Month'S This National Supply Chain Focus Integrity Month

VOLUME 3 ISSUE 4April 2022THISMONTH’SFOCUSDID YOU KNOW?Protecting the ICT supplychain is a supply chainsecurity force-multiplierfor all other critical supplychains.CDSE – Center for Development ofSecurity Excellence@TheCDSECenter for Development ofSecurity ExcellenceCDSE PulsePublished by the DefenseCounterintelligence and Security Agency(DCSA) Center for Development ofSecurity Excellence (CDSE) Marketing andCommunications Office.DCSA LeadershipWilliam K. Lietzau Daniel LecceDirector, DCSADeputy Director, DCSAKevin JonesAssistant Director,TrainingErika RagoneseDeputy AssistantDirector, TrainingCDSE LeadershipHeather MardagaDirectorZinethia ClemmonsChief, Shared ServicesPulse StaffAdriene BrownSamantha DambachChief Content Officer Natalie PerkinsContent Developers/Isaiah BurwellManagersContent WriterMarc PulliamContent DesignerNATIONAL SUPPLY CHAININTEGRITY MONTHNATIONAL SUPPLY CHAIN INTEGRITY MONTH:A CALL-TO-ACTION CAMPAIGNThis April marks the fifthannual National SupplyChain Integrity Monthfor organizations acrossthe country. During themonth, the Departmentof Defense (DOD), theOffice of the Directorof National Intelligence(ODNI), the Cybersecurityand Infrastructure SecurityAgency (CISA), and othergovernment and industrypartners will promote acall-to-action campaign to“Fortify the Chain.”For this month, the NationalCounterintelligence andSecurity Center (NCSC),located within ODNI, hasreleased new supply chainrisk management resourcesto help industry andgovernment stakeholders.Visit the NCSC supplychain website to findinformation on supplychain threats, bestpractices, and links to otherpartner agency resources.As the Nation’s riskadvisor, one of CISA’s toppriorities is to help securethe global informationand communicationstechnology (ICT) supplychain from emergingthreats. ThroughoutApril, CISA is promotingresources, tools, andinformation to helporganizations and agenciesprotect their ICT supplychains. To access CISA’sonline resources visit theirSupply Chain IntegrityMonth webpage.The Center forDevelopment of SecurityExcellence (CDSE)scheduled two webinarsto support Supply ChainIntegrity month. The firstevent “Supply Chain Past,Present, and Future” washeld on April 7. If youmissed it, there will beanother opportunity toview the webinar onceit is posted online. Thereis still time to registerfor our second event“Microelectronics andSupply Chain 2022” onThursday, April 28, 2022,12:00 – 1:00 p.m. ET. Joinus for this live discussionthat will go in-depth onmicroelectronics issues andconcerns, practical stepsthe security community cantake, and what we need tobe aware of to secure themicroelectronics supplychain.CISA THEMES FOR THE MONTH INCLUDE:Week 1: Power in Partnership – Fortify the ChainWeek 2: No Shortages of Threats – Educate to MitigateWeek 3: Question, Confirm, and Trust – Be Supplier SmartWeek 4: Plan for the Future – Anticipate ChangeSign up for the latest security awareness newsletters at https://www.cdse.edu/news/index.html1

VOLUME 3 ISSUE 4April 2022A JOINT EFFORT: SECURING THE ICT SUPPLY CHAINThis year’s NationalSupply Chain IntegrityMonth theme focuses onsecuring the informationand communicationstechnology (ICT) supplychain and ExecutiveBranch efforts to addressthis critical issue. Everycompany, organization,and individual that usesICT products and services,such as cell phone devices,online banking, and cloudcomputing, is part of aglobally connected supplychain.“This year’s campaign isfocused on fortifyingthe U.S. Informationand CommunicationsTechnology (ICT) supplychain, which powersAmerica’s nationalsecurity missions,critical infrastructuresectors, and privatesector innovations,” saidMichael Orlando, SeniorOfficial Performingthe Duties of NCSCDirector.”Supply chain risk increaseswhen adversaries attemptto exploit ICT and theirrelated supply chains forthe purposes of espionage,sabotage, and foreigninterference activity.Vulnerabilities in supplychains, either developedintentionally for maliciousintent or unintentionallythrough poor securitypractices, can enable dataand intellectual propertytheft, loss of confidence inthe integrity of the system,or exploitation to causesystem or network failure.Increasingly, adversaries,including foreignadversaries such as Russia,China, North Korea, andIran, are looking at thesevulnerabilities as principalattack vectors.According to one privatesecurity report, softwaresupply chain attacksmore than tripled in 2021compared to 2020. Theexploitation of thesevulnerabilities raised thebar for software securityand the need for morepublic-private partnerships.provide recommendationsand guidance to helpshape trusted supply chainpractices.Over the next severalmonths, the Task Force’sefforts will include thelaunch of a new HardwareBill of Materials WorkingGroup, continuation oftwo current workinggroups, and scoping of twoadditional efforts relatedto promoting softwareassurance and, the utility ofSoftware Bill of Materials.The ongoing COVID-19pandemic highlightedvulnerabilities in complexglobal supply chains invery real ways to the public,government, and industry.In order to strengthenthe national industrialbase during times ofdisruption, the Presidentsigned Executive Order(E.O.) 14017 on February24, 2021. The E.O. calls fora comprehensive reviewof supply chains in criticalsectors, including thedefense industrial base(DIB).In response to E.O.14017, the Departmentof Commerce andDepartment of HomelandSecurity released aone-year report titled,“Assessment of the CriticalSupply Chains Supportingthe U.S. Informationand CommunicationsTechnology Industry.”The report defines thecritical sectors andsubsectors supportingthe ICT industry, evaluatesIn December 2018, CISAestablished the ICT SupplyChain Risk Management(SCRM) Task Force. TheICT SCRM Task Force is apublic-private partnershipfocused on global ICTsupply chain security. Itis composed of a diverserange of professionalswithin the InformationTechnology andCommunications Sectorswith representatives fromlarge and small privatesector organizations andfederal agencies. Thisincludes subject matterexperts, infrastructureowners and operators, andother key stakeholders whoSign up for the latest security awareness newsletters at https://www.cdse.edu/news/index.html2

VOLUME 3 ISSUE 4April 2022the current supply chainconditions, identifieskey risks that threatento disrupt those supplychains, and proposeseight recommendations tomitigate risk and strengthensupply chain resiliency.DOD also released thereport “Securing DefenseCritical Supply Chains,”February 24, 2022, inresponse to E.O. 14017.This report outlinesgovernment and nationalstrategies for assessing andstrengthening critical DIBsupply chains.“This report is a strategicroadmap for thedepartment to buildlasting resilience in ourdefense industrial base.”Andrew Hunter, ActingUnder Secretary ofDefense for Acquisitionand Sustainment.In the report, DODhighlights a set of strategicenablers that underpinoverall mission success andsupply chain resilience. Oneof those strategic enablersis cyber posture. MakingCybersecurity-Supply ChainRisk Management (C-SCRM)a priority was identified askey to enhancing supplychain cyber resilience.Cybersecurity-SupplyChain Risk Management(C-SCRM) efforts managesupply chain risk byidentifying susceptibilitiesand vulnerabilities tocyber-threats throughoutthe supply chain anddeveloping mitigationstrategies to counterthose threats whetherpresented by the supplier,the supplier’s products andits subcomponents, or thesupply chain (e.g., initialproduction, packaging,handling, storage, transport,mission operation, disposal).Several organizationsprovide C-SCRM trainingand resources forgovernment and industrypersonnel. NCSC, CISA andCDSE all have a wealthof training and resourcesavailable to increaseC-SCRM knowledge andraise awareness of threats,mitigations, and bestpractices to improve supplychain integrity. Theselearning and awarenessresources are designed toemphasize the role thatwe all have in securing ICTsupply chains.ICT products and servicesensure the continuedoperation and functionalityof U.S. critical infrastructure.When a supply chainincident occurs, everyonesuffers: buyers, suppliers,and users. Governmentand industry partners havecome together to combatthe threats to ICT. Securingthe global ICT supply chainfrom the evolving risks oftomorrow through trainingand awareness should bea priority for industry andgovernment personnel.Sign up for the latest security awareness newsletters at https://www.cdse.edu/news/index.html3

VOLUME 3 ISSUE 4April 2022SUPPLY CHAIN INTEGRITY RESOURCESCDSE has several toolkits that include courses to enhance supply chain knowledge and performance support toolsthat provide information to help perform role-based tasks and raise understanding and awareness of supply chain riskmanagement policies, potential threats/vulnerabilities, and mitigation strategies: Acquisition isition-Toolkit/ Counterintelligence Awareness Toolkit: Supply Chain Risk Management ntelligence-Awareness-Toolkit/ Cybersecurity: Supply Chain Risk Management urity-Toolkit/ Insider Threat Toolkit: Cyber Insider Threat/User Activity Monitoring Threat-Toolkit/ Deliver Uncompromised ver-Uncompromised-Toolkit/ Operation Warp Speed (OWS) and Beyond ation-Warp-Speed-and-Beyond-Toolkit/This includes several supply chain integrity month posters: Insider Risk in Software Supply -chain/ Keep the Troops /Article/2753947/supply-chain-month/ Deliver UncompromisedINSIDER RISKIN SOFTWARESUPPLY CHAINSOUR SOFTWARE MAY BETRUSTED, BUT IS IT SECURE?A software supply chain attack occurswhen malicious code is deliberately addedto a component, with intent to distributethe malicious code to a target furtherdown the supply chain. These attacks aimto compromise systems and data, and mayalso cause collateral damage.INSIDERS:VULNERABILITIES TOSOFTWARE INTEGRITY:ENHANCE SOFTWAREINTEGRITY WITH:Create source code, design applications, andcontribute to software developmentInsiders wittingly or unwittingly introducemalware to applicationsReview, test, and license applicationsfor usageInsiders utilize un-vetted dependenciesduring developmentCode signing: code with a trusted,cryptographically secure indicator thatsoftware has been approved by itsdeveloper and not subsequently modified.Update, maintain, and repair existingsoftwareInsiders fail to patch software or delaydeployment of more secure applicationsHashing: unique strings of informationgenerated by hashing algorithms,distributed by developers to verify softwarehas not been modified.Share, distribute, and utilize applicationsUser Activity Monitoring: detect anomalousor concerning network behaviors that mayput the organization at s/Article/2753845/deliver-uncompromised-campaign/ Supply Chain Resilience member: Trusted insiders have access to assets at all stages in the supply chain. Damage to the supply chain caused by insiders may leadto reduced military strength and mission readiness; loss of reputation, innovation, and industry advantage; and financial instability.Center for Developmentof Security Excellencewww.cdse.eduNCSC and CISA also have resources to raise awareness and educate industry and government personnel on supply chainintegrity issues and best practices: NCSC Supply Chain Risk we-do/ncsc-supply-chain-threats NCSC Awareness areness-materials CISA National Integrity onth CISA ICT Supply Chain ry CISA ICT Supply Chain it ICT SCRM Task Forcehttps://www.cisa.gov/ict-scrm-task-forceSign up for the latest security awareness newsletters at https://www.cdse.edu/news/index.html4