Cyber Risks in the Supply Chain

1. Cyber Security Supply Chain
Risks and Governance
By: David NJOGA – Cyber GRC Expert (NC3)
CONFIDENTIAL 1

2. CONFIDENTIAL
Aim
• Apprise the participants on the cybersecurity governance
principles, and their alignment towards effective supply chain risks
treatments to enhance national security.
CONFIDENTIAL 2

3. CONFIDENTIAL
Scope
Introduction
Objectives
Justification
Supply Chain Risks
Supply Chain Risks Treatment Plans
Conclusion
Plenary
CONFIDENTIAL 3

4. CONFIDENTIAL
Introduction
• Cyber Security Governance provides strategic visibility into
business risks based on cyber threats to:
• achieve compliance requirements
• improve the nation’s overall cyber security posture
CONFIDENTIAL 4

5. CONFIDENTIAL
Objectives of Cyber Security Governance
• To provide pivotal cyber governance activities
for effective and efficient national cyber
operations to improve national security.
CONFIDENTIAL 5
Fig. 1: NIST Cybersecurity Framework v1.1

6. CONFIDENTIAL
Objectives of Cyber Security Governance. . .
• Cyber Governance is concerned with
value delivery from digital transformation
and the mitigation of business risk that
results from digital transformation.
CONFIDENTIAL 6
Benefits
Realization
Risk
Optimization
Resource
Optimization
Fig. 2: COBIT 2019 Value Chain

7. CONFIDENTIAL
Components of Cyber Governance System
CONFIDENTIAL 7
Fig. 3: COBIT 2019 Governance System

8. CONFIDENTIAL
Key Roles, Activities and Relationships
CONFIDENTIAL 8
Fig. 4: COBIT 2019 Governance vs Management

9. CONFIDENTIAL
Justification
CONFIDENTIAL 9

10. CONFIDENTIAL
Supply Chain
• Cybersecurity in the supply chain cannot be viewed as an IT
problem only!
• Cyber supply chain risks touch sourcing, vendor management,
supply chain continuity and quality, transportation security
and many other functions across the enterprise.
• Cyber supply chain risks require a coordinated effort to address.
CONFIDENTIAL 10

11. CONFIDENTIAL
CONFIDENTIAL 11

12. CONFIDENTIAL
Some Cyber Attacks
NotPetya ransomware hit global businesses in approximately 59
countries in late June 2017; an attack which prevented one of the
largest container shippers, Maersk Line, from taking new orders
Superfish adware installed on Lenovo notebooks could intercept
encrypted https traffic (2014-2015)
Exploitation of internet of things (IoT) sensors
Bogus traffic attacks from Google Traffic Analytics
CONFIDENTIAL 12

13. CONFIDENTIAL
Cyber Supply Chain Security Principles
Develop your defenses based on the principle that your systems
will be breached.
Cybersecurity is never just a technology problem, it’s a people,
processes and knowledge problem.
Security is Security.
CONFIDENTIAL 13
“Sharing information with suppliers is essential, yet increases the risk of that
information being compromised” (Bowman 2013).

14. CONFIDENTIAL
Supply Chain Risks
• Cyber supply chain risks covers a lot of territory. Some of the concerns
include risks from:
Third party service providers or vendors to software engineering.
Poor information security practices by lower‐tier suppliers.
Compromised software or hardware purchased from suppliers.
Software security vulnerabilities in supply chain management or
supplier systems.
Counterfeit hardware or hardware with embedded malware.
Third party data storage or data aggregators.
CONFIDENTIAL 14

15. CONFIDENTIAL
Appreciation of suppliers’ cybersecurity practices
Is the vendor’s software / hardware design process documented?
Repeatable? Measurable?
Is the mitigation of known vulnerabilities factored into product
design?
How does the vendor stay current on emerging vulnerabilities?
What controls are in place to manage and monitor production
processes?
CONFIDENTIAL 15

16. CONFIDENTIAL
Appreciation of suppliers’ cybersecurity practices …
How is configuration management performed? Quality assurance?
What levels of malware protection and detection are performed?
What steps are taken to “tamper proof” products? Are backdoors
closed?
What physical security measures are in place? Documented?
Audited?
What access controls, both cyber and physical are in place? How are
they documented and audited?
CONFIDENTIAL 16

17. CONFIDENTIAL
Appreciation of suppliers’ cybersecurity practices …
What type of employee background checks are conducted and how
frequently?
What security practice expectations are set for upstream suppliers?
How is adherence to these standards assessed?
How secure is the distribution process?
Have approved and authorized distribution channels been clearly
documented?
What is the component disposal risk and mitigation strategy?
How does vendor assure security through product lifecycle?
CONFIDENTIAL 17

18. CONFIDENTIAL
Cyber Supply Chain Best Practices
Security requirements are included in every RFP and contract.
Onsite collaboration with vendors to address any vulnerabilities and
security gaps.
“One strike and you’re out” policies with respect to vendor products that
are either counterfeit or do not match specification.
Component purchases are tightly controlled; component purchases from
approved vendors are prequalified
CONFIDENTIAL 18

19. CONFIDENTIAL
Cyber Supply Chain Best Practices…
Secure Software Lifecycle Development Programs and training for all
engineers in the life cycle are established.
Source code is obtained for all purchased software.
Software and hardware have a security handshake.
Automation of manufacturing and testing regimes reduces the risk of
human intervention.
CONFIDENTIAL 19

20. CONFIDENTIAL
Cyber Supply Chain Best Practices…
Track and trace programs establish provenance of all parts, components
and systems.
Programs capture “as built” component identity data for each assembly
and automatically links the component identity data to sourcing
information.
Personnel in charge of supply chain cybersecurity partner with every
team that touches any part of the product during its development
lifecycle and ensures that cybersecurity is part of suppliers’ and
developers’ employee experience, processes and tools.
Legacy support for end-of‐life products and platforms; assure continued
supply of authorized IP and parts.
Tight controls on access by service vendors are imposed.
CONFIDENTIAL 20

21. CONFIDENTIAL
Strategic and Systemic transformation
The strategic dimension covers setting strategy, planning and
implementing high‐level steps, and initiating a program and
related portfolio of cybersecurity projects.
The systemic dimension addresses dependencies between parts
of the cybersecurity system that will have an impact on how
change will be achieved and what will be the immediate and
secondary effects.
CONFIDENTIAL 21

22. CONFIDENTIAL
Recommendations
• Adopt Local Robust IT security solutions
• Compliance and Governance of suppliers, vendors, third-party
actors, partners, traders, manufacturers and contractors.
• Certification of International Standards
CONFIDENTIAL 22

23. CONFIDENTIAL
Conclusion
• Cyber governance needs to acknowledge the fact that attacks, incidents
and breaches always target the weakest link in the security of value
chain of the enterprise.
• Consequently, the national cyber security governance design will
address the following two dimensions:
• Basic governance provisions, e.g., expressing the intentions and
overall goals of senior executives and management;
• Extended governance provisions, e.g., guidance for processes that
handle cybercrime and cyberwarfare attacks or links to business
assurance.
CONFIDENTIAL 23

24. CONFIDENTIAL
Plenary
CONFIDENTIAL 24