The document discusses securing the ICT supply chain from cyber threats. It provides examples of past cyber attacks that targeted software supply chains, such as the Xcode Ghost attack in 2015 that compromised the iOS app developer toolchain. The document also discusses the risks of hardware supply chains being compromised through tactics like planting spy chips during the manufacturing and distribution process, as was reported done by the NSA on Cisco routers and servers from Amazon and Apple. It advocates breaking the cyber kill chain and securing different components of the ICT supply chain from chips to end customers to help stop threats.

1. Cyber Norms: Securing the
ICT Supply Chain
United Nations Singapore Cyber Programme 2019
Benjamin Ang,
Head Cyber Homeland Defence, CENS RSIS NTU
Twitter @benjaminang

2. Part of the software supply chain
Source
Code
Compiler
Binary
Code

3. XCode Ghost 2015 (Part 1)
IOS App
Developer
IOS XCode
Compiler
IOS App

4. XCode Ghost 2015 (Part 2)
IOS App
Developer
Ghost
Compiler
IOS App
Hello,
Beijing

5. MeDoc Tax Accounting software (2017)
updates
NOTPETYA

6. Everything is modular
https://www.msn.com/en-sg/?AR=1

7. Hardware supply chain: Where are you?
chips
computers
printers
routers
Packaging &
Distribution
customers
Snowden: NSA planted
bugs in Cisco Routers

8. Snowden: NSA planted bugs in Cisco routers

9. Bloomberg: Spy chip planted in Amazon,
Apple, US DOD servers

10. Don’t Panic

11. Stop threats
along the
Network
Layers

12. Break the
Cyber Kill
Chain
Reconnaissance
Weaponize
Delivery
Exploit
Install
Command
& Control
Action

13. Post It: What can you secure, and how?
chips
computers
printers
routers
Packaging &
Distribution
customers