Cyber-attack strikes German fuel supplies
Source: BBC
Published: February 1, 2022
A major fuel supplier in Germany is operating at a “limited capacity” after a cyber-attack disrupted IT systems at the weekend. Oiltanking Deutschland GmbH & Co. KG stores and transports oil, vehicle fuels and other petroleum products for companies like Shell. It says it discovered it had been hacked on Saturday. It has declared “force majeure” for the majority of its inland supply activities in Germany.
A cyber attack at the Patent Office led to increased eyes on supply chain risk
Many people think of cybersecurity as threats coming from the outside, but with the government relying on private companies to provide hardware and software, the very tools that agencies use could be a threat within themselves.
Supply chain issues are wracking the nation, but the government is also thinking about its supply chain in terms of what companies are providing goods and services.
The U.S. Patent Office is one organization that pays particularly close attention to supply chain issues in order to keep clients proprietary information safe. Just recently, the Patent Office found a zero day vulnerability in one of its logging libraries, according to Stephan Mitchev, director of the Office of Application Engineering and Development and acting chief technology officer at the Patent Office.
That infiltration caused the office to look harder at its supply chain to see what could have been infected.
SolarWinds Public Sector Cybersecurity Survey Report 2021
SolarWinds released the findings of its seventh Public Sector Cybersecurity Survey Report. The Public Sector Cybersecurity Survey Report includes responses from 400 IT operations and security decision makers, including 200 federal, 100 state and local, and 100 education respondents.
“These results demonstrate that while IT security threats have increased—primarily from the general hacking community and foreign governments—the ability to detect and remediate such threats has not increased at the same rate, leaving public sector organizations vulnerable,” said Brandon Shopp, Group Vice President, Product Strategy, SolarWinds. “But the data also shows an increased awareness and adoption of zero trust, as well as a commitment to invest in IT solutions and adopt cybersecurity best practices outlined in the Administration’s Cybersecurity Executive Order. It’s through these steps that public sector organizations can enhance their cybersecurity posture and fight the rising tide of external threats.”
NIST SP 800-160v1 Revision 1 Initial Public Draft out for Review
NIST is releasing the draft of a major revision to Special Publication (SP) 800-160 Volume 1, Engineering Trustworthy Secure Systems. This publication is intended to serve as a reference and educational resource for engineers and engineering specialties, architects, designers, and personnel involved in the development of trustworthy secure systems and system components. The guidance can be applied selectively by organizations, individuals, or engineering teams to improve the security and trustworthiness of systems and system components.
In particular, Draft SP 800-160 Volume 1, Revision 1 focuses on the following strategic objectives, which drove the majority of changes to the publication:
- More strongly positioning Systems Security Engineering (SSE) as a sub-discipline of Systems Engineering (SE)
- Emphasizing that the responsibility for engineering trustworthy secure systems is not limited to security specialties and that the achievement of security outcomes must properly align with SE outcomes
- Aligning SSE practices with safety practices and other disciplines that deal with the loss of assets and the consequences of asset loss
- Focusing on the assurance of the correctness and effectiveness of the system’s security capability to achieve authorized and intended behaviors and outcomes and control adverse effects and loss
- More closely aligning systems security engineering work to international standards
NIST is interested in feedback on the specific changes made to the publication during this update, including the organization and structure of the publication, the presentation of the material, its ease of use, and the applicability of the technical content to current or planned systems engineering initiatives.
Submit comments using the comment template provided.
Automatic Diversity in the Software Supply Chain
ArXiv.org
Abstract
Despite its obvious benefits, the increased adoption of package managers to automate the reuse of libraries has opened the door to a new class of hazards: supply chain attacks. By injecting malicious code in one library, an attacker may compromise all instances of all applications that depend on the library. To mitigate the impact of supply chain attacks, we propose the concept of Library Substitution Framework. This novel concept leverages one key observation: when an application depends on a library, it is very likely that there exists other libraries that provide similar features. The key objective of Library Substitution Framework is to enable the developers of an application to harness this diversity of libraries in their supply chain. The framework lets them generate a population of application variants, each depending on a different alternative library that provides similar functionalities. To investigate the relevance of this concept, we develop ARGO, a proof-of-concept implementation of this framework that harnesses the diversity of JSON suppliers. We study the feasibility of library substitution and its impact on a set of 368 clients. Our empirical results show that for 195 of the 368 java applications tested, we can substitute the original JSON library used by the client by at least 15 other JSON libraries without modifying the client’s code. These results show the capacity of a Library Substitution Framework to diversify the supply chain of the client applications of the libraries it targets.
What are Weak Links in the Node.js Package Manager (NPM) Supply Chain?
What are Weak Links in the npm Supply Chain?
ArXiv.org
Abstract
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, and their users with supply chain attacks. In 2021 there was a 650% year-on-year growth in security attacks by exploiting Open Source Software’s supply chain. Proactive approaches are needed to predict package vulnerability to high-risk supply chain attacks.
The goal of this work is to help software developers and security specialists identify weak links in a software supply chain by empirically studying npm package metadata.
In this paper, we analyzed the metadata of 1.63 million JavaScript npm packages. We propose six signals of a security weakness in a software supply chain, such as the presence of install scripts, maintainer accounts associated with an expired email domain, and inactive packages with inactive maintainers. Our analysis identified 11 malicious packages from the install scripts signal. We also found 2,818 maintainer email addresses associated with expired domains, allowing an attacker to hijack 8,494 packages by taking over the npm accounts.
We obtained feedback on our weak link signals through a survey responded to by 470 npm package developers. The majority of the developers supported three out of our six proposed weak link signals. The developers also indicated that they would want to be notified about weak links signals before using third-party packages. Additionally, we discussed eight new signals suggested by package developers.
On the Feasibility of Detecting Software Supply Chain Attacks
Published in: MILCOM 2021 – 2021 IEEE Military Communications Conference (MILCOM)
Date of Conference: 29 Nov.-2 Dec. 2021
The Supply chain attack is the stealthy and sophisticated cyberattack that aims to compromise a target by exploiting weaknesses and vulnerabilities in its supply chain. Recent supply chain attacks (e.g., SolarWinds attack) have compromised some of the most secured IT infrastructures of government agencies and enterprises. The European Union Agency for Cybersecurity, ENISA, has predicted that there will be 3 times more supply chain attacks in 2021 than in 2020. In this paper, we look into the problem of supply chain attacks, the challenges of defending software supply chain attacks. We analyze what it takes to effectively prevent software supply chain attacks, and show that it is indeed feasible and practical for the customers to detect certain software supply chain attacks. We propose an information flow based detection approach that enables end users to detect many software supply chain attacks without dealing with any of the underlying software suppliers.
China Locks Down City Containing One of World’s Busiest Ports, Could Impact Supply Chain
China Locks Down City Containing One of World’s Busiest Ports, Could Impact Supply Chain
Source: Newsweek
Published: January 7, 2022
The Chinese industrial city of Ningbo has been shut down due to COVID-19 and the lockdown has its port continuing to be backed up. Located in the Zhejiang province of China, Ningbo is home to the third-largest port in the world. However, lockdown measures could worsen the already-disrupted port as worldwide supply chain woes persist.
Log4j Highlights Need for Better Handle on Software Dependencies
Dark Reading
January 3, 2022
Log4j Highlights Need for Better Handle on Software Dependencies
It’s a new year and the cybersecurity community now faces the long-term consequences of yet another software supply chain security nightmare. After a year full of application security zero-day fallout, the Log4j vulnerability debacle (also referred to as Log4Shell) was like a thematic bookend for 2021 that closed out the year much in the way SolarWinds started it. The real-world consequences of these incidents schooled enterprise IT teams in too many ways to count. But perhaps the most important lesson to bubble up is how much work many organizations need to do to truly understand and manage what code is running under the hood across their software portfolios. Like the SolarWinds incident before it, the Log4j fiasco highlighted how many hidden software dependencies exist in enterprise software — and how hard it is to stamp out critical underlying flaws when these dependencies aren’t sufficiently understood.
The Impact of Business Intelligence on Supply Chain Performance with Emphasis on Integration and Agility–a Mixed Research Approach
International Journal of Productivity and Performance Management
Purpose
The paper aims to explore how business intelligence (BI), integration and agility influence supply chain performance.
Design/methodology/approach
The study was performed by the exploratory sequential mixed method in two phases including meta-synthesis as a qualitative method and survey as a quantitative method. Data were collected through a survey of 369 Iranian companies across various industries. Structural equation modeling was used to test hypotheses.
Findings
The results show that BI, integration and agility play an important role in achieving better supply chain performance. In the meantime, BI has the greatest impact on supply chain performance. Additionally, BI has a positive and significant effect on the integration and agility of the supply chain. The study also found that integration has a direct effect on supply chain agility.
Originality/value
To the best of the authors’ knowledge, the paper theoretically and empirically presents a new conceptual model of the relationship between BI, integration, agility and supply chain performance. The study helps researchers and practitioners to achieve insights into supply chain performance improvement.