The Department of Defense is working with a unnamed company to mitigate cybersecurity vulnerability discovered in a technology used by the Pentagon, the DoD\u2019s Deputy Chief CIO Michele Iversen said Nov. 12.<\/p>\n\n\n\n
Without going into specific detail, Iversen said the department is working to remove the product.<\/p>\n\n\n\n
\u201cThe company was compromised [and] had a big cybersecurity vulnerability,\u201d said Iversen, speaking at Fifth Domain\u2019s annual CyberCon conference. \u201cAnd we have seen bad things coming from those products, so we are looking at how to use our authorities … [to] block those products or companies for national security systems.\u201d<\/p>\n\n\n\n
This highlights a broader issue facing the DoD: how to protect its supply chain.<\/p>\n\n\n\n
To mitigate supply chain risk, Iversen said that she is working on a supply chain illumination tools. She said that these are useful because its made up of publicly available information that doesn\u2019t need any level of classification.<\/p>\n\n\n\n
Specifically, she said she\u2019s working on a decision support tool where she can expose a \u201cbare minimum set of publicly available supply chain information.\u201d<\/p>\n\n\n\n
\u201cSo when people are going to look and make their purchases, they have information available to them,\u201d she said.<\/p>\n\n\n\n
She said, ultimately, she wants the DoD CIO\u2019s office to offer that tool as a service.<\/p>\n\n\n\n
The National Institute of Standards and Technology is also starting to develop cybersecurity tools. NIST\u2019s Jon Boyens, acting deputy chief of the computer security division, said that his team at the standards agency is working on a supplier inter-dependency tool \u201cto look at different suppliers and their criticality\u201d to allow for government to be more effective in asking for capabilities during the procurement process.<\/p>\n\n\n\n
\u201cIndustry is saying, \u2018You know, we\u2019ve invested in this but we\u2019re not getting any incentives\u2019 … and so they\u2019re kind of looking for incentives for investing in technology,\u201d said Boyens.<\/p>\n\n\n\n
Iversen said that technology research and development also presents its own attack surface with which it needs to grapple. If the research and development was done in a foreign country, that presents a unique set of threats. For example, Iversen pointed to back-up software being placed into a nuclear command-and-control system.<\/p>\n\n\n\n
\u201cMaybe you just say anything where the R&D … [is] done in those countries is just off limits,\u201d Iversen said. \u201cIt just makes common sense. It\u2019s fixing stupid.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The Department of Defense CIO’s office wants to create supply chain decision support tool as a service.<\/p>\n","protected":false},"author":7,"featured_media":55879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":6,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[104,106,31,110,14,33,6],"tags":[],"coauthors":[3242],"class_list":["post-19069","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-acquisition-update","category-daily-brief","category-home","category-it-cloud-report","category-it-networks","category-newsletters","category-acquisition"],"acf":{"subheadline":"","legacy_arc_id":"HMMXM5AJ3BCLTPPPFPVMKYYLFQ","arc_canonical_url":"\/smr\/cybercon\/2019\/11\/12\/here-are-some-new-tools-coming-to-protect-the-supply-chain\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n