Review of the publication NIST SP 800-161 Rev. 1 (Draft) "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"

Ruslan Rakhmetov, Security Vision

A number of high-profile cyber incidents that have occurred recently (such as the attacks on IT giants SolarWinds and Kaseya) have confronted the global community with the fact that even the most tested and researched information systems cannot be unequivocally trusted. The reason is the possibility of supply chain attacks by unauthorised attackers introducing malicious code and/or undeclared capabilities into software and/or hardware supplied by a third party (IT vendor, manufacturer, third-party developers).

It is no secret that modern applications, information systems and high-tech equipment are so complex and updated so frequently that the customer company, as a rule, cannot independently verify the absence of vulnerabilities, malicious functionality, backdoors (software or hardware bookmarks) in the equipment, operating systems, application software and even in the security features used. Supply chain risk handling is covered in NIST SP 800-161 Rev. 1 (Draft), ‘Cybersecurity Supply Chain Risk Management Practices for Systems and Organisations,’ which we will discuss in this publication.

NIST SP 800-161 defines a supply chain as an interconnected set of resources and processes between different tiers of enterprises (including buyers, suppliers, developers, system integrators, service providers), each of which is a consumer of products and services from a lower tier with further implementation into the life cycle of the final product. Supply chain cyber risk is defined as the potential damage or compromise resulting from cyber risk from suppliers, their supply chains and their products or services. Supply chain cyber risks arise because of threats that exploit vulnerabilities and weaknesses in supply chain products and services, as well as in the supply chain logic itself. Supply chain threats can include deliberate malware, counterfeiting, industrial espionage, supply chain disruption, service disruption, intelligence agencies, as well as natural disasters, low-quality products and services, regulatory and geopolitical restrictions (sanctions). Supply chain vulnerabilities can include supply chain interdependencies, limited capabilities of individual supply chain elements, insufficient cyber security measures, as well as vulnerable supplier systems and components, unpatched systems, and lack of information security awareness.

For example, supply chain cyber risks would be:

• Compromising the source code repository of a proprietary software product and including a backdoor in it;
  
• Identification of a vulnerability in common software and further attacks on users of that software;
  
• substitution of hardware components (microcontrollers, memory modules, peripherals) in motherboards with similar original ones, but containing software and hardware bookmarks, with further installation of such motherboards into equipment and delivery to the customer - the ultimate target of the attack.

NIST SP 800-161 recognises that the reuse of software components, including open source components, is a cost-effective and popular way to develop and improve software, and often the end user is unaware of the versions of the software modules used in the final software they use. Similar cyber threats are also relevant to in-house software development, as in-house developers may use third-party libraries and modules that may contain vulnerabilities. To give an example: the recent dangerous Log4Shell vulnerability discovered in the popular OpenSource Apache Log4j web application logging library is being actively exploited in cyberattacks precisely because of its widespread use in commercial platforms around the world. Another example: when developing a software product for internal use, an open source library is used in a GitHub repository; this repository can be compromised by attackers (e.g., by stealing administrator credentials) to ‘distribute’ modified project code containing an easily exploitable vulnerability, followed by attacks on all companies that used the GitHub repository. As a result, NIST SP 800-161 introduces the concept of C-SCRM (Cybersecurity Supply Chain Risk Management), which refers to a systematic supply chain cyber risk management process that is part of an enterprise risk management framework and includes supply chain security practices and measures for IT and OT infrastructures as well as IoT devices. Implementing C-SCRM processes can help organisations identify the most supply chain dependent information systems and IT infrastructure components, reduce the likelihood of infrastructure compromise by effectively identifying, responding to and recovering from supply chain incidents, increase confidence in the quality, authenticity, reliability, cyber resilience and security of purchased products, and in the reliability of suppliers and service providers.

To effectively and consistently manage supply chain cyber risks, NIST SP 800-161 provides a number of requirements for supplier contractual obligations and product/service procurement management:

• Compliance with applicable cybersecurity requirements must be a condition of contract award and payment;
  
• Cybersecurity requirements must also be imposed on subcontractors and sub-suppliers, with monitoring of compliance with these requirements;
  
• Periodic re-checks of suppliers' compliance with cybersecurity requirements;
  
• Established processes and protocols for sharing information about vulnerabilities, cyber incidents and other business process disruptions, as well as criteria for categorising incidents;
  
• Contract terms and conditions specifying the roles, responsibilities and actions of suppliers and other third parties in responding to identified cyber risks or supply chain cyber incidents to mitigate risk, minimise damage and provide incident response actions;
  
• Methods for verifying and double-checking suppliers‘ and contractors’ fulfilment of terms and conditions may include certifications, customer site visits, assessments by independent third parties, or self-assessment procedures by suppliers and contractors.

When processing data on products, services, or sources of supply, it is recommended that the following characteristics be considered:

• Functionality and capabilities;
  
• Access to data and information, including access privileges;
  
• Installation and operating environment;
  
• Security, authenticity and integrity of the product and service and the associated supply and compilation chain;
  
• The capability of the supply source to provide the expected product or service of the required quality;
  
• Control or influence on the source of supply by foreign regulations or foreign entities;
  
• Market alternatives to the source of supply;
  
• Potential risk factors such as geopolitical, legal, governance/internal controls, financial stability, cyber incidents that have occurred, physical and personal security, and other information that will affect the analysis of the quality, authenticity, reliability, cyber resilience and security of the supply sources and the products and services purchased.

It is recommended that the following risk indicators and analyses be considered to assess supply chain cyber risks:

• Cyber threat information, including indicators of compromise and attacker tactics, techniques and procedures;
  
• Data from defence alerts, cyber intelligence reports;
  
• Infrastructure and/or business process security implications associated with the use of the product or service;
  
• Information system vulnerabilities;
  
• The level of threats and vulnerabilities based on the results of their assessment;
  
• Potential negative impact or damage caused by possible compromise of the product or service to the company's business processes, as well as the likelihood of such negative impact or damage, taking into account the possibility of exploitation of vulnerabilities;
  
• The company's ability to mitigate identified supply chain cyber risks.

NIST SP 800-161 provides recommendations for effective supply chain cybersecurity, which are divided into foundational, sustaining, and enhancing.

The foundational recommendations include the following items:

• Establishing a dedicated unit or team to manage supply chain cyber risk;
  
• Implementing risk management processes and hierarchy in accordance with NIST SP 800-39 and NIST SP 800-30 recommendations;
  
• Implement a corporate governance structure to integrate supply chain cyber risk management requirements into corporate policies and procedures;
  
• Develop a process to identify and assess the criticality of corporate suppliers, products, and services;
  
• Raising awareness of supply chain cyber risk management issues among responsible employees;
  
• Develop and implement supply chain cyber risk management requirements into procurement policies and procedures;
  
• Implementing a logically linked, repeatable, documented process for determining levels of adverse impact when supply chain cyber risks are realised;
  
• Implementation of supplier risk assessment processes, including criticality, threat and vulnerability analyses;
  
• Implementing a quality and reliability assessment programme with methods to monitor and verify them;
  
• Allocating adequate resources to information security and supply chain cyber risk management functions;
  
• Ensuring controlled access to sensitive supply chain cyber risk management information;
  
• Implementing applicable protective measures in accordance with NIST SP 800-53;
  
• Implementing a cyber incident response programme that includes capabilities to identify the root cause of cyber incidents, including those due to supply chain attacks;
  
• Implementing internal processes to verify that vendors and service providers are actively seeking out and reporting vulnerabilities in their products;
  
• Implement an enterprise-wide Software Bill Of Materials (SBOM) management and monitoring function to identify vulnerabilities in the software in use.

Additional recommendations include the following items:

• Implementing and collaborating on an information security programme that takes into account current cyber threats;
  
• Utilising trust building mechanisms including third party assessment questionnaires, vendor site visits, formal certifications (e.g. ISO 27001) to assess critical vendor capabilities and practices;
  
• Implementing formal processes to monitor and reassess existing suppliers to identify potential changes to their risk profiles;
  
• Utilising an understanding of the corporate risk profile to determine risk appetite and tolerance to support risk-based management decisions in relation to supply chain management;
  
• Utilising a consistent process for sharing supply chain cyber risk information between companies and government agencies;
  
• Escalation of high-priority supply chain cyber risks to company management level (if necessary);
  
• Incorporating training on supply chain cyber risk management into the corporate internal training process;
  
• Incorporating supply chain cyber risk management aspects into the product and systems lifecycle, and implementing appropriate logically related, repeatable, documented processes in the creation of systems, cybersecurity practices, IT product and service acquisition procedures;
  
• Incorporating internal supply chain cyber risk management requirements into contractual requirements for suppliers, developers, system integrators, and service providers;
  
• Incorporating critical suppliers into cyber incident response, continuity and recovery plans and testing;
  
• Engaging with vendors, developers, system integrators, service providers to enhance their cybersecurity practices;
  
• Defining, collecting, and reporting supply chain cyber risk management metrics to support risk-based management decisions, applying management practices to fully implement supply chain cyber risk management, and improving the efficiency and effectiveness of supply chain cybersecurity processes and practices.

Developing recommendations include the following items:

• Automating supply chain cyber risk management processes (where applicable and feasible) to improve logical coherence and efficiency and free up resources;
  
• Applying quantitative risk analysis techniques to improve the accuracy of supply chain risk assessments, improve the ability of company management to determine how best to respond to cyber risks, and quantify the effectiveness of supply chain cyber risk response;
  
• Applying the results of supply chain cyber risk management metrics calculations to predict supply chain cyber risks and move from a reactive to a proactive response method.