well thank you uh for the introduction
and reading off all of those certs it
may sound hilarious uh when i
when i hear it back myself uh although i
do recommend folks if you you know
you're in this course and you're
you're thinking about your future check
out you know some of the certifications
that are out there
uh there's a lot of very good ones some
of them are very specialized uh
and so forth but i actually kind of
giggled inside when i heard that
um because i've been on the other end i
uh and i was a purdue university
graduate uh i've attended
you know this particular course that you
guys are in and
i've spoken in person a few times in the
past
and i wish we could all be there
together i'm used to you know
looking at a folks a smiley room of
smiling faces and so forth
uh but i hope um hope to cover
any question that you guys might have
with this with respect to this topic
so i'm going to be speaking on cyber
supply chain
risk management or sometimes you'll hear
what it said is
cyber scrim uh i like to say it out as
scrm or something like that but i've
definitely heard folks in the industry
call it scrim
so if you ever heard that that's kind of
what they're referring to
and the the really the focus on this
talk topic is specifically
on its impact on uh information
in operational technology now a lot of
people do talk about
uh i.t but we are going to have a little
bit of a focus on
operational which are things that we use
in our in our daily lives it can be
embedded or
other you know scada type systems or
manufacturing and so forth
and so on now just disclaimer um
the opinions you know herein are my own
and do not
necessarily represent the views of my
employer
so i will give you from my own uh
personal experience
and as best of you know guidance i can
possibly provide at least off the top of
my head
without breaking out a book or reading
something specific
all right um so i always like to kind of
do these
um things up here uh in the front that
are kind of like abstract so
if you kind of read it it's kind of the
too long don't read
uh you know summary of of really what's
going on here
and in in this topic
we are basically looking at the
interdependency that we have
of of really getting our components and
parts our software and
everything that we do to make a product
from other folks
in fact we find it very unlikely that
folks make every single component
right every single line of software even
if it's the compiler itself that is
generating the code
something is doing something for you uh
and so uh we need to understand what's
going on uh with respect to all that and
how
you know how maybe things could creep in
uh potentially
now with respect to uh electronics
uh they're almost entirely nowadays
uh manufactured offshore uh so that may
uh you know if you have various
different um you know
trust uh requirements on things that you
are creating that house to have a
certain you know trusted computing base
or something along that line
uh there's a lot of concern there uh
with respect to that
um in in folks in the past
have you know looked at various
different concerns
and identified identifying things that
may have kind of malicious functionality
from parts in which they've
purchased and have them made offshore
brought them back in and say you know
this doesn't exactly the same
as uh what i originally designed you
know
is it malicious is it some extra you
know debug functionality you know what
is this extra thing
uh and so forth um and then
um and so what we're really gonna
um focus in on is a little bit beyond
the
the close the classic um supply chain
risk management which is really more
focused on
you know are we gonna get the product on
time and on budget well we're
specifically looking at the products
that we receive
are they trustworthy do they have you
know extra vulnerabilities
uh and so forth uh and so on
now this is important especially in
areas such as
manufacturing uh you know and
where we have things are being tested
and and created with
automated processes and automated tools
and so forth and we want to see
how my cyber supply chain risk
management
affect uh what they're developing
now this is a statement um we say a lot
and uh just kind of note that uh if
you're a big company you've got a big
budget you've got a lot of cyber
security folks on staff
but if you really want to attack that
company you really attack
their suppliers so if you can go
maybe to someone who doesn't have as
much money or much funding or as much
funding as some of the bigger companies
it might be easier to attack that and
kind of look at that
with respect to one's attack surface as
ways that
um things might be entering into uh
their products
so uh just kind of talk about some
recent uh supply chain attacks
um this was uh from about a year ago
in that um the fbi was warning that
that there was lots of ongoing top
attacks with respect to
uh supply and chain companies and what
they're trying to do
is um look at folks that are supporting
the industrial control systems for
energy and trying to
you know get products in there such as
remote access trojan
uh if i can control your you know your
product
now i'm not covering solar winds if
anyone is familiar with real
real recent history but if i can get a
product
um you know inside of the way that you
you know run your system then perhaps uh
i might be able to
um you know subvert what you're doing um
and so forth
all right now this was a a big one from
a few years ago
and i'm kind of going to talk around
this particular subject
and um the big hack was a huge
uh article that came out from bloomberg
and bloomberg uh reported on this and
basically said
that um a a small little chip and that's
kind of
a depiction of of how big you know the
this how big it is the size of a you
know a grain of rice and that
you know something so small um
you know was designed into particular
boards
and you know that potentially could have
extra functionality
or back door capability or something
that is definitely not wanted right or
something you didn't design
into your own product and so forth now
it came out a lot of folks did take a
look at this and didn't necessarily find
uh this particular uh grain of rice but
if anyone knows anything about
a micro electronics manufacturing
there's a lot that one can store in that
tiny little space when you hear about
millions of transistors at
you know five microns and and what you
can do with that kind of level you know
things are so so small
it's very easy to add additional
functionality
and and for you know folks that have to
build trusted computing systems and
things that are very
you know secure um you know we have we
always have to worry about this idea
of trusted foundries are things
developed on
shore within the united states or
offshore offshore
outside of united states and there are
very few
trusted foundries within the united
states and they seem to be dwindling
every year uh there uh every time i
think that oh
maybe that's it there's no more left uh
someone uh someone will remind you
oh there's one over here or or so forth
but there isn't there isn't that many
places
around at least within the united states
that do
develop the designs in which folks might
do
so if you think you know if you're an
electrical engineer you design out your
board
you say this is exactly what i want you
know what to do i've got my
and gates and or gates and this is all
all
perfectly how i would like it to be when
you get back it's very easy for someone
to
integrate some additional extra
functionality
without you knowing it and it's very
difficult for you to
go about determining whether or not that
additional functionality is in there
whether you're
you'd have to kind of you know start to
de-layer your board
do destructive analysis or if you're
lucky
do non-destructive analysis and and
attempt to determine
how what is the you know the composition
of that board uh and so forth
uh ripple 20 uh came out um right about
the
right right before actually i wrote the
original version of this particular talk
and um it was kind of featured very
heavily at
defcon at least virtually and
with it there was 19 vulnerabilities
that had been
in a tcp library
that are found in many internet of
things
products so if you're an internet of
things vendor
you don't have a lot of costs that
you're going to be able to build into
your product if you can go out and buy
uh
some uh feature capability
and it costs you like a penny you're
going to go you're going to go do it
because
it is going to be a lot cheaper for you
in the long run
and in this particular case they were
able to find
19 unknown vulnerabilities in that tcpip
library and one of the interesting
things about it
is one of the the exploits allowed
a cross firewall remote code exploit
in that it was doing a dns request and
that dns request was passed and returned
back and so if you have an industrial
device that just so happened to be
running
uh this uh you know tcp library it's
potential that it could have bypassed
your firewall
got inside your system and have you know
extra functionality you didn't
necessarily want to be there
so things that they've found ripple 20
in
you know industrial devices you know
building
things like big robotic arms and moving
uh
big manufacturing equipment and so forth
power grids and medical devices which
really scare me
um you know definitely in home devices
so you know cheap you know cameras and
sensors
and those types of things uh and
including of course uh network devices
and things
which we build our own home networks on
and and sometimes small business you
know they use
a lot of these commodity devices to kind
of build just a simple little network
with
a simple little vpn you know connected
to another little network somewhere else
those things run a lot of internet
of things uh capabilities uh
and so forth all right
all right so i'm going to talk about
some of the work that we did
last year with respect to
working with the national institute of
technology and one of the document
documents that they were coming out with
was the nister which is an interagency
report
8276 and it's a title was key practices
on cyber supply chain risk management
observations from industry you know we
like others are
a part of industry and so this is one of
the things that we commented and
collaborated on
with them um and and provided a lot of
you know feedback
with respect to some of the things that
we might have seen uh
you know in work that looking at a lot
of different customers and
um things along that line so these were
the key
uh summary items that they had now we're
gonna have a second
uh version of this on the next slide
which was the ones that we
recommended but
their first one was established training
on cyber supply chain risk management
it's very common that folks don't always
know all the risks with respect to uh
cyber supply chain risk management and a
lot of folks
with with with respect to scrim in
general
think you know if i buy the product if
it comes to me on time
uh if i do uh you know uh
uh virus scan it's okay there's nothing
there right so that virus scan
you know says it's it's the exactly the
way i thought it was and then let's go
use it in our product and so
establishing a good and detailed
training program
on what that might mean
what are the potential ramifications of
things getting into your
environment whether it's from a hardware
perspective a software perspective
a firmware perspective all of these
types of things establishing that
training
and making sure that everyone is trained
and it's not just your engineers it's
not just your supply chain folks
it can be a wide variety of folks in
program management and
all sorts of folks quality assurance all
of those guys
are all part of the this really the team
that's going to put together
secure systems and training everyone and
having that
is very important uh the establishment
of a formal program
so having folks go about the concept of
really validating your supply chain
making sure that what is it they're
delivering potentially
is exactly what you think it is uh
you know one of the things you'll want
to do is look
at your suppliers and kind of rate them
with respect to the criticality they
might have to
a critical piece of component that you
might be making so if you're making
something that is you know maybe safety
critical
or you know some other thing that needs
to operate
you want to have a really a little bit
more scrutiny
in that and so you might have a set of
folks that might be a third party
organization within your own group or
you might outsource
to other folks and have them come in and
kind of validate
what that thing is that you buy and make
sure
that it you know it truly in fact is
what it they says it is
now integrating um supply chain uh
functions across all disciplines
um that kind of gets back a little bit
what i was talking about training in
that
it's just it's not just supply chains uh
tasks to ensure
what is purchased is secure it's gonna
involve
folks in engineering it's gonna evolve
you know
really the whole entire product uh cyber
security group
so making sure that everyone is trained
they know what they need to do they're
part of that formal program
uh and making sure that those
disciplines are all in align to make
sure that what is purchased is really
truly uh what's going to be important to
your product
now knowing and managing your suppliers
so this
is um a set of things where
you're working with your suppliers and
you are kind of monitoring what what
they're doing
making sure that they are not delivering
uh malicious content
let's say that you're part of that
formal program and you do find
um you know an of an issue well
getting to the next one collaborate with
your key suppliers but
collaborate with them and make sure that
that doesn't happen again
and um and so if it does happen again
then
you know making sure that you're
managing that and making sure that maybe
you're looking at
uh supplier redundancy or making sure
that some things are a little bit more
resilient
and how you um both create them
and integrate them into your product
now the collaborate your with your
suppliers uh
is focused on kind of that first
takeaway which is if i'm going to attack
a company i'm going to attack their
suppliers so
it is very important that organizations
collaborate with those
uh suppliers making sure that maybe you
know
they they don't have the big it security
budget that
you do and so if you can you know reach
out provide best practices
you know provide uh you know various
different
um you know tactic techniques and
procedures
uh that you see from adversaries um you
know making sure that
uh that they know that if you're a
target perhaps their target too
and you know what you might be doing to
help them bolster their security
maybe it's providing them uh equipment
that maybe they
wouldn't be able to normally afford or
some vpn access or authentication access
lock help locking down their systems you
know those types of things is a good way
to
work with those key suppliers and i
believe a lot of them will
be very receptive to that now if you go
to them and say
you know we demand you be you know we're
talking about cmmc
just a little bit later but cmmc level
five right off the bat
they might say we can't afford that and
that's something you know you want to
consider and help them
along the way and get them to that kind
of level
and then of course you're gonna monitor
them throughout that relationship so
just because it's good on day one does
not mean necessarily that it's good on
the final day and so as you're going
through
uh that relationship that you're making
sure that
uh you know things don't creep up or you
know
things change over time and and so forth
all right so these are um some other
ones
that we had a little bit different uh
has the same theme though um for us
uh one of the things that we've been
focusing on is
really uh i work a lot in training and
developing targeted training not just
generic training
but something specific to what that
individual does
on their day in and day their day job
and so that
does get help you got to get familiar
with what they do
and try to determine how does cyber
supply chain
risk management affect this particular
discipline which is going to be
different than say
you know quality is going to be
different than um
maybe purchasing or something like that
so there are certain aspects that they
all want
that is specific to the training that
they're they're looking for
uh we definitely agreed with the uh
integrating it across
all levels we'll talk about a nist uh
document upcoming another nist document
talking about that
and in course uh establishing that
formal uh program but with that forward
program
having you know clearly defined and
signed off
uh you know policies and procedures by
senior management vice presidents
presidents
uh whoever is you know got the authority
in your program that everyone
from top down is a part and agreeing on
what that formal program is
and and and helps instigate it and make
it a part of how you do
business now of course uh
you may um have defined set of
suppliers that are critical suppliers so
one of the things you'll have to do is
determine which one those might be so
you might have a
like i said a critical process or pro
you know
product that you might be developing it
might be
a sub system in a larger system or
it's a board on you know on
on this uh little chassis or this
embedded device
that that thing right there is the most
critical
aspect of your system other things might
not be as
critical so definitely making sure that
you're working with those that you
feel is most critical and having a
little bit of
extra scrutiny with respect to what that
what that is because that's really what
makes your products so great right
people love your product because this
whiz-bang thing and
if they're a part of that making sure
that they are you know
extra specially taken care of
of course understanding your supply
chain um it is often very difficult to
know
who your supplier supplier suppliers are
and i don't think i could
say supplier supplier suppliers enough
and in fact it can keep going on and on
and on
and if you do any kind of research in
the area of
supply chain risk management or in cyber
specifically
you'll find this kind of finger drawing
where
you know one thing leads to another
thing that leads to another thing that
leads to another thing that eventually
gets to
into your system and you'll be surprised
how
how in-depth it might go
um all right let's see some of the other
ones we got on here
you know i definitely collaborate uh
with
i would say really all your suppliers
but if you had to
if you could only afford a little bit
maybe you you do identify
some key specific ones other ones you
have a certain level of trust
uh that you're working with so making
sure that you're
you know using your funds correctly
now there are various different cases
where you want your products to be
resilient and you also want to have a
resilient
supplier base where you have more than
one supplier or you might have one that
develops it for let's say
arm processors or intel processors they
they might be completely different and
one of the things that we always try to
consider
with respect to building secure systems
is what happens
when we get exploited what what is the
resiliency that has to take place
uh with respect to that and it could be
it could involve
buying a component that does this one
thing that is different than another
component
and that resiliency is extraordinarily
uh important
and of course monitor them throughout
your uh throughout the entire
relationship
and uh and really think about that full
life cycle and a lot of people
do tend to forget that eventually things
do get disposed of
we don't want to see things in landfills
with you know special
firmware installed or chips you know
they are disposed of correctly
and data is properly purged and and so
forth
all right so here's some example is
an important things that folks might
want to look at with respect to
providing guidance with respect to
cyber supply chain risk management and
the biggest one right now
is what's going on uh with the special
pub 800 161
and then additionally i'm going to talk
a little bit about
the recently updated nist special pub
853
uh in the upcoming slides in
the in this specific guidance on
supply chain risk management it is you
know it's kind of listed for federal
information systems and organizations
but a lot of folks
adopt this particular uh
document and methodology now note um
draft one uh is coming uh so i
i it always cringe every time when i
make a slide and then i see
oh man this hasn't been updated for you
know six years
uh it's coming uh it's not quite out yet
uh the current one still references the
older
nist revision but it goes in depth
on looking at your organization
looking at all of those capabilities and
roles and it does provide
in section 1.7 a methodology for
building this uh this kind of group from
scratch
and so the ic ict is integrated
communications technology which is
basically everything that produces ones
and zeros
so they provide guidance on using
the nist special pub 839 which is
managing
information security risk that's
important because you don't want to
you know spend money on places you know
you don't need to be spending money
that's kind of why i kept bringing up
criticality a little bit
uh determining what's critical uh on how
your
product is going to run and execute and
what really keeps it
working those are the things you want to
focus on so you want to have that kind
of risk
management along the way to ensure that
you are
tackling and going and looking at the
right
right items now um it specifically calls
out how to apply
the nist uh security and privacy
controls which was under nist special
pub 853 revision four
and i added the bracket now revision
five so i do have that in the next slide
uh which i will cover um because they
they did some
interesting things with respect to how
it used to be
uh in the controls document and those of
you aren't familiar
uh with these particular documents
uh the 853 is probably one of the most
famous documents out there in that
people kind of equate that to
security requirements like i might have
access control requirements or
something along that line one of the
sections
in there was specific uh actually it was
a subsection
lee was called sa-12 on
supply chain risk management so move on
to the next slide
one of the things that they um did is
they pulled that out into a major level
and they kind of you know started to see
what they could do to integrate supply
chain
across the document and so they
came up with a supply chain risk
management
family or you'll see it bracketed sr
so you have policies and procedures and
you know various different controls and
it talks about
things that you want to be thinking
about if you're building in um supply
chain now
provenance um pedigree improvements you
know who has it and where
where you know who created it uh and
understanding who created it
um is is extraordinarily important
because it may be
a mom-and-pop shop who wrote some code
base that gets integrated into something
else which then gets integrated
um uh into your products and so if
you're
in the uh you know
if you were looking at the the
vulnerability i was just talking about
um where uh the tcp vulnerability
uh that was us you know a small company
wrote a tcp
library it was integrated into major
operating systems are
more focused on uh embedded type systems
those were integrated into
a targeted board that folks created made
their product out of it and it got
uh you know brought in and so
in this particular case you would look
at uh you know who had
the ability or and and touch the product
all the way all along along the way
uh the assessment and reviews so
eventually at some point you will have
to assess the work that they're doing
uh i mentioned maybe potentially
utilizing a third party
uh like an internal third party is
really helpful but if you can
definitely work with them and make sure
that you know when
you're bringing in let's say source code
from that mom and pop shop
that you might be doing things such as
static code analysis
and running various different tools and
doing it really a full static
application security test
of what is it they're developing you may
also potentially be doing dynamic
analysis
and that dynamic analysis may you know
definitely run the code
in its targeted environment and maybe
fuzz it
uh you know check for you know memory
reads and writes and all of those types
of things and and see how it works in
nominal and off nominal situations uh
and so forth
there's a whole bunch of others on here
i'm not gonna touch on them all but i do
want to recommend folks take a look at
this especially if you are
new to supply chain in
in trying to think of you know what
controls that your programs
uh or companies should be looking at
with respect
to applying to applying to the processes
and things that you're doing
there's a lot of great stuff in here
including that very last one
uh component disposal um now actually
i'm gonna go
back right um up one
authenticity is an extraordinarily uh
important thing i
apologize for skipping it um people have
been creating products
that look nearly identical to other
products in some
cases they actually exceed the
capability of the original product
in these cases they've basically reverse
engineered all of
you know all of the components they've
created their own parts
it looks nearly identical to it and you
build that part and put that part into
your environment and you think about
um you know that often you know on
authentic part may work and may not be
malicious
but it may not work in all situations
where
you know you bought it because it runs
at 500 degrees and when you do reach
that temperature
uh it burns up and then it's not as good
as you'd
like it to be and so forth
all right so all of this is really great
but how does this really impact
uh you know information technology and
specifically
operational technology now
of course you know attackers are going
to attack your suppliers
now this does include things that you
buy
to integrate into your company as a part
of the things in which you
manufacture now one of the things that
folks might want to do
is create malware specifically targeted
to your
uh your product to attempt to maybe get
a copy of your source code
get a copy of your hardware device or
hardware designs however you laid out
your chips
uh you know maybe potentially create
counterfeits or or duplicate
pro you know do duplicate systems that
look identical to yours as i was
mentioning
basically leading to a loss of
intellectual property and if you do
any kind of google search on you know
folks targeting
uh you know the united states and trying
to you know potentially
get their intellectual property it it
it's it's a lot
so uh every year the number is bigger
bigger and bigger it seems like
all right now if you're manufacturing
and you're buying uh equipment and
you're integrating it as a part of how
you're developing your
uh systems what you want to make sure
that
the things that you're utilizing to test
invalidate
that what you're doing you know
developing is good to make sure that
that system
uh does not you know pass when it should
not pass
perhaps it's saying system's great i'm
gonna let it go on through
no big deal uh or there might be some
you know certain circumstances where it
yeah it doesn't it shouldn't pass right
but they're going to allow that
to pass now also it may have extra
firmware
other capability uh installed
that you might not necessarily want
and then of course you're passing things
right
so if you pass a system you say yes that
i ran it through all of my system tests
that system test um you know says it's
okay
i'm going to go ahead and let it um
let it you know send it to my customer
and my customer runs it and it fails
and he you know and he's doing his own
vendor tracking right he's looking at me
as being a supplier to him and he's
saying oh well you know that guy
didn't necessarily deliver a good
product well the next time he really
didn't do
a good product and then we lose that
customer trust and it's definitely
something that no one wants to have
um and and so forth um
anyway um yeah the false um
false pass rates can really um really
you know trick
trick you up and uh it another thing
that you might
potentially be concerned about is what
relationship you have to the folks that
maintain
the equipment that um allow
that pass your system so you might have
a situation where
a vendor shows up they show you know hey
i'm
you know the maintenance guy for product
x
and they are allowed to go in and find
the debug port
into plotting product x plug into that
upload some
extra fun uh firmware and
you know and let that uh potentially on
through and so
there's always um
a certain set of trust that one has with
um you know
things that you do in test equipment and
and so forth and so on
all right now organizat
all organizations really should have a
cyber supply chain risk management
capability
and you need to have a method to respond
to when things go wrong
and kind of go under the assumption that
what happens
when things do go wrong what is my
disaster recovery continuing uh
continuity of operations like how do i
keep uh
how do i keep going and what happens
when a vendor contacts
me and says um well i've been using
that thing that caused ripple 20. i
don't think you
knew about it but ripple 20 you know has
a lot of unknown vulnerabilities and
it's in my product now it's in your
product
you should be aware now when do they
tell you is it a
30-day 60-day 90-get day thing you know
how do you respond how do you you know
how do you tell your customers
you know what is your vulnerability
reporting you know
uh whether you have a full you know
common vulnerability uh and exposures
you know process or or so forth how do
you how do you do
how do you respond to all of that
now there are various different ways to
specifically combat
risk now sometimes folks will say well
this all this is great but i really
don't have the funds to do that
so you might end up going with a third
party
now uh ul uh the other folks that
com you'd commonly find on like light
bulbs and stuff like that have been
working on
um a supplier trust level
and level one uh nascent and as i
mentioned you know things such as
uh criticality kind of equate that to
that so something's low criticality they
might be
nascent or um i'm sorry i'm i said that
wrong
um the criticality would be affected by
their level of trust and so if you have
a critical
uh vulnerab a critical supplier and they
are nascent that means that maybe
perhaps they don't have
very many uh cyber security practices
and then you'd want to go in and work
with them
uh and help that supplier along and so
to rate folks you could have a nascent a
challenger a contender
a strong performer or leader and we do
hope that
everyone on here does uh strive to be a
leader
uh and really has that highest trust you
know they're putting out
good code no known uh vulnerabilities
are weaknesses in their products
definitely no
no design flaws or anything along that
line
and they're working with their suppliers
to make sure that they
that though their suppliers and their
supplier suppliers which is that
two-tier relationship
that they are also becoming strong
performers they're also becoming leaders
in the way that they're delivering uh
their capability
uh capabilities today all right
so what should one be doing after
listening to this talk
first definitely get educated on
specific issues
i.t is different than operational
technology i tried to do a little bit
more
focus on operational technology
today uh there's a lot i could say on it
in addition
uh but i think that subject has really
been covered quite a bit
and uh embedded systems and things that
we use day in and day out
they our daily lives do sometimes get
missed
and it's going to be different right so
it you know if it crashes i reboot but
ot
might mean i have a problem or my
production line stops or
something is not going to be the way i
want it to be
it's not just a blue screen of death at
that point
now develop a specific set of questions
for your suppliers
uh some example ones you know do they
have an
application security program uh we tend
to use the word software assurance so
whether you use those two terms um
basically
what are they doing to deliver
and implement secure coding and have
that
throughout their life cycle and deliver
to you as you know someone that you're
going to integrate
into their uh product into your product
now uh one of the things that's recently
come out is a cyber security
maturity model certification or cmmc
as that starts to mature we'll see
folks get assessed for the certain level
of capability that they have
very you know similar to the ul provided
trust levels
in some ways uh but basically the more
capabilities that they get
uh you know you'll be higher up the
scale now uh
kind of think of it very similar to
other um
cmm or cmmi uh done
out of uh carnegie mellon or sci i'm
sorry sci
that um you know the same kind of rating
the same kind of
um structure and so so forth uh
now do a perform a component uh risk
assessment so look at each component
um try to figure out you know one way to
to categorize them whether it's ul or
something like that
figure out what kind of testing you
might want to do you might want to say
for this vendor i'm going to
um i'm going to specifically
do static analysis i'm going to check
every line of code that they have
i'm going to do pedigree um provenance
uh for whatever it was make sure it's
not just some open source code that they
just
copy and pasted uh you know you know
straight into their product
and and try to understand what what that
is and and make sure that you
implement that across your um your
components
uh now you also may want to use a
third-party vendor and i just kind of
just a quick list i think at the time i
just kind of googled third party
uh vendor you know whatever you feel uh
might be a good choice but you know
these companies
they they go out and they look at
products they look at
um maybe known uh issues with various
different vendors and they'll rate them
uh
based on their perception of that
particular vendor so if you don't have a
method
or a way to um you know understand
what's being done then perhaps they
might
provide some guidance for you and then
of course still probably number one
partner with your suppliers
and make sure that your suppliers
aren't just feeling like okay i i i give
my product to this other person
and that other person just takes it and
then scans my code and tells me my code
is bad
you know that you're working with them
and providing feedback and say you know
you guys have a lot of buffer overflows
maybe we could provide for you some
secure coding training that we might
have
so here's some example code here's ways
to fix that
let's validate our input you know all of
those wonderful things
um partnering with their suppliers can
go a long way to make sure that they
uh you know build you know build that
security into their products
build it into your products uh and so
forth and then
eventually of course everyone has to
have a plan so
uh as you if you develop your product
have a cyber scrim plan all the way from
you know you know make buy decisions all
the way to the very end
uh how are you going to handle it you
know in some cases
some folks will work with vendors and
they will um
have third parties that host um
the source code just in case third party
goes out of business
and so they will they will do that um
and and have you know have that
capability so if the third party does go
out of business then you'd want to go in
and you know have rights to maybe get
access to that in case you need to
uh update it over time and so whatever
whatever is important to you you put
that in your supply chain
a risk management plan and then work
with your vendors uh and so forth
now here's a set of references uh some
of the ones we called out today
um i think that is about it
um and so i think we're ready for
question and answers
which i haven't seen any posted on the q
a or the chat but if you
have a question you can go ahead and
enter it that would be
uh that would be totally okay either one
i've got them both
like i said while you guys are uh
thinking of questions i will note that
one of the questions we had beforehand
we had a question about threat modeling
and
maybe how threat modeling applies and i
think
mining is extraordinarily important it
does help you determine
what what is you know what's critical to
you and
where an attacker might go at you and
when i kind of
generically saying you know if someone's
going to attack you go look at your
suppliers
but they might come at you with various
different other ways too and so
um even threat modeling your suppliers
would be a really cool thing uh to do
and and determine how might your
suppliers supply your suppliers
um you know wiggle your way into your um
product okay so we have a question uh
can you elaborate on a specific case of
discovering
a threat and how it was handled um
so i'm not allowed to talk specifically
on
things that happened in particular with
my own company but i can tell you
that and i i will um
generically talk about um
the the issue with respect to um
to solar winds uh so if those of you
aren't familiar with that particular
tool it it has been used in a lot of
network uh security environments and
and some people have very much called
this a supply chain
attack now one of the things that you'll
want to do as someone who writes code
is um that supply chain uh
will uh want you'll have to have a way
to update
the code and so what they did is they
um you know they updated their code just
like normal and
somehow someone got access to uh
you know their repository their code
signing cert and so forth
and it it was very it was very difficult
in a tough situation for them
uh to deal with and they you know a lot
of folks
wouldn't have necessarily found that
particular
exploit but there was a lot of you know
work being done to kind of communicate
you know what is it what's going on
on with that and i think the whole
community uh came together
and um really handled it in a very good
way working together
exchanging you know various different
ways to um
you know do indicators of compromise
find
uh various different issues maybe maybe
provide different ideas on how
um one might go about you know scanning
for
such a type of thing right so a lot of
times if you don't have um
you know uh a static binary analysis
where you're looking at what does the
binary do if the binary is opening up a
socket when it's not supposed to a lot
of people don't
do that so there's a lot of tools that
are available
uh whether you're using ida pro or
guidra
or some of the other uh kind of reverse
engineering tools that are out there
uh there's a lot of things that that can
be done now
with respect to handling handling
threats
i mentioned it's very good to have a
certain time frame so whether it's
30 days 60 days 90 days or even in some
cases
24 hours right so if i get a problem
24 hours we're telling everyone or
something like that that might be the
requirement
so um having those defined i think is
very
very important with respect to discovery
and letting that out
um so now i do have a question uh in uh
so i'm gonna answer it live i guess i
push that button but
i'll read it first and it says uh one
may consider using a software escrow
service when bringing in third-party
software components uh into their
product
yes that's exactly uh some of the things
i was mentioning about having that third
party
um actually a lot of people forget about
um escrow services
they they do exist and as uh if you have
uh if you're buying something from a
company maybe they might not necessarily
they might not necessarily know whether
or not that company is going to be in
business
in 5 10 15 years and considering that
software
escrow might be a good idea depending on
you know what you know what might happen
and so that might be something
it's kind of between you and your
supplier uh and
and so forth um i had a couple comment
on chat so i'm gonna hit
answer live on that one and
let me scroll back up i had a couple
come in so let me try to take them in
order
um how would you consult someone about
social engineering attacks
a lot of companies don't realize uh
someone
can uh basically
kind of call them and pretend to be
someone
um if if you ever get a chance i
strongly recommend
um you attend the uh so if you go to
like a
a conference like defcon uh try to get
into
the social engineering village and uh
about a year ago there actually was a
social engineering um
conference uh in particular and uh
there's a lot of great examples about
um you know you know folks creating
websites out there
um having exact uh you know have you
know pictures you know looks just like a
company website it might say you know
that company's name
dot you know question questions.com
and they'll say hey you know um
you know we're having trouble uh
validating maybe
we'll just throw suppliers out there
right so you know
can you enter your key suppliers in here
so we can double check
them and make sure that they're not on
any
list of you know delivering bad bad
stuff
and so you get tricked very easily like
oh okay i will
all they want to know is just who my who
my key suppliers are so now
they know who your key suppliers are so
if they can go you know take them out
it's vote it's so easy to trick people
uh i have seen um and i'm not a social
engineer my joke about social
engineering is basically
so i lock down my system and someone
goes what's your password
and you're like solarwinds1234 um
you know if you if if it's that easy
then you know someone just tricks you
and
and you just give up the password and
i've seen so many even
smart intelligent people be tricked from
social engineering
um it i would say um
education is great um knowing what to do
when you do get that fish or spearfished
is is is is very very good um
i know i know kevin mitnick puts out a
lot of courses along that area and
there's a lot of
some companies that he work with he
works with that do put out training in
that area
and there are third parties that do
targeted
um social engineering to kind of see how
this organization doing with respect to
identifying social engineering tricks
all right i'll move on to the next one
it says what do you think about
bloomberg doubling down on the supplier
chain
you mentioned despite uh producing any
public evidence of their claim
um yeah i was following that very
intently
because um i didn't i
personally i don't know whether or not
there was something there
but when i think about how small the
chips are getting
and they're getting smaller and smaller
to a point that maybe you can't find
things
maybe it was or wasn't there i don't i
don't really know but it does give me
pause
for thought right you look at a system
board if i hold up a system board can
you tell me what's on that board
uh there's a lot of a lot of stuff there
and
i can't tell you that all the the
transistors are exactly the way that i
originally designed
if if i don't have a good method to you
know validate that
so um all i can say is they you know
they did double down as drew was
mentioning and
they were very adamant that and i don't
think even today have they
retracted anything so um
i can't i'm not bloomberg but uh they
seem to be very adamant that that was
that was definitely the case
all right um i have one to send to me
directly so let me see if that's
actually a question or
um and so forth um
oh so the question is really around uh
small manufacturers
um and not having the security staff
uh you know a lot a lot of folks there
there is
so you guys are if you guys are taking
this course i can tell you
um i went to pre university i had a lot
of job offers
um i luckily had a nice conversation
with uh dr
spafford and i said hey i'm gonna have i
have all these which one should i take
and he was like
you take that one and that one was a
network security job
there are there's just a huge shortage
out there of of of really good
people i think some people say well
there's millions of unfilled jobs well
yeah there's a lot of jobs out there but
really good people
and you know you guys are going to
purdue i have high faith in you guys
all and um i think that you know you
guys can fill
a lot of those roles and whether you're
small
or maybe even moderate sized you might
not always have
um you know all the people that have
the kind of training that you guys have
had or something along the lines so
um they're it it it depends it really
depends on
the quality like i definitely have
talked to folks i feel like i'm like a
few few people and i'm like wow that
guy's like
he's going somewhere he's very smart um
and so it it let's say that to the
answer to the question i would say
it depends right it really depends on
the person working the job and i can
tell you honestly that cyber security is
just plain awesome
and i strongly recommend it keep going
in cyber security
and um you know especially
if you ever get into understanding like
how x-plays work and you make an exploit
work and you understand
everything about it it's it's
interesting it's kind of like when you
lock pick and you finally pick that lock
it's really kind of cool so i recommend
it
um so you might want to mention
diversity of roles
in our field um socks cert audit
compliance uh just by two cents
um i'm assuming you mean um doing
uh both uh security operations and
incident response
uh and then kind of like transitioning
into uh
audit and compliance yes um
and this isn't uh you know like uh
necessarily like um
yeah yeah okay yeah to paul's um
statement uh they're in cyber security
there is everything and if someone asks
me like what area of cyber security do
you
special in and i go cissp and they're
like
really i'm like yeah i'll do everything
and there is a wide range of jobs
whether you're doing
compliance which compliance can just be
like a check in the box
to implementing uh cyber security to
reverse
engineering to i'm a developer and i
write secure code
i'm a secure architect i'm a cloud
security person
i am um you know all of those
as someone who's done a lot of different
roles
changing what you're doing every so
often is really
kind of good uh you will find um
different points of view and it will
definitely make you a better
cyber security person i know if i kind
of come in
and be like okay i'm cyber secure you
know i'm the cyber security person and
i'm here to
make everything better oh by the way
your software is
not so secure uh you know we've done
these static analysis tools
on it and it says this and i've gone
through it and i've kind of like
validated those things
you know you know just saying what a
tool says
isn't really really that great but
understanding
exactly um why it works the way it is
especially coming from like a
programming background and understanding
how software
you know is put together is is very
important so having a wide range of jobs
um i mean i've done network security
uh networks so network security led into
network intrusion detection
which led into vulnerability
identification
which included vulnerability reverse
engineering
to exploitation to you know how was that
done in other
you know other industries so definitely
wide variety
of jobs very very cool to look at
okay i think that's it that last one was
had nothing to do with with really
supply chain but
you so much for joining the series
seminar and um
we'll make videos available in our
youtube channel
okay alrighty all right thank you all
right thank you guys
bye
you