IT supply chain security is weak at major U.S. agencies, says GAO
Lawmakers call on agencies to focus more on possible vulnerabilities embedded into IT products
IDG News Service - U.S. lawmakers called on three large U.S. government agencies, including the Department of Energy, to start monitoring their IT purchases for possible malware, counterfeits or other security flaws, after a watchdog agency pointed out potential vulnerabilities in their IT supply-chain procedures.
The three agencies, also including the U.S. Department of Justice and Department of Homeland Security, do not have plans to identify possible embedded threats in IT products or to monitor commercial IT products for embedded threats, said the U.S. Government Accountability Office, in a report released Tuesday.
With agencies buying hardware pieced together from components made all over the world, they need to check their purchases for vulnerabilities that could slip in at any point in the manufacturing and shipping process, Gregory Wilshusen, GAO's director of information security issues, told lawmakers.
"The global IT supply chain introduces risks that, if realized, could jeopardize the confidentiality, integrity and availability of federal information systems," he told the U.S. House of Representatives Energy and Commerce Committee's oversight subcommittee.
Of four national security-related agencies the GAO studies, only the Department of Defense has made significant progress toward identifying IT supply chain risks, despite an August 2009 standard on IT supply chain security published by the National Institute of Standards and Technology, the GAO said.
The GAO report prompted lawmakers to push Gil Vega, chief information security officer for the Department of Energy, to develop an IT supply chain security plan. The DOE, which oversees the nation's nuclear energy stockpile, began to address the concerns in the GAO report this month, when it first heard of them, Vega told the subcommittee.
"When will the Department of Energy finish its process of giving guidance to your suppliers to promote their supply chain's integrity?" said U.S. Rep. Cliff Stearns (R-Fla.). "When is that date going to be?"
A date is "hard to predict," said Vega, who has been the agency's CISO for just eight months. Vega said he's not aware of any cyberattacks at the DOE that resulted from supply chain vulnerabilities.
Supply chain risks are real, Stearns said. Based on the DOE's nuclear mission, "I think you should have been ahead of the curve, instead of, just in the last two weeks, giving guidance to your suppliers," he said.
But four of the five witnesses at Tuesday's hearing, including Wilshusen, said vulnerabilities in the IT supply chain were not the most pressing cybersecurity concern for most federal agencies. Cyberattacks from outside groups or involving insiders are a bigger problem for agencies, said Dave Lounsbury, CTO at the Open Group, an IT standards consortium working on supply chain security.
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!