg<\/figcaption><\/figure>\n

What does this say about supply chain security?<\/h2>\n

Let\u2019s start with what our working definition for supply chain security is going to be. What occurs with actual hardware modification is exceedingly rare and kind of the nuclear level disaster of supply chain attacks. What we tend to refer to (at The SSL Store) with regard to supply chain security is more along the lines of cybersecurity.<\/p>\n

\"supplyBut before we get into that, the biggest takeaway from this should be how one mistake, anywhere on your supply line, can be catastrophic. We\u2019ve written about it plenty of times here because we spent so much time covering GDPR compliance, but having the best cybersecurity implementations in the world can be rendered entirely moot if one of your partners drops the ball. That\u2019s why the GDPR requires data processing agreements and companies are supposed to audit their partners\u2019 security.<\/p>\n

But I\u2019d also be remiss if I didn\u2019t point out that no amount of planning could have probably anticipated state-sponsored sabotage.<\/p>\n

Despite that, this is still a good time to go over some supply chain cybersecurity best practices. So here goes:<\/p>\n

Supply Chain Security Best Practices<\/h2>\n

According to the US National Institute for Standard and Technology<\/a>, you should construct your supply chain cybersecurity plan around three principles:<\/p>\n

    \n
  1. Assume you will be breached. Start from the premise that a breach is inevitable.<\/li>\n
  2. Understand cybersecurity isn\u2019t just a technology problem, it\u2019s a people and processes problem, too.<\/li>\n
  3. Don\u2019t divorce physical security from cybersecurity\u2014security is security.<\/li>\n<\/ol>\n

    \"supplyNow, before you can start getting into specific security implementations you\u2019re going to need to perform a risk assessment<\/a>. We\u2019re not going to go too in-depth on that topic today (if you want to take a deep-dive I suggest you read the article), but the general idea is that you need to start by categorizing the types of risk you\u2019ll face and their severity. And then start to look at strategies that will mitigate attacks and minimize risks.<\/p>\n

    Some of the concerns you\u2019ll have from a supply chain standpoint will be third-party vendors or service providers with physical or virtual access to your company. Or security issues or lack of security from your partners. Or potentially purchasing hardware or software that is already compromised. And then there are software vulnerabilities in supply chain management or supply lines and even concerns about third-party data storage and data aggregators.<\/p>\n

    Ok, so let\u2019s get into some actual examples of Supply Chain Cybersecurity Best Practices:\"supply<\/p>\n