Supply chain insecurity threatens national security

The SolarWinds hack gave digital intruders unprecedented access to the networks of government agencies and most of the Fortune 500 -- an extremely serious compromise of our nation’s electronic infrastructure. Our intelligence community is still scrambling to understand what has been lost; many believe it is the most serious cybersecurity breach in history.

Because we are increasingly dependent on technology services -- especially in the pandemic year -- our adversaries have a large attack surface to probe and exploit. Their primary incentive today is probably voyeuristic surveillance: to see who is connected to whom, what they say, how they say it and when they communicate with each other. But we must assume deeper, more malevolent intentions now that intruders have knowledge of our networks. If there were ever a kinetic conflict, with physical incursion and real violence, the infiltration (and possibly already-implanted malware) could be used by adversaries to inflict real damage to critical infrastructure.

Given our inexorable reliance on SCADA (supervisory control and data acquisition) systems that electronically manage much of our manufacturing, transportation, power generation and large-building infrastructure, damage can be caused by something as simple as programming a gauge to give false readings or turning off a circuit or circuit breaker. Indeed, we showed the world this was possible with the Stuxnet cyberattack on the Iranian Natanz uranium enrichment facility more than a decade ago.  If an even-larger attack on the U.S. were to succeed, it would mean no email, no phones, no electricity, no water, no fuel, no money. Our country would be severely disabled precisely when it needs to respond to an overt act of war.

Though no group or country has yet been publicly accused (or taken credit) for the SolarWinds attack, the highly sophisticated maneuvers point to state-affiliated actors in Russia. The intruders then exploited ubiquitous tools like Microsoft’s Office 365 and “pulled up the ladder” so that others couldn’t follow behind. They also embedded themselves in updates of the very code that hundreds of thousands of operators -- in the public and private sector -- use to monitor their networks. Taken together, this is an incredible launch pad for even more mischief later.

Dan Geer, currently a senior fellow at In-Q-Tel (the non-profit venture capital arm of the CIA) and one of the country’s most respected cybersecurity experts, told us that containing this incursion will be especially difficult for three reasons.  First, many software components are reused and recycled from one version to the next.  This “monoculture” means that a single infection can spread rapidly between applications. Second, our ability to detect intrusion was compromised because the hackers went after the very software many agencies use to surveil their networks.  Finally, Geer said, “the people who protect our infrastructure have to remember everything that has ever happened, and our adversaries just have to find one new thing. That’s the very definition of asymmetric warfare.”

We have previously written about cyber-physical vulnerabilities, particularly of the electric grid and the semiconductor supply chain.  This is critical business and still unfinished, despite increasing voices of alarm.  We are apprehensive that our government’s response is fractured, haphazard and ineffective.  As cyber and national security expert Rob Knake points out, “For more than two decades, U.S. cyber strategy has been predicated on the need for government and private enterprise to work together to counter threats … [yet we have] never built the structures or capabilities to fully implement such a joint effort.”

The SolarWinds attack is at its core a supply chain problem, which is probably the most serious and pernicious vulnerability we have.  Fundamentally rethinking our software and our hardware supply chain is a basic question of national security, but we are not defenseless. For example, we know how to deploy -- inexpensively and reliably -- digital sentries that can detect anomalous behavior on networks, from the power and heat generated on the devices, to the data that passes between them. What’s lacking today is a coherent plan to do so.

Retired Brig. Gen. Greg Touhill, who was appointed by President Barack Obama as the government’s first chief information security officer, writes in a recent Appgate blog that he has no evidence that “leads me to believe the Intelligence Community or US Cyber Command saw this coming, warned the victims, or conducted any actions to interdict the adversaries. [T]his highlights just how hard it is to find and interdict attacks at cyberspeed.” Geer concurs, saying “the pinnacle goal of security engineering is ‘no silent failure’ -- you can’t mitigate what you don’t know is happening.”

And that is the greatest concern of all. Indeed, a similarly pernicious attack (but hardly reported) was discovered by Dragos, Inc., targeting safety systems of a respected manufacturer of electric power equipment. Unless and until the U.S. gets serious about supply chain management generally, and cybersecurity specifically, the world’s most powerful defense establishment will continue to overstress unsustainable force projection instead of more response-nuanced preparation to 21st century threats.

Some have proposed new approaches to international treaties that distinguish between “honorable” and, by implication, “dishonorable” espionage. Stanford University professor Dan Boneh disagrees.  “It may have been a nation-state this time,” he said, “but you literally have kids in dorms in foreign countries that could do this, with or without the tacit support of sovereign governments.  I just don’t think this is an effective approach.” Like Geer, he strongly suggests defense in depth, which improves surveillance on the one hand and makes attack more difficult, and expensive, on the other. He is quick to point out that “there are no magic bullets here.”

Concurrent public health, economic, social equity and climate crises will certainly dilute congressional and executive-branch attention. Even with the unprecedented policy tsunami it has to manage, we believe the Biden administration must prioritize and reverse the neglect, mismanagement and misdirection of the last one, which fired a highly competent cyber executive for inadequate fealty. Like apolitical viral pathogens, an attack on our infrastructure will not discriminate its destruction based on political ideology.

We know what to do; the available checklists are simply not followed. We must make our own critical infrastructure, seamlessly share the cyber information we do have, follow the procedures already in place, with people we know and trust, and provide commercial incentives that help shift our thinking from “just in time” to “just in case.”