In this lesson,
we're going to cover the different supply chain risks
that you may encounter out in the real world.
In the ever-evolving technology landscape,
understanding and mitigating supply chain risks
is a really big consideration
for cybersecurity professionals.
So, in this lesson,
we're going to focus on the potential vulnerabilities
that can arise at various points within the supply chain,
especially from hardware manufacturers, software developers,
and service providers.
First, let's look at hardware manufacturers.
At the heart of supply chain risk lies the complexities
of product manufacturing.
When you consider buying a product
like a router or a switch,
it becomes really clear and apparent
that they're composed of hundreds
of distinct little components.
Each of these components is sourced from various suppliers,
and they can each be a potential vulnerability
if they're tampered with
or if sourced from untrustworthy vendors.
So to prevent issues with our hardware,
we really need to ensure
that we conduct rigorous supply chain assessments
to trace the origins of our hardware
and to determine the integrity of the components
in our enterprise networks.
The origin of the components
within our network infrastructure
can also define the trustworthiness of the entire device
that we're looking at.
For entities with a minimal risk appetite,
such as the Department of Defense,
measures like the Trusted Foundry program
have been implemented
to ensure that all the hardware being installed
in their networks has undergone a strict check
to ensure they're authentic
and that the microprocessors in them
have been manufactured securely
to perform only their designated functions
without any kind of deviations from the known good baseline.
Another often overlooked risk
is the purchase of additional hardware
from secondary or aftermarket sources.
While these options might be budget friendly,
the risk of acquiring counterfeit
or tampered devices can be pretty high.
These devices may have been tampered with,
and their code could be modified
to include malware like a Trojan,
or they could allow remote access or unauthorized access
into your enterprise networks,
or they could cause all sorts of other operational failures.
Now, our supply chain risks are not confined solely
to the world of hardware though.
This brings us to our second type of supply chain risk,
software developers and software providers.
Often, the risk to our networks
is going to come from the software we purchase
and install onto that enterprise network.
Software developers and software providers
are integral cogs in our supply chains,
and any software that we're going to use
in our modern enterprise networks should be checked
to ensure it's properly licensed, that it's authentic,
and that the software is free
of known vulnerabilities or bugs.
Additionally, the software should be scanned
with a good antivirus or anti-malware solution
to ensure that it's free of any malicious code.
This type of software assessment is a lot easier to conduct
if the software you choose to use
is considered to be open source.
That way, you can review the entire source code
if you need to as well.
But even if you're using
a proprietary piece of software like Microsoft Office,
you can still run some simple scans
and vulnerability assessments against those programs
to ensure that they're not vulnerable to known attacks
by a threat actor.
Now, third, we have service providers
and managed service providers known as MSPs.
These service providers,
especially those offering software as a service,
pose some unique challenges to the security
of our enterprise networks.
When you entrust a service provider to access your data,
how can you ensure
that the information they're getting actually maintains
its confidentiality and integrity?
Are the managed service provider's
cybersecurity protocols robust enough
to protect all of your data?
And in the face of a security breach,
would the service provider be well equipped
to provide the necessary support and cooperation
that you might need to conduct a full scale incident response
or forensic investigation?
These are all of the types of things
that your organization needs to think about
when they're trying to make a risk decision
about whether or not to use one service provider or another.
It's all going to be based on their risk appetite
and understanding the potential ramifications
of a data breach to your organization.
So remember, supply chain risks are multifaceted,
and organizations must approach them
with a holistic strategy.
From the tangibility of hardware
to the intangibility of services,
every aspect has to undergo
a supply chain audit and assessment.
Vendor selection is going to be one
of those really important things,
and it's not just a matter of cost efficiency,
but also, you need to factor in due diligence,
historical performance, and a commitment to security
of the vendor you're considering.
Remember, in the realm of supply chain risk
to your organization's security posture,
you are only as strong as the weakest link
in that supply chain.