NIST Refreshing Voluntary Cybersecurity Framework Amid Push for Mandates
Source: Nextgov
Published: February 22, 2022
The National Institute of Standards and Technology wants to know how it might improve its landmark framework of cybersecurity standards and practices and streamline similar efforts related to particular issues like privacy and supply-chain security. “Every organization needs to manage cybersecurity risk as a part of doing business, whether it is in industry, government or academia,” said Commerce Deputy Secretary Don Graves in a news bulletin NIST published Tuesday. “It is critical to their resilience and to our nation’s economic security. There are many tools available to help, and the CSF is one of the leading frameworks for private sector cybersecurity maintenance. We want private and public sector organizations to help make it even more useful and widely used, including by small companies.”
New Pentagon Report Raises Alarm Over Industry Consolidation, Future of Competition
Feb. 16, 2022
Air Force Magazine
The Defense Department faces a future of high-price, sole-source contracts, reduced innovation, and possible critical shortages if it doesn’t take steps to increase competition and the number of suppliers in the defense industrial base, according to a new Pentagon report. But changing the conditions creating the situation won’t be easy, it said.
To prevent these issues, the U.S. must limit further defense industry consolidation; fix intellectual property issues; attract new businesses to the industry—especially small businesses—and put “sector-specific supply chain resiliency plans” into effect for critical items, ranging from missiles to castings, strategic metals, and microelectronics, according to the report, released Feb. 15.
Pentagon Report: State-of-Competition-Within-the-Defense-Industrial-Base
Three Ways to Enhance Supply Chain Cybersecurity
Three Ways To Enhance Supply Chain Cybersecurity
Source: Forbes
Published: February 16, 2022
It’s a familiar headline: Your supply chain may be your biggest cybersecurity risk. And for good reason. Between pressure to maintain business continuity and exceed profits amid inflation and global supply chain issues, organizations across industries have a lot to contend with. This focus elsewhere can lead to threat actors slipping under the radar more easily while also making a big splash. For instance, beyond the potential exposure of credit card data, we’ve seen a rise in ransomware and nation-state threat activity in an attempt to further disrupt stressed infrastructures. While these challenges are broad, if we approach cybersecurity as a collective whole, rather than as individual organizations, they are not insurmountable.
Cyber Attack Strikes German Fuel Supplies
Cyber-attack strikes German fuel supplies
Source: BBC
Published: February 1, 2022
A major fuel supplier in Germany is operating at a “limited capacity” after a cyber-attack disrupted IT systems at the weekend. Oiltanking Deutschland GmbH & Co. KG stores and transports oil, vehicle fuels and other petroleum products for companies like Shell. It says it discovered it had been hacked on Saturday. It has declared “force majeure” for the majority of its inland supply activities in Germany.
A cyber attack at the Patent Office led to increased eyes on supply chain risk
Many people think of cybersecurity as threats coming from the outside, but with the government relying on private companies to provide hardware and software, the very tools that agencies use could be a threat within themselves.
Supply chain issues are wracking the nation, but the government is also thinking about its supply chain in terms of what companies are providing goods and services.
The U.S. Patent Office is one organization that pays particularly close attention to supply chain issues in order to keep clients proprietary information safe. Just recently, the Patent Office found a zero day vulnerability in one of its logging libraries, according to Stephan Mitchev, director of the Office of Application Engineering and Development and acting chief technology officer at the Patent Office.
That infiltration caused the office to look harder at its supply chain to see what could have been infected.
SolarWinds Public Sector Cybersecurity Survey Report 2021
SolarWinds released the findings of its seventh Public Sector Cybersecurity Survey Report. The Public Sector Cybersecurity Survey Report includes responses from 400 IT operations and security decision makers, including 200 federal, 100 state and local, and 100 education respondents.
“These results demonstrate that while IT security threats have increased—primarily from the general hacking community and foreign governments—the ability to detect and remediate such threats has not increased at the same rate, leaving public sector organizations vulnerable,” said Brandon Shopp, Group Vice President, Product Strategy, SolarWinds. “But the data also shows an increased awareness and adoption of zero trust, as well as a commitment to invest in IT solutions and adopt cybersecurity best practices outlined in the Administration’s Cybersecurity Executive Order. It’s through these steps that public sector organizations can enhance their cybersecurity posture and fight the rising tide of external threats.”
NIST SP 800-160v1 Revision 1 Initial Public Draft out for Review
NIST is releasing the draft of a major revision to Special Publication (SP) 800-160 Volume 1, Engineering Trustworthy Secure Systems. This publication is intended to serve as a reference and educational resource for engineers and engineering specialties, architects, designers, and personnel involved in the development of trustworthy secure systems and system components. The guidance can be applied selectively by organizations, individuals, or engineering teams to improve the security and trustworthiness of systems and system components.
In particular, Draft SP 800-160 Volume 1, Revision 1 focuses on the following strategic objectives, which drove the majority of changes to the publication:
- More strongly positioning Systems Security Engineering (SSE) as a sub-discipline of Systems Engineering (SE)
- Emphasizing that the responsibility for engineering trustworthy secure systems is not limited to security specialties and that the achievement of security outcomes must properly align with SE outcomes
- Aligning SSE practices with safety practices and other disciplines that deal with the loss of assets and the consequences of asset loss
- Focusing on the assurance of the correctness and effectiveness of the system’s security capability to achieve authorized and intended behaviors and outcomes and control adverse effects and loss
- More closely aligning systems security engineering work to international standards
NIST is interested in feedback on the specific changes made to the publication during this update, including the organization and structure of the publication, the presentation of the material, its ease of use, and the applicability of the technical content to current or planned systems engineering initiatives.
Submit comments using the comment template provided.
Automatic Diversity in the Software Supply Chain
ArXiv.org
Abstract
Despite its obvious benefits, the increased adoption of package managers to automate the reuse of libraries has opened the door to a new class of hazards: supply chain attacks. By injecting malicious code in one library, an attacker may compromise all instances of all applications that depend on the library. To mitigate the impact of supply chain attacks, we propose the concept of Library Substitution Framework. This novel concept leverages one key observation: when an application depends on a library, it is very likely that there exists other libraries that provide similar features. The key objective of Library Substitution Framework is to enable the developers of an application to harness this diversity of libraries in their supply chain. The framework lets them generate a population of application variants, each depending on a different alternative library that provides similar functionalities. To investigate the relevance of this concept, we develop ARGO, a proof-of-concept implementation of this framework that harnesses the diversity of JSON suppliers. We study the feasibility of library substitution and its impact on a set of 368 clients. Our empirical results show that for 195 of the 368 java applications tested, we can substitute the original JSON library used by the client by at least 15 other JSON libraries without modifying the client’s code. These results show the capacity of a Library Substitution Framework to diversify the supply chain of the client applications of the libraries it targets.
What are Weak Links in the Node.js Package Manager (NPM) Supply Chain?
What are Weak Links in the npm Supply Chain?
ArXiv.org
Abstract
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, and their users with supply chain attacks. In 2021 there was a 650% year-on-year growth in security attacks by exploiting Open Source Software’s supply chain. Proactive approaches are needed to predict package vulnerability to high-risk supply chain attacks.
The goal of this work is to help software developers and security specialists identify weak links in a software supply chain by empirically studying npm package metadata.
In this paper, we analyzed the metadata of 1.63 million JavaScript npm packages. We propose six signals of a security weakness in a software supply chain, such as the presence of install scripts, maintainer accounts associated with an expired email domain, and inactive packages with inactive maintainers. Our analysis identified 11 malicious packages from the install scripts signal. We also found 2,818 maintainer email addresses associated with expired domains, allowing an attacker to hijack 8,494 packages by taking over the npm accounts.
We obtained feedback on our weak link signals through a survey responded to by 470 npm package developers. The majority of the developers supported three out of our six proposed weak link signals. The developers also indicated that they would want to be notified about weak links signals before using third-party packages. Additionally, we discussed eight new signals suggested by package developers.
On the Feasibility of Detecting Software Supply Chain Attacks
Published in: MILCOM 2021 – 2021 IEEE Military Communications Conference (MILCOM)
Date of Conference: 29 Nov.-2 Dec. 2021
The Supply chain attack is the stealthy and sophisticated cyberattack that aims to compromise a target by exploiting weaknesses and vulnerabilities in its supply chain. Recent supply chain attacks (e.g., SolarWinds attack) have compromised some of the most secured IT infrastructures of government agencies and enterprises. The European Union Agency for Cybersecurity, ENISA, has predicted that there will be 3 times more supply chain attacks in 2021 than in 2020. In this paper, we look into the problem of supply chain attacks, the challenges of defending software supply chain attacks. We analyze what it takes to effectively prevent software supply chain attacks, and show that it is indeed feasible and practical for the customers to detect certain software supply chain attacks. We propose an information flow based detection approach that enables end users to detect many software supply chain attacks without dealing with any of the underlying software suppliers.