{"id":14942,"date":"2020-03-02T16:32:00","date_gmt":"2020-03-02T16:32:00","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2020\/03\/02\/how-to-secure-the-us-governments-technology-supply-chain\/"},"modified":"2026-08-08T17:58:30","modified_gmt":"2026-08-08T17:58:30","slug":"how-to-secure-the-us-governments-technology-supply-chain","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/opinion\/2020\/03\/02\/how-to-secure-the-us-governments-technology-supply-chain\/","title":{"rendered":"How to secure the U.S. government\u2019s technology supply chain"},"content":{"rendered":"\n

Fears of a full-on cyberattack, or more insidious scattered technical invasions, have escalated since the 2016 U.S. presidential election was found to be influenced by foreign hacking. More recently, unrest in the Middle East following U.S. threats of war against Iran, as well as the 2020 elections have fueled concerns about vulnerability in the American government\u2019s technical supply chain. <\/p>\n\n\n\n

At the same time the U.S. government is working to prevent foreign telecommunications firms like China-based Huawei from building 5G networks in the United States, as well as for allies\u2019 networks that they could breach, the country could face a more menacing risk from its own IT supply chain exposure.<\/p>\n\n\n\n

Comprehensive policies lacking<\/b><\/p>\n\n\n\n

The U.S.-China Economic and Security Review Commission in a 2018 report<\/a> on this threat declared that U.S. government laws and policies do not currently address supply chain risk management comprehensively. The commission, created by Congress to report on the national security implications of the U.S.-China trade relationship, stated that Chinese companies are used to further state goals and target U.S. federal networks and those of its contractors.<\/p>\n\n\n\n

\u201cThe U.S. government needs a national strategy for supply chain risk management (SCRM) of commercial supply chain vulnerabilities in U.S. federal information and communications technology (ICT), including procurement linked to the People\u2019s Republic of China,\u201d the report warned<\/a>.<\/p>\n\n\n\n

Future risks to the supply chain will involve software, cloud-based infrastructures and hyper-converged products, rather than simply hardware, the report said. The business alliances, investment sources and joint research of vendors, suppliers or manufacturers are also sources of risk that are not always included in traditional supply chain risk assessment. <\/p>\n\n\n\n

Similar worries plague large private-sector organizations, and for good reason: Securing a complex technology supply chain can\u2019t begin until it\u2019s understood where the dangers lie, and how to implement a course of action that builds resiliency in that supply chain.<\/p>\n\n\n\n

The U.S. government\u2019s chief information security officer, Grant Schneider, in December 2019 told a technology security summit<\/a> that there are still few answers on how to secure the government\u2019s technology supply chain. \u201cCould [a company] come under the influence of a foreign adversary in any way shape or form? Is there quality where we need it to be? \u2026 How do we ensure their supply chain and the parts that they\u2019re taking in and putting inside their box are actually the parts they\u2019re expecting?\u201d<\/p>\n\n\n\n

Who should be the auditor?<\/b><\/p>\n\n\n\n

The federal government isn\u2019t certain whether it should conduct its own assessments of which technology contractors in its chain are meeting requirements, or whether that assessment function should be handled by a third party, Schneider admitted<\/a>. The vetting responsibility gains urgency when you realize many of the U.S. government\u2019s technology suppliers are foreign entities that could be susceptible to interference by adversarial nations or rogue terrorist actors.<\/p>\n\n\n\n

In light of the unease of the U.S. government\u2019s top cybersecurity boss over weaknesses in the nation\u2019s technology supply chain, here are several recommendation on how to keep you supply chain secure.<\/p>\n\n\n\n