Authors/
Terence Liu, CEO of TXOne Networks, SEMI Taiwan Semiconductor Cybersecurity Committee
Darren Chung, TXOne Networks Technical Marketing Team
The Importance of Cybersecurity for the Supply Chain
Modern ICT products and services depend on their supply chains, which connect global manufacturers, software developers, and other service providers. Generally, the components and software for the end product come from many sources. For example, the end product may be designed in North America then and manufactured in an Asian country, where it is assembled with multiple components originating from various countries and manufacturers. Not only can the resulting products from this process contain malware or be vulnerable to cyber-attacks, but vulnerabilities in the supply chain itself can also affect a company's cybersecurity.
Although globalized supply chains boost the global economy, they also put companies and consumers at risk. According to the ENISA report in 2021– "Threat Landscape for Supply Chain Attacks" [1], the data showed in the report highlights the importance of cybersecurity for the supply chain:
The number of supply chain attacks has risen sharply: The survey shows that the number of supply chain attacks was four times more in 2021 than it was in 2020.
Product security is critical to supply chain risk management: The survey shows that in order to attack the targeted organization, adversaries focused on the suppliers' software code in 66% of the reported incidents. Supply chain risk is no longer just a cybersecurity management issue, it now also requires safeguarding the cybersecurity of ICT products.
Critical assets are now a prime target for hackers: About 58% of hackers in supply chain incidents primarily targeted customer data, including personally identifiable information (PII) and intellectual property. It shows that once a supply chain incident occurs, it will seriously impact the competitiveness of enterprises.
Even if an organization's own defenses are comprehensive, it can be easy to suffer from supply chain attacks. Adversaries can use the most vulnerable vector in the supply chain to conduct targeted attacks penetrating the target organization. In addition, a manufacturer could suffer a ransomware attack from one of its suppliers, resulting in disruption of the supply of critical manufacturing components, or a retailer could suffer a data breach from a supplier because the supplier that maintains its air conditioning systems has access to the retailer's data sharing portal.
Cyber Attacks on Supply Chains in High-Tech Industries
What is a supply chain attack? A supply chain combines an ecosystem of resources and activities required to design, manufacture, assemble, and distribute a product to move resources from suppliers to end consumers. However, attacks can occur by targeting one or more of a supply chain's systems, processes, developers, or operational services, thereby gaining access to the critical system or causing disruptive or harmful effects. Although ‘supply chain attack’ is a general term and there is no universally accepted definition, the relevant threats can be classified into four attack levels according to the National Counterintelligence and Security Center (NCSC) in the US [2]:
Supply chain cyber attack
The first is an attack using cyber means to target one or more of the systems, processes, developers, or operational services of a supply chain, thereby achieving access to the critical system or inducing disruptive or damaging effects.
One notable supply chain attack incident in the retail industry is that of Target, where more than 70 million consumers had their data stolen, leading to a total loss of about 200 million US dollars in 2013. We can see that the incidents were initiated through supply chain attacks. By leveraging stolen credentials from retail suppliers to gain access privileges to the network, the hacker escalated privileges and moved laterally undetected until the hacker found the critical POS system. The malware downloaded detailed credit card information from the POS system, and all the data was then quietly exfiltrated to the attackers’ servers.
Software-enabled attack
The second is software-enabled supply chain attacks, which typically exploit "software vulnerabilities" to disrupt, disable, or destroy supply chain systems, processes, or operations. It is worth noting that this type of attack is distinct from the "software supply chain attack" subset that targets the software's design, development, delivery, or improvement.
For example, the Log4Shell is vulnerability was found in the widely-used open source software and Java-based log auditing framework, Apache Log4j. The vulnerability was discovered to have somehow missed validation and input checking, allowing hackers to remotely execute code (REC) and install malicious code on the targeted computer to launch various attacks. This vulnerability has been assigned a CVE number (CVE-2021-44228). Furthermore, the widespread use of Log4j in the industry makes Log4Shell one of the most critical vulnerabilities ever discovered. Even Cadence, an EDA software and engineering service leader, was affected by the significant Log4j vulnerability that ravaged the world in 2021 [3].
Software supply chain attack
The third type is the ‘software supply chain attack’. This kind of attack occurs when a cyber threat actor infiltrates a software vendor's network and employs malicious code to compromise the software before the vendor delivers it to their customers. The compromised software then compromises the customer's data or system. The characteristic of this kind of attack is that the hacker infiltrates the vendor's software development process before the software is compiled and signed. It will become a software product with malicious code, which makes the malware more difficult to detect. They are attacks against the supply chain of the piece of software itself.
In 2020, the state-sponsored hacking group exploited access to SolarWinds' software development operations to modify SolarWinds' source code for its Orion network management software. State-sponsored hacking groups inserted malicious code in an automatic software security update impacting 18,000 government and private users. To prevent SolarWinds developers and users from discovering the existence of malware, hackers have designed many mechanisms to avoid detection. For instance, malware is employed before compiling and only occurs when deployed on the customer. The incident took a year and three months from the start of the intrusion until SolarWinds discovered it.
Hardware-enabled attack
Adversaries can also compromise devices by tampering with hardware or modifying the supply chain firmware. Those attacks may be challenging to detect and give the adversary a high degree of control over the system. Hardware manipulations create a "back door" connection between the device and external computers that the attacker compromises, and once a "back door" infiltrates the hardware supply chain adversaries will use it to gain further access or steal data.
Two known methods to accomplish hardware-enabled attacks are ‘interdiction’ and ‘seeding’ [4]. In interdiction, adversaries intercept hardware on its way to the following factory in the production line and then modify hardware and quickly repackage, going back to the original working process and final location. Another way is seeding attacks. Adversaries may pose as an insider or convince an insider to either conduct actions that benefit the attack, such as allowing the adversaries direct access to the hardware. For example, state-sponsored hacking groups APT28 or Fancy Bear used the Unified Extensible Firmware Interface (UEFI) rootkit to attack Windows PCs in 2018. The rootkit, known as LoJax, is designed to install malicious code directly into the operating system and ensure it is executed upon startup. This technique allows adversaries to maintain persistence on affected devices, despite hard drive replacements and operating system reinstallations [5].
How to Mitigate Supply Chain Attacks in the Semiconductor Industry
As mentioned above, companies in the semiconductor industry chain are hyperconnected, and supply chain security is already a problem that the semiconductor industry must fully understand and response. The National Institute of Standards and Technology (NIST) released a new version of the document SP 800-161r1 [6] on cybersecurity supply chain risk management in May 2022 to help all circles understand supply chain risks and guide enterprises to effectively manage risks.
1. Identify the Cyber Risk Posture of Supply Chain
The New version of SP 800-161r1 pointed out that one of the key successful factors in cyber supply chain risk management is that companies must carefully assess supplier cybersecurity risks from the initial stage of acquisition. Acquisition teams can work with cybersecurity teams to drive acquisition policies and processes that incorporate supply chain security considerations into every step of the acquisition and contract management lifecycle. For example, the US government mandates supply chain risk management considerations in GSAM Subpart 504.70, which include planning, defining, and developing requirements, performing market analysis, completing procurement, ensuring compliance, and monitoring performance to ensure supply chain security is considered when purchasing ICT/OT assets.
a. Identify and assess supply chain cybersecurity posture
Firstly, the enterprise should formulate and define requirements for addressing cybersecurity risks throughout the supply chain during the planning stage. After defining the requirements, the enterprise usually conducts a market analysis of potential suppliers. Market analysis activities explore the availability of potential or pre-qualified sources for the supplier. It is a common practice for companies to conduct more robust due diligence research on potential suppliers and/or products using cybersecurity questionnaires to generate supplier risk profiles. Moreover, the enterprise can use a Request for Information (RFI) to conduct a preliminary screening of potential suppliers and gather cybersecurity validation information.
b. Actively monitor the cybersecurity posture of the supply chain
In addition to conducting questionnaire surveys, enterprises should monitor supply chain cybersecurity risks in real-time. Enterprises will continuously monitor their supply chain security posture with a dedicated third-party security rating tool. The security rating tools can leverage big data from the network and mathematical models to transform supply chain threat intelligence into quantitative cyber risk indicators, such as social information exposure, darknet discussion, DNS health level, IP reputation, credential leakage, system patching, network security, endpoint security and so on.
c. Supply Chain Threat Intelligence Sharing
Effective information sharing helps companies access information to understand and mitigate cybersecurity risks across the supply chain. Companies can build information-sharing processes and activities into their supply chain risk management. This program may include establishing information-sharing agreements with peer companies, business partners, and suppliers. By exchanging supply chain risk information within a community, companies can leverage that community's collective knowledge, practices, and capabilities to gain a complete landscape of the threats.
For example, in December 2018, the US Department of Homeland Security established the ICT SCRM working group, Japan in November 2020 established Supply Chain Cybersecurity Consortium, and Taiwan also established a SEMI Taiwan Semiconductor Cybersecurity Committee in 2021 to facilitate information sharing and provide regulations and best practices to private industry.
2. Establish Control with OT Zero Trust in Asset Life Cycle Protection
The goal of the OT zero trust approach is to eliminate all threats, whether they originate from inside or outside the network. The central principle is that it is not safe to trust anything inside or outside the OT environment – including stakeholders, the network, or assets – without first conducting identification and classification. Many global leaders in semiconductors use the asset life cycle architecture together with OT zero trust to plan and deploy cyber defenses for semiconductor work sites. They’ve found OT zero trust to be an effective as a strategy for mediating and adding defensive underpinnings to the asset planning phase, where improving long- and short-term cyber defensive outcomes is critical.
a. Onboarding
Before an asset is shipped to a foundry, suppliers should scan each asset to create a record of OT health that proves the equipment is malware-free. In the past, attackers have launched large-scale attacks and exploited the supply chain by compromising assets prior to shipment. Similar to going through each country’s customs on either side of an international flight, both the supplier and the asset owner must keep a record as they independently confirm device safety and security for themselves on their own side of the transaction.
b. Staging
During the staging phase, prepare assets by patching vulnerabilities and shutting down non-essential services such as system applications, permissions, ports, and user accounts, thereby reducing the opportunity for attackers to gain access to mission-critical computers in a device. We can achieve the goal in different system layers by following examples, including but not limed to:
Using malware protection to enhance the system's immunity
Removing all superfluous services and software
Disabling high risk network protocols and unnecessary network ports
Controlling for and limiting user privileges and access
Disabling USB ports at boot
c. Production
As mentioned in the first chapter, asset users usually face the problem of managing legacy assets, where they need to ensure uninterrupted production and operational resilience. In this case, network segmentation prevents system vulnerabilities from turning into large-scale disasters. For example, different parts of a computer network or network area are separated by firewalls, switches, and routers to reduce malware cross-infection. The benefits of the protection stage are avoiding a wide range of network attacks, improved access control for external and internal network security, and better analytics around network monitoring.
d. Maintenance
From the moment an asset is put into its intended production use, it begins to age and depreciate, and regular maintenance begins. Not only repairs, but also ongoing software configuration changes, system upgrades, and security updates to keep assets in sync with the changing factory field. Sometimes this is also necessary in order to maintain compliance with company security policies.
3. Build Software Assurance into Supply Chain Management
Today's software development relies on a complex software supply chain ecosystem (including open source software). From the Log4j incident, we know potentially devastating vulnerabilities may exist in open source. Once the vulnerable open source code is broadly applied within an industry, then there is a potential for far-reaching impact within that industry. Moreover, the SolarWinds incident shows the importance of establishing a secure software development process. To build a secure and trustworthy software supply chain, companies should encourage suppliers to deploy the following software assurances [7]:
a. Integrate cybersecurity into automated software development workflows
To avoid the extra cost of after-the-fact patching, it is necessary to perform efficient system security testing in the development process. However, the key to success depends on agile development methods and DevSecOps, Software security testing needs to be automated into development workflows and maximize automated detection capabilities, including threat modeling, static code analysis, dynamic code analysis, software composition analysis, manual code review, and penetration testing.
b. Actively identify and disclose vulnerabilities while maintaining a vulnerability response program
Much software is composed of complex and imperfect components (such as open source components), which may hide high-risk vulnerabilities. A key benefit of identifying and disclosing vulnerabilities is the early detection of software with hidden vulnerabilities. This capability has become part of the supplier's competitiveness. By leveraging third-party cybersecurity inspection tools, the supplier can automatically correlate numerous public and private vulnerability repositories to analyze software for hidden high-risk vulnerabilities.
c. Enable patch management
Based on the criticality vulnerability analysis and to provide the customer with the supplier's patch management policy, the supplier should establish a scope for and then deploy, verify, and validate mitigation such as security upgrades and corrective configurations recommendation for that vulnerability.
d. Maintain a list of organization-approved commercial software components and component versions
To mitigate enterprises using software with high-risk vulnerabilities, enterprises should maintain a list of organization-approved commercial software components and component versions with their provenance data. Should assess EOL status and deploy virtual patching as necessary. For instance, Windows XP and Windows 7 are examples of end-of-support operating systems. When Microsoft stopped issuing updates and patches, these OSes became more vulnerable to security threats. Thus, vendors should avoid developing the product with end-of-support OSes such as Windows XP and Windows 7.
e. Require a software component inventory
It is recommended that suppliers improve the transparency of the software supply chain, and require suppliers to establish a software component inventory, sometimes referred to as a "software bill of materials (SBOM). Moreover, NTIA has established the importance of SBOM, and the US FDA also requires that electronic medical equipment incorporate SBOM into the acquisition standards. International SBOM standardization has also been widely discussed, including SWID, Common Platform Enumeration (CPE), SPDX, and CycloneDX. SBOM reports can also act as a form of OT health record, helping asset owners to identify the potential impact of a new vulnerability and allowing cybersecurity teams to quickly find where the vulnerable software is being used so they can plan remediation accordingly.
TXOne Networks’ role in supply chain cybersecurity
To improve the security of the semiconductor industry supply chain, in January of 2022, SEMI took the next step and launched their new SEMI E187 specifications for the cybersecurity of fab equipment standards. These standards were designed to neutralize supply chain attacks, insider threat, and other potential flash points in a cyber-attack. Through SEMI E187, it is possible to provide global semiconductor equipment manufacturers with a guideline for security by design at early stages. Secondly, enterprises can also clarify cybersecurity requirements when purchasing equipment to avoid the new asset becoming a security risk. Dr. Terence Liu, CEO of TXOne Networks and a member of the SEMI Taiwan Semiconductor Cybersecurity Committee, has said, "The establishment of this standard is like building a trust mechanism. Semiconductor manufacturers can trust that the equipment handed over by suppliers is safe."
TXOne’s specialists have collaborated with industry leaders to create a new approach to management based on applying OT zero trust to the asset life cycle. By zeroing out trust and implementing a policy of verification at every phase that could present a potential point of entry to a threat, cybersecurity specialists can streamline compliance with SEMI E187, address OT cybersecurity challenges, and secure fab equipment against cyber supply chain threats.
1. OT Zero trust for inbound devices:
This cybersecurity policy takes effect from the moment a device comes onto your premises. Newly-arrived assets being prepared for onboarding are pre-scanned (Trend Micro Portable Security 3 Pro™) to mitigate the risk of supply chain attack – in the past, cyber attackers have triggered cyber incidents by compromising devices prior to shipment. While the SBOM and systems like it will be a tremendous boon to OT cyber defenses, knowing what software you are using is only half the battle. TXOne Networks’ OT zero trust approach integrates software inventories with OT health checks or SBOMs (when available) to secure high-risk vulnerabilities in assets.
2. OT Zero trust for appliances:
Traditional antivirus software can bog down assets, leading to crashes or delays. Operations-friendly, “OT-native” lockdown software (StellarEnforce™) secures legacy endpoints with a trust list that only allows applications critical to operations. For modernized endpoints that carry out more varied or complex tasks, a library of trusted ICS applications and licenses informs next-generation antivirus software (StellarProtect™) as to which files and applications it can skip and give priority to, preserving resources for operations.
3. OT Zero trust for networks:
Attackers find your OT network much more challenging to attack when unnecessary “doors” in the network are sealed with specific rules for traffic put in place by firewall or IPS appliances (EdgeIPS™ EdgeFire™). With these special rules for traffic, which are based strictly on which assets need to communicate to do their work, the network is separated into segments that are easier to monitor and secure. For legacy and otherwise unpatchable assets, virtual patching shields vulnerabilities so that they cannot be exploited by attackers. Network appliances and policy are easily observed and maintained through a single, centralized console (OT Defense Console™).
TXOne Networks works with partners to provide a total solution with network endpoints, and a unified network security platform for OT visibility. Meanwhile, we also actively help enterprises to ensure comprehensive management, automation, continuous monitoring, and deep data correlation of the entire supply chain to limit the opportunity for adversaries to disrupt the supply chain.
Terence Liu, CEO of TXOne Networks,
SEMI Taiwan Semiconductor Cybersecurity Committee
Darren Chung, TXOne Networks Technical Marketing Team
Reference
[1] ENISA, “Threat Landscape for Supply Chain Attacks”, ENISA, July 29, 2021
[2] National Counterintelligence and Security Center, “Cyber Attacks on the Information Communications Technology Supply Chain – Defined”, NCSC, April 01, 2022
[3] Cadence Security Advisory, “Log4j Vulnerability Security Advisory”, Cadence, Accessed May 30, 2022
[4] Cristin Goodwin, Joram Borenstein, “Guarding against supply chain attacks—Part 2: Hardware risks”, Microsoft, February 3, 2020
[5] NJCCIC Alert, “APT28: First Group to Embed Rootkit in UEFI”, NJCCIC, October 02, 2018
[6] Jon Boyens (NIST), Angela Smith (NIST), Nadya Bartol (Boston Consulting Group), Kris Winkler (Boston Consulting Group), Alex Holbrook (Boston Consulting Group), Matthew Fallon (Boston Consulting Group), “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations”, NIST, May 5, 2022
[7] Cybersecurity and Infrastructure Security Agency, “Defending Against Software Supply Chain Attacks”, CISA, April 2021