Application-based attacks like the Colonial Pipeline ransomware hack capture headlines but security pros know that cyber criminals are not stopping with application-based attacks and will continue to aim deeper into the heart of computing by targeting operating systems, firmware and hardware.
This inevitable trend has created a need for security solutions that not only focus below the OS in areas like firmware and software, but also that reach deep into the technology supply chain. Attacks early in the chain can have a profound impact on technology consumers, including government organizations that rely on technology to carry out their missions and store and transmit sensitive data.
This trend is one reason the National Institute for Standards and Technology is updating its guidance on developing cyber resilient systems. It is also a bit part of why the Biden administration emphasized cyber resilience in its recent review of supply chain issues.
The escalating nature of cybercrime is also why Intel and other industry leaders are investing in the Compute Lifecycle Assurance, or CLA, initiative. The goal is to develop and implement industry leading supply chain security solutions and to work with industry partners to implement a framework for building security into every stage of a devices existence, from design to manufacture, from deployment to retirement.
For government organizations, CLA means the technologies they rely on should become increasingly cyber resilient. Agencies are well-advised to keep themselves informed of the advancements in supply chain transparency and traceability, and the continual protections CLA will generate to address vulnerabilities as they emerge.
Security at Every Stage
The shift in focus of cyber crime has highlighted the importance of advanced security operations, investments, training and solutions that span across every stage of the device lifecycle. Industry leaders in security have long invested, implemented and led the industry in these holistic supply chain and product lifecycle assurance investments. CLA extends that security-first mindset throughout the technology lifecycle, including:
Build: Starting at the design stage then deep integration with sourcing and manufacturing, how do you confirm the integrity of a platform and its component devices? Is it designed and built in a trusted manner? Is the platform assembled in a trusted facility, with proper controls in place to not only establish the time of manufacture, but also to ensure the necessary levels of traceability?
Theres always risk during manufacture that a vulnerability could be inadvertently built into a product. This could occur, for example, through firmware with embedded malicious code or counterfeit components that are intentionally malicious or not designed securely.
CLA provides guidelines for mitigating this risk. One approach is to implement security solutions to gather, cryptographically seal, and securely store metadata from devices as they are manufactured.
Transfer: Does the system arrive as ordered? Are there processes, controls, and technologies in place to detect tampering, modification or changes within the hardware, firmware and software? Are there mechanisms in place to establish who should, or should not have rights to modify the platform throughout distribution?
Risk can also be introduced as devices ship and make their way through the distribution channel. Does the system arrive as ordered? Are there processes, controls, and technologies in place to detect tampering, modification or changes within the hardware, firmware and software? Are there mechanisms in place to establish who should, or should not have rights to modify the platform throughout distribution?
CLA can reduce these risks in several ways. One is a set of standards to help all vendors that design, build or combine components to adhere to stringent security practices. Another is tamper-resistant and tamper-evident packaging to identify physical tampering. Finally, technology solutions that track and can identify changes to the system (authorized or unauthorized) and establish ownership and transfer for the device are critical to establish transparency, traceability, and tamper resistance within the distribution channel.
Operate: Is the system operating in a known and trusted state? Have the latest functional or security updates been applied? Is the trust profile of the system enough to automate key provisioning and attestation procedures?
Technology must remain protected as its implemented, used and updated. CLA provides guidelines designed to allow your organization to confirm, for example, that the technology products you procure are legitimate and secure before you deploy them. Your IT team should also be able to configure hardware to ensure, each time the device is booted up, that firmware is up-to-date and physical components havent changed.
Retire: Has all data that was transmitted, stored or erased been confidentially wiped from the drive and the platform? Is the status of the device understood as it enters into the secondary market?
In the past, organizations procured a device, provisioned it to an employee and, when it came time for replacement, physically destroyed sensitive components on the system such as storage. Today, consumption models such as PC as a service (PCaaS) are popular, allowing organizations to lease devices, which are eventually reprovisioned in secondary markets. Such redeployments present security risks.
CLA addresses these risks through technologies that ensure data is entirely and irretrievably wiped from devices before theyre reprovisioned or discarded. Proof-of-custody data can make sure the device that was deployed is the device that was retired, and that certificates of data destruction havent been faked.
Agencies Play a CLA Part
CLA doesnt involve only the companies that design and build devices upstream in the supply chain. Consumers of technology such as government agencies also play a crucial role.
IT departments should take advantage of the transparency thats being built into the technology supply chain. Use available tools from industry partners to retake the snapshot taken when the system first loaded the BIOS onto the CPU and ensure theres a match. Second, keep current on BIOS updates and firmware patches that protect against vulnerabilities as theyre uncovered.
Finally, demand that all your technology providers implement the kind of supply chain visibility CLA advocates. Many CLA guidelines map directly to key regulations you need to comply with such as the Defense Federal Acquisition Regulation Supplement (DFARS), which requires organizations to have a mechanism to protect against counterfeit components.
No initiative or technology can eliminate cyberattacks and cyber risk. But by building protections into every link of the supply chain, the Compute Lifecycle Assurance initiative is making technology safer for the government organizations that depend on it.
Patrick Bohart is a senior director at Intel focusing on technology advancements in security assurance.
Continued here:
Working to Secure the Technology Supply Chain - Nextgov
- Report: Apple acquires French startup behind AI and computer vision technology - 9to5Mac - April 22nd, 2024 [April 22nd, 2024]
- CACI Awarded $1.3 Billion Task Order to Provide Communications and Information Technology Expertise to U.S. ... - Business Wire - April 22nd, 2024 [April 22nd, 2024]
- What is semi-automated offside technology and how does it work? - The Athletic - April 22nd, 2024 [April 22nd, 2024]
- Can technology save us from an ecological apocalypse? - interview - CyberNews.com - April 22nd, 2024 [April 22nd, 2024]
- Does LaLiga have goalline technology? What about other major leagues? - AS USA - April 22nd, 2024 [April 22nd, 2024]
- Driver Assistance Technologies: NHTSA Should Take Action to Enhance Consumer Understanding of Capabilities and ... - Government Accountability Office - March 31st, 2024 [March 31st, 2024]
- OpenAI reveals Voice Engine, but won't yet publicly release the risky AI voice-cloning technology - The Associated Press - March 31st, 2024 [March 31st, 2024]
- Nexalin Technology Full Year 2023 Earnings: US$0.63 loss per share (vs US$0.30 loss in FY 2022) - Yahoo Finance - March 31st, 2024 [March 31st, 2024]
- 'Battle for your brain': What the rise of brain-computer interface technology means for you - WBUR News - March 31st, 2024 [March 31st, 2024]
- Firsthand Technology Value Fund (NASDAQ:SVVC) Research Coverage Started at StockNews.com - Defense World - March 31st, 2024 [March 31st, 2024]
- Suzhou Anjie Technology Full Year 2023 Earnings: Misses Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Inside the shadowy global battle to tame the world's most dangerous technology - POLITICO Europe - March 31st, 2024 [March 31st, 2024]
- The Technological Pivot Of History: Power In The Age Of Exponential Innovation Analysis - Eurasia Review - March 31st, 2024 [March 31st, 2024]
- 'Women Behind the Wheel' explores the intersection of gender, culture and cars - NPR - March 31st, 2024 [March 31st, 2024]
- Shanghai Weihong Electronic Technology Full Year 2023 Earnings: Revenues Beat Expectations, EPS Lags - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- A Look At The Fair Value Of Powertech Technology Inc. (TWSE:6239) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Weaver Network Technology Full Year 2023 Earnings: EPS Beats Expectations, Revenues Lag - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- New York City will introduce controversial AI gun detection technology amid subway crime crisis - SiliconANGLE News - March 31st, 2024 [March 31st, 2024]
- Earnings Not Telling The Story For Beijing CTJ Information Technology Co., Ltd. (SZSE:301153) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Vontron Technology Full Year 2023 Earnings: EPS: CN0.35 (vs CN0.34 in FY 2022) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Huawei Revenue Rises as Technology Giant Commits to Growth - Technology Magazine - March 31st, 2024 [March 31st, 2024]
- Shenzhen Fortune Trend technology Full Year 2023 Earnings: Beats Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- USPACE Technology Group Limited (HKG:1725) May Have Run Too Fast Too Soon With Recent 28% Price Plummet - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- NYC to test gun-detecting technology in subway system - SILive.com - March 31st, 2024 [March 31st, 2024]
- Cancer Treatment: 3D Printing and Scanning Technology - Surviving Mesothelioma - March 31st, 2024 [March 31st, 2024]
- Does Contel Technology (HKG:1912) Have A Healthy Balance Sheet? - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Oppo Find X7 series now supports 5G-Advanced technology with up to 10 Gbps downlink speed - The Indian Express - March 31st, 2024 [March 31st, 2024]
- DCPS receives nearly $20k in grants for technology program advancements - The Owensboro Times - March 31st, 2024 [March 31st, 2024]
- Hangzhou Electronic Soul Network Technology Full Year 2023 Earnings: Misses Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- International Business Digital Technology Full Year 2023 Earnings: CN0.07 loss per share (vs CN0.019 loss in FY ... - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Analysts Are More Bearish On Guangzhou Tinci Materials Technology Co., Ltd. (SZSE:002709) Than They Used To Be - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Daheng New Epoch Technology Full Year 2023 Earnings: EPS: CN0.11 (vs CN0.16 in FY 2022) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Tesla offers U.S. customers a month's trial of its driver-assist technology - Reuters - March 31st, 2024 [March 31st, 2024]
- Slam Dunk Technology: How AI Is Revolutionizing The Game Of Basketball - Forbes - March 31st, 2024 [March 31st, 2024]
- China Environmental Technology and Bioenergy Holdings Full Year 2023 Earnings: CN0.03 loss per share (vs CN ... - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Vuma and Huawei team up to launch industry first 50G PON ... - Light Reading - July 15th, 2023 [July 15th, 2023]
- See What Kim Kardashian and Kylie Jenner Look Like With Aging ... - E! NEWS - July 15th, 2023 [July 15th, 2023]
- AFRL conducts swarm technology demonstration > ONE AFRL ... - afrl.af.mil - May 20th, 2023 [May 20th, 2023]
- Shell to use new AI technology in deep sea oil exploration - Reuters - May 20th, 2023 [May 20th, 2023]
- Former Google CEO says AI at 'center' of technology competition between US and China - Fox News - May 20th, 2023 [May 20th, 2023]
- Agriculture and technology combine to drive the industrys growth - Times of India - May 20th, 2023 [May 20th, 2023]
- Technology and the Skills Shortage - Financial Times - May 20th, 2023 [May 20th, 2023]
- New License Agreement Announced for Next-Generation Base ... - BioPharm International - May 20th, 2023 [May 20th, 2023]
- Orion Governance Licenses Technology from GE to Deliver Next Generation Data Governance Solution - Yahoo Finance - May 20th, 2023 [May 20th, 2023]
- World needs to be 'vigilant' as AI technology improves and ... - KTVZ - May 20th, 2023 [May 20th, 2023]
- After Losing Son, Ridgefield Mother Pushes For Technology to Prevent Hot Car Deaths - NBC Connecticut - May 20th, 2023 [May 20th, 2023]
- After last year's fan violence in Queretaro, has Fan ID technology ensured safety for Liga MX fans? - ESPN - ESPN - May 20th, 2023 [May 20th, 2023]
- Bleach: The Soul Reapers' Gigai Technology, Explained - CBR - Comic Book Resources - May 20th, 2023 [May 20th, 2023]
- Cogito Tech - Catalyzing Transformation in Global Healthcare ... - Business Standard - May 20th, 2023 [May 20th, 2023]
- Barriers to Use of Technology in Diabetes Management - Patient Care Online - May 20th, 2023 [May 20th, 2023]
- Blue technology startups presented at the inaugural Gulf Blue ... - The University of Southern Mississippi - May 20th, 2023 [May 20th, 2023]
- CureVac files expanded patent lawsuit against Pfizer/BioNTech over ... - Reuters - May 20th, 2023 [May 20th, 2023]
- Harrison Ford defends use of de-ageing technology in new Indiana Jones film: I know that that is my face - Yahoo News - May 20th, 2023 [May 20th, 2023]
- Sanwo-Olu: Nigeria needs technology to compete with likes of China - Guardian Nigeria - May 20th, 2023 [May 20th, 2023]
- Prejudice in technology, and the necessity of time: Books in brief - Nature.com - May 20th, 2023 [May 20th, 2023]
- New technology uses ordinary sunlight to disinfect drinking water ... - Stanford University News - May 20th, 2023 [May 20th, 2023]
- Incredible AI technology shows what UK cities will look like in 2050 - LADbible - May 20th, 2023 [May 20th, 2023]
- Your Firm and Your Tools - Top Technology Initiatives - CPAPracticeAdvisor.com - May 20th, 2023 [May 20th, 2023]
- Tom Hanks: I could appear in movies after death with AI technology - BBC - May 20th, 2023 [May 20th, 2023]
- Transform your career with Chief Technology Officer online course - Economic Times - May 20th, 2023 [May 20th, 2023]
- e-Learning Jamaica Technology in Education Conference Slated for ... - Government of Jamaica, Jamaica Information Service - May 20th, 2023 [May 20th, 2023]
- Andrew Maynard | What's a Luddite? From Industrial Revolution to ... - TribDem.com - May 20th, 2023 [May 20th, 2023]
- At Yale, Kaloyan Kolev used technology to create and to make ... - Yale News - May 20th, 2023 [May 20th, 2023]
- This technology could alter the entire planet. These groups want every nation to have a say. - MIT Technology Review - April 17th, 2023 [April 17th, 2023]
- The secret lives of snakes and how Georgia College uses technology to study them - 13WMAZ.com - April 8th, 2023 [April 8th, 2023]
- Technology Innovation Institute to host 2nd 'Additive Manufacturing the Future' seminar in Abu Dhabi - Devdiscourse - April 8th, 2023 [April 8th, 2023]
- Can Array Technologies Inc (ARRY) Stock Rise to the Top of Technology Sector Thursday? - InvestorsObserver - March 31st, 2023 [March 31st, 2023]
- Here's Why We Think Pfeiffer Vacuum Technology (ETR:PFV) Might Deserve Your Attention Today - Simply Wall St - February 18th, 2023 [February 18th, 2023]
- Will WM Technology Inc (MAPS) Stay at the Top of the Technology Sector? - InvestorsObserver - February 18th, 2023 [February 18th, 2023]
- Ways in which technology can enhance the abilities of law enforcement agents to assist the community - Times of India - February 7th, 2023 [February 7th, 2023]
- Meet The Titans: Google And OpenView (Microsoft) Faceoff On Chat Technology Innovation - Forbes - February 5th, 2023 [February 5th, 2023]
- MACOM Technology Solutions Holdings, Inc.'s (NASDAQ:MTSI) Stock Has Been Sliding But Fundamentals Look Strong: Is The Market Wrong? - Simply Wall St - February 5th, 2023 [February 5th, 2023]
- WVU Dept. of Ophthalmology acquires state-of-the-art technology for simulation lab - WV News - February 5th, 2023 [February 5th, 2023]
- Executive Vice President of Technology & Operations Alok Sethi Just Sold A Bunch Of Shares In Franklin Resources, Inc. (NYSE:BEN) - Simply Wall St - February 5th, 2023 [February 5th, 2023]
- Is Now The Time To Put Amkor Technology (NASDAQ:AMKR) On Your Watchlist? - Simply Wall St - January 27th, 2023 [January 27th, 2023]
- There Are Reasons To Feel Uneasy About New Oriental Education & Technology Group's (NYSE:EDU) Returns On Capital - Simply Wall St - January 27th, 2023 [January 27th, 2023]
- Technology has set us on a path toward one of two dystopian scenariosbut its not too late to save democracy - Fortune - January 17th, 2023 [January 17th, 2023]
- IonQ Acquires Entangled Networks And Locks In Quantum Networking Technology Critical To Its Future Success - Forbes - January 10th, 2023 [January 10th, 2023]
- Industrialization 3.0 - How Technology, Wall Street, And The Government Can Help The US Win In A World Of Re-Industrialization - Forbes - January 10th, 2023 [January 10th, 2023]
- Connect with aspirational India through technology and work in interest of world: Anurag Thakur to NRIs - Economic Times - January 8th, 2023 [January 8th, 2023]