The military supply chain is vast, multifaceted, and riddled with potential cyber vulnerabilities.<\/p>\n\n\n\n
As a result, “there is [a] possible theft of data or proprietary information or classified information. There\u2019s the ability through malware to sabotage activities or to destroy the confidence in the data,\u201d said Daniel McGarvey, former director of information protection for the Air Force and a senior consultant to the federal Performance Accountability Council. \u201cThere\u2019s the threat of putting embedded malware into a system that either takes control of or actually disables the system.\u201d<\/p>\n\n\n\n
In an increasingly digital battlefield, senior leaders, experts and analysts say supply-chain cybersecurity could be a weak point in the military\u2019s armor. To remedy that, they urge closer oversight of contractors, and tighter coordination on cyber issues between military buyers and defense-industry suppliers.<\/p>\n\n\n\n
Threat window<\/b><\/p>\n\n\n\n
In a 2017 document, the Pentagon\u2019s Defense Science Board said the complex relationships in the supply chain creates a window for bad actors. \u201cThe supply chain for microelectronics parts is complex, involving multiple industry sectors. Each sector sells to each of the others,\u201d they noted. \u201cFurthermore, parts may be returned to manufacturers or distributors and subsequently reenter the supply chain making both pedigree and provenance difficult to track using current procedures.\u201d<\/p>\n\n\n\n
As a result, \u201cassuring that defense electronics are free from vulnerabilities is a daunting task,\u201d they wrote. \u201cOf particular concern are the weapons the nation depends upon today; almost all were developed, acquired, and fielded without formal protection plans.\u201d<\/p>\n\n\n\n
Analysts point to a number of factors working against the military\u2019s interest here. Waning corporate loyalty has ratcheted up the insider threat in recent years. The sheer volume of electronic components makes detailed quality-control checks impractical. Contractual requirements can push suppliers to be more diligent \u2013 but only if they are acting in good faith to begin with. \u201cThat only works for suppliers who have no malicious intent,\u201d McGarvey said.<\/p>\n\n\n\n
Moreover, while the military controls prime contracts, it struggles to exert that control further down the food chain, said Ray Gagne, the Army\u2019s director for Acquisition Program Information Protection.<\/p>\n\n\n\n
\u201cWith the primes we have contractual understandings, but when they subcontract out, that is inherently a vulnerability,\u201d he said. \u201cThere is activity ongoing to ensure that a piece of technical data is protected as it flows down the chain, but that is still a work in progress.\u201d<\/p>\n\n\n\n
Despite the hurdles, experts point to a number of steps the military and its partners could take to prevent or minimize cyber incursions in the production of military systems.<\/p>\n\n\n\n
Rating the risk<\/b><\/p>\n\n\n\n
In order to safeguard the cyber jewels, the military first needs to have a realistic understanding of what technical data and intellectual property is in play.<\/p>\n\n\n\n
\u201cWe work with the respective program management offices to ensure they are knowledgeable about the information that is in the hands of industry,\u201d Gagne said. \u201cIf it\u2019s a program that we deem to be of a critical nature to the Army, we may ask the program managers to take additional steps to ensure sufficient security counter-measures are in place.\u201d<\/p>\n\n\n\n
This risk-based approach forms a critical first layer of defense, he said. Given the vast number of systems in the military portfolio, any realistic effort to close cyber gaps in the supply chain needs to start with a push to prioritize the vulnerabilities.<\/p>\n\n\n\n
For systems deemed high risk, some exerts suggest a line of defense that focuses on the behavior of people, rather than cyber-health of specific systems. For any given production task, a manufacturer \u201ccan set a baseline of what is normal behavior, alerting security experts earlier when there are anomalies with how users are interacting with data,\u201d said Eric Trexler, vice president for global governments and critical infrastructure at security firm Forcepoint.<\/p>\n\n\n\n
By watching for suspect activity, he suggested, it might be possible to stop cyber disruptions before they occur. Others endorse this approach, saying the onus is on industry to adopt best practices.<\/p>\n\n\n\n
\u201cSome contractors have developed their own secure development and supply chain practices,\u201d said Wayne Lloyd, federal chief technology officer of cybersecurity company RedSeal. \u201cIt\u2019s in the best interest of defense contractors to validate that software and components have not been subverted or come from questionable suppliers. This also relieves the burden of effort on the [Department of Defense] to have to ensure the authenticity of components for weapons systems.\u201d<\/p>\n\n\n\n
Contractors could also be more active via human resources as a way to reduce the insider threat. \u201cThey could create a working group, for example, that cuts across legal, security, HR and management, with the aim of addressing employee wellness,\u201d McGarvey said. \u201cYou want to develop individuals who are not going to be vindictive, who fit well into the social environment of the organization. Employee wellness creates organizational wellness.\u201d<\/p>\n\n\n\n
The military, for its part, might look to expand upon existing structures that help to ensure the validity of material in the supply chain.<\/p>\n\n\n\n
Microelectronics DOD can trust<\/b><\/p>\n\n\n\n
Take for instance the trusted supplier program managed by the Defense Microelectronics Activity (DMEA). That program accredits suppliers of integrated-circuit related products and services to ensure integrity in design and manufacturing.<\/p>\n\n\n\n
\u201cThis 100-percent needs to be expanded to cover any microelectronics that are going into a critical weapons system,\u201d said Jennifer McArdle, a professor of cyber defense at Salve Regina University and a non-resident fellow at the Center for Strategic and Budgetary Assessments. \u201cWe need to work more closely with industry to make sure we get microelectronics we can trust.\u201d<\/p>\n\n\n\n
McArdle would also like the military to do more to validate the components it puts into play. \u201cYou can\u2019t test and evaluate everything, but if you can test and evaluate a small batch you can at least have some degree of assurance,\u201d she said. \u201cYou cannot check every single connection, it would just take forever. The question is always, how much enough? If you can\u2019t solve the problem, you at least have to mitigate the risk.\u201d<\/p>\n\n\n\n
The Pentagon could also leverage its sizable market muscle to steer providers toward better cyber practices.<\/p>\n\n\n\n
In a strategy called \u201cDeliver Uncompromised,\u201d which has been adopted by the Defense Department, the Mitre organization laid out such a path. \u201cThrough the acquisition process, DoD can influence and shape the conduct of its suppliers,\u201d the authors wrote. \u201cIt can define requirements to incorporate new security measures, reward superior security measures in the source selection process, include contract terms that impose security obligations, and use contractual oversight to monitor contractor accomplishments.\u201d<\/p>\n\n\n\n
While such obligations could help improve the process, military officials argue, success in the long run comes from forging a new cooperative working environment that recognizes the military need for security, on the one hand, and the potential financial and operational burdens of cyber hygiene on the other.<\/p>\n\n\n\n
\u201cWe have to identify the things that are most critical, and then it has to be negotiated between the government and the contractor,\u201d Gagne said. \u201cFor example, the contractor may have the ability to secure a system, and it\u2019s just a matter of asking them to do it, or it may fall to the program manager to determine the level of risk the government is willing to take. They\u2019ll have to make decisions together, based on both the risk and the cost.\u201d<\/p>\n\n\n\n
Where Gagne envisions a two-way street, some in industry are wary. They suggest that at the end of the day, securing the military supply chain may be, mostly, the government\u2019s job.<\/p>\n\n\n\n
\u201cThis a counter-intelligence game: What does our enemy want and what can we do about it? That process already exists and maybe you could build off of that,\u201d said Bryson Bort, chief executive officer of the security firm Scythe and a fellow at the National Security Institute at George Mason University.<\/p>\n\n\n\n
\u201cIn industry when we look at information [security], it\u2019s ongoing. We do penetration testing, we do focused security hardening and testing, we introduce dynamic third part threat evaluations,\u201d he said.<\/p>\n\n\n\n
Wouldn\u2019t it be expensive for the military to apply that same rigor across the supply chain? To answer, Bort referenced China\u2019s J-20 stealth fighter, widely believed to be based on plans for a U.S. fighter that were stolen by hackers.<\/p>\n\n\n\n
\u201cYes, it is expensive,\u201d he said. \u201cBut is that any worse than when the Chinese show up with the J-20 instantly built, and they\u2019ve skipped two generations of air warfare because they stole the plans? What\u2019s the cost of that?\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
In an increasingly digital battlefield, senior leaders, experts and analysts say supply-chain cybersecurity could be a weak point in the military\u2019s armor.<\/p>\n","protected":false},"author":7,"featured_media":27541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[2063],"class_list":["post-26314","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"H2QJTORDRZCQRINNPTEBCG66YE","arc_canonical_url":"\/industry\/2019\/01\/02\/is-there-such-a-thing-as-too-much-supply-chain-cybersecurity\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n