Narrator: Supply chain assessment. 2 2
In this lesson, we're going to talk 3 3
about supply chain assessment and why it's so important. 4 4
When you think about supply chain assessment, 5 5
and more largely, supply chain management, 6 6
you have to think about all the components 7 7
that go into a particular product. 8 8
So for example, when I buy something off the shelf 9 9
and I get something like a router or a switch, 10 10
there are hundreds of different pieces inside of that, 11 11
and each of those pieces could have been tampered 12 12
with by somebody along the way. 13 13
By conducting a supply chain assessment, 14 14
you're going to be able to understand 15 15
where those parts come from 16 16
and can you trust that end product. 17 17
Now, I'm not saying you need to go 18 18
down to the individual component here, 19 19
but you do have to understand where do the devices 20 20
that you're putting into your network 21 21
come from and can you trust them? 22 22
After all, we're trying to conduct secure working 23 23
in an unsecure environment, 24 24
and this involves mitigating the risks 25 25
that are caused by the supply chain. 26 26
Now, to create a trusted computing environment, 27 27
an organization really has to ensure 28 28
that the operation of every element, 29 29
which includes the hardware, the firmware, 30 30
the drivers, the operating systems, and the applications 31 31
are all consistent and tamper-resistant. 32 32
If you can do that, 33 33
you'll have created a trusted computing environment. 34 34
Now, in some organizations, 35 35
this is really, really important. 36 36
In others, it's not nearly as important. 37 37
And so this is going to be one of those things 38 38
that the risk appetite of your organization 39 39
is going to define how much time, 40 40
effort, and resources you put into this concept 41 41
of supply chain assessment. 42 42
Now, when you get a new vendor, 43 43
you should conduct due diligence. 44 44
Now, due diligence is a legal principle 45 45
that says the subject has used best practice 46 46
or reasonable care when setting up, 47 47
configuring and maintaining a system. 48 48
When you're trying to hire a vendor, 49 49
you need to ensure that they have done due diligence 50 50
on their supply chain, 51 51
and you need to do your due diligence on them. 52 52
This includes things like ensuring 53 53
that their cybersecurity program is properly resourced. 54 54
You also want to make sure that they have security assurance 55 55
and risk management processes and programs in place. 56 56
And by doing this, this will help make sure 57 57
that they have a valid organization 58 58
and a way of doing due diligence within themselves. 59 59
Another thing you want to look at 60 60
is the product support lifecycle. 61 61
If you're going to buy a product, you need to make sure 62 62
that they're going to be able to support it for the long term. 63 63
For example, if you buy Microsoft Windows, 64 64
you know that they're going to give you patches 65 65
and updates and support for a certain amount of time. 66 66
That's known as its end-of-life date. 67 67
That's part of the product support lifecycle. 68 68
If I buy a product from some brand new company, 69 69
do I know they're going to be around in five years 70 70
when I have a problem and need them to solve it? 71 71
This is all things you have to consider 72 72
as part of your due diligence. 73 73
Another thing you want to consider, 74 74
is do they have the proper security controls in place 75 75
for confidential data? 76 76
If you're giving them access to your data 77 77
because they're doing something like software as a service, 78 78
you want to make sure they have the proper security controls 79 79
in place to ensure your data remains confidential. 80 80
Another thing you have to think about, 81 81
is when things go wrong, will they be there to help you? 82 82
If you have to conduct an incident response 83 83
or do forensic investigations, 84 84
will that company be able to support you 85 85
and provide you assistance? 86 86
And finally, we want to think about the general 87 87
and historical company information. 88 88
When you look at a company, do they have strong enough 89 89
financials that they're going to be in business next year 90 90
to support your needs? 91 91
Or are they going to be a fly-by-night organization 92 92
that's out of business in the next six to 12 months? 93 93
These are all things you want to consider 94 94
as you're doing your due diligence. 95 95
Now, your due diligence should apply 96 96
not only to your suppliers, but also to your contractors. 97 97
If I'm going to hire people to work on my team as contractors, 98 98
I need to do due diligence on them 99 99
and make sure I can trust them. 100 100
Now, another area that we have to start talking 101 101
about is this concept of the hardware itself. 102 102
I mentioned earlier, 103 103
you have to think about where does this hardware come from? 104 104
And based on your organization, 105 105
you're going to either have more or less 106 106
of a risk appetite for hardware. 107 107
Now, one of the organizations that has a very low tolerance 108 108
or low risk appetite for hardware, 109 109
is the Department of Defense. 110 110
And so they created something known as the Trusted Foundry. 111 111
Now, the Trusted Foundry 112 112
is a microprocessor manufacturing utility 113 113
that's part of a validated supply chain, 114 114
one where the hardware and software does not deviate 115 115
from its documented function. 116 116
And again, this was created and operated 117 117
by the Department of Defense, which is the US military, 118 118
because if they're going to put a microprocessor 119 119
to run a jet or a bomb or something like that, 120 120
they want to make sure it does exactly 121 121
what it's supposed to do, each and every time. 122 122
And that's what the Trusted Foundry program is all about. 123 123
For the exam, you really just need to understand 124 124
that Trusted Foundry is a way to ensure 125 125
that microprocessors in the supply chain are secure, 126 126
and it's run by the Department of Defense. 127 127
Now, another thing we want to talk 128 128
about is hardware source authenticity. 129 129
This is the process of ensuring the hardware 130 130
is procured tamper-free from trustworthy suppliers. 131 131
Now, the idea here is we have to know 132 132
where our stuff comes from. 133 133
Now, if you need a new router, do you buy it directly 134 134
from Cisco, from one of their authorized resellers, 135 135
or do you go on eBay and buy a secondhand one? 136 136
Well, depending on which way you do, 137 137
that thing is going to be more or less trustworthy. 138 138
There is a much greater risk of inadvertently obtaining 139 139
counterfeited or compromised devices 140 140
when you purchase from secondhand or aftermarket sources. 141 141
So whenever possible, go straight to the source. 142 142
When I look at these routers and switches, 143 143
just by looking at them, I can't tell 144 144
if they've been modified on the inside. 145 145
This is something that can be done inside of those machines. 146 146
And there's been cases where there has been malware 147 147
embedded into the firmware of these devices, 148 148
or extra chips being put inside these devices, 149 149
and then they're sold at a cheap price online. 150 150
And that way, you install this, 151 151
and now they have access to your entire network. 152 152
So you have to be careful with this stuff, 153 153
and that is why supply chain assessments are so critical 154 154
to the security of your network.