Supply chain threats 'hard to detect, expensive to fix'

A congressional intelligence panel recommends that “the United States should view with suspicion the continued penetration of the U.S. telecommunications market by Chinese telecommunications companies,” and a recent report on emerging threats identifies supply chain security as a growing concern.

But the report from the Georgia Tech Information Security Center and Georgia Tech Research Institute  also characterizes supply chain threats as “hard to detect, expensive to fix, and a policy nightmare,” with few good solutions.

Supply chain threats involve the inclusion of back doors, malicious code or other flawed hardware, software or firmware in products; and the threats can occur anywhere along the line, from developers and manufacturers to vendors and integrators. They can include substandard or illegal counterfeit goods as well as maliciously designed products that can allow unauthorized access to sensitive systems, including critical infrastructure in our nation’s private sector, civilian government and military.

Because the vulnerabilities and exploits can be baked into a product from the beginning, they are difficult to detect and guard against once they are installed in a system.

No one is immune from the threat of buying compromised goods, but the seriousness of the threat depends on who you are, said Paul Royal, associate director of the Georgia Tech Information Security Center and author of the Emerging Cyber Threats Report for 2013. There is little incentive for manufacturers and vendors to target small organizations and consumers, he said. “But for high-profile, high-value targets, it’s probably a big problem.”

Such targets would include agencies that hold sensitive information such as classified data and high-value intellectual property, as well as critical infrastructure operators.

This was what spurred the House Permanent Select Committee on Intelligence to warn against Chinese telecom vendors in its report, “The U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE,”  released in October. The 60-page report noted that telecom plays a critical role in national security and already is being targeted by other nations.

The investigation began in November 2011 at the request of Chinese company Huawei Technologies, which wanted to assure the U.S. government and market of its trustworthiness. But a preliminary review revealed potential security threats posed by Chinese companies with potential ties to the Chinese government or military. The committee concluded that “the opportunity exists for further economic and foreign espionage by a foreign nation-state already known to be a major perpetrator of cyber espionage.”

The investigation included a review of open source and classified information. Huawei and ZTE cooperated, but “the Committee remains unsatisfied with the level of cooperation and candor provided by each company,” it said in its report. “Neither company was willing to provide sufficient evidence to ameliorate the Committee’s concerns. Neither company was forthcoming with detailed information about its formal relationships or regulatory interaction with Chinese authorities. Neither company provided specific details about the precise role of each company’s [ties to the] Chinese Communist Party Committee. Furthermore, neither company provided detailed information about its operations in the United States.”

While this did not amount to proof of wrongdoing, the investigation concluded “that the risks associated with Huawei’s and ZTE’s provision of equipment to U.S. critical infrastructure could undermine core U.S. national-security interests,” and that “based on available classified and unclassified information, Huawei and ZTE cannot be trusted to be free of foreign state influence and thus pose a security threat to the United States and to our systems.”

The committee recommended that that country “should view with suspicion the continued penetration of the U.S. telecommunications market by Chinese telecommunications companies,” and that “private-sector entities in the United States are strongly encouraged to consider the long-term security risks associated with doing business with either ZTE or Huawei for equipment or services.”

The committee “strongly encouraged” customers to seek other vendors. But finding reliable vendors for any IT equipment and software is not necessarily easy, said Georgia Tech’s Royal.

“It’s very hard to source everything locally,” he said. Supply chains for multi-component systems are so complex that it is difficult if not impossible to spot something malicious. “There are very few solutions.” Risk can be mitigated by using trusted vendors, which is imperfect but can allow you to “somewhat sidestep the risk,” he said.

One technique for finding software vulnerabilities—either intentional or accidental—is independent analysis of the code. This is a growing but still immature field of security.

“Formal vendor software testing programs are still in a relatively early stage of adoption,” according to a report on Enterprise Testing of the Software Supply Chain, from the software analysis company Veracode.

The report says that the number of assessments of third-party application grew 49 percent from 2011 to 2012, but most of that is being done by financial services, software and IT services, and technology sectors. In government, fewer than five agencies are regularly analyzing externally developed software, said Chris Wysopal, Veracode’s CTO and CISO.

At the same time that there is a growing number of application layer attacks, there has also been a trend toward enterprises going to third-party vendors for application software, Wysopal said.

“There is pressure to do more with your IT for less,” he said. “That is driving CIOs to go external for their software because they can get their faster and cheaper.”

That is not necessarily a bad thing, he added. The financial services industry produces some of the best in-house code. Outside that sector, an enterprise is likely to find that code developed by a third party is at least as good, if not better, than that developed in-house. But that does not mean it is good enough. On average, only 38 percent of applications being tested pass on the first go-round. Within 12 weeks of testing that rate goes up to 52 percent.

“I’m definitely not satisfied with 38 percent,” Wysopal said. He said he believes the rate could be 80 percent or higher if companies paid more attention to the quality of applications during the development period.

Wysopal said there is a growing interest from federal agencies in analyzing third-party applications, but aside from the Federal Aviation Administration and a handful of others, almost no one is doing it yet. This is due in large part to the complexity and long terms of federal contracts, which do not allow them to evolve to meet emerging threats.

“But there is hope,” he said.

The National Institute of Standards and Technology is revising its comprehensive list of IT security controls for agencies. Special Publication 800-53 Rev. 4, now in draft form, addresses supply chain protection and application security for IT systems designated as high risk.