IT Supply Chain Presents Numerous Information Security Risks to Federal Agencies

Reliance on a global supply chain introduces multiple risks to federal  information systems and underscores the importance of threat  assessments and risk mitigation. Supply chain threats are present at  various phases of a system’s development life cycle. Key threats that  could create an unacceptable risk to federal agencies include the  following:  installation of hardware or software containing malicious logic, which  is hardware, firmware, or software that is intentionally included or  inserted in a system for a harmful purpose;  installation of counterfeit hardware or software, which is hardware or  software containing non-genuine component parts or code;  failure or disruption in the production or distribution of critical products  resulting from manmade or natural causes;  reliance on a malicious or unqualified service provider for the  performance of technical services; and  installation of hardware or software that contains unintentional  vulnerabilities, such as defects in code that can be exploited. Such threats can have a range of impacts, including allowing attackers to  take control of systems and read, modify, or delete sensitive information;  decreasing the reliability of IT equipment; decreasing the availability of  material needed to develop systems; or allowing remote attackers to  cause a denial of service, among other things. Threat actors can introduce these threats into federal information systems  by exploiting vulnerabilities that could exist at multiple points in the global  supply chain. Examples of types of  vulnerabilities that could be exploited include acquisition of IT products or parts from sources other than the original  manufacturer or authorized reseller, such as independent distributors,  brokers, or on the gray market; applying untested updates and software patches to information acquiring equipment, software, or services from suppliers without  understanding their past performance or corporate structure; and using delivery or storage mechanisms that are not secure. If a threat actor exploits an existing vulnerability, it could lead to the loss  of the confidentiality, integrity, or availability of the system and associated  information. Three National Security-Related Agencies Have Not Fully Addressed IT Supply Chain Risk

Although the four agencies in our review—the Departments of Energy,  Homeland Security (DHS), Justice, and Defense—have acknowledged  the risks presented by supply chain vulnerabilities, they varied in the  extent to which they have addressed these risks by (1) defining supply  chain protection measures for department information systems, (2)  developing implementing procedures for these measures, and (3)  establishing capabilities for monitoring compliance with and the  effectiveness of such measures. Because it had  not defined these measures or associated implementing procedures,  the department was also not in a position to monitor compliance or  effectiveness. By contrast, the Department of Defense has made more progress. Specifically, the department’s supply chain risk management efforts  began in 2003 and include a policy requiring supply chain risk to be addressed early and across  a system’s entire life cycle and calling for an incremental  implementation of supply chain risk management through a series of  pilot projects; a requirement that every acquisition program submit and update a  “program protection plan” that is to, among other things, help manage  risks from supply chain exploits or design vulnerabilities; procedures for implementing supply chain protection measures, such  as an implementation guide describing 32 specific measures for  enhancing supply chain protection and procedures for program  protection plans identifying ways in which programs should manage  supply chain risk; and a monitoring mechanism to determine the status and effectiveness of  supply chain protection pilot projects, as well as monitoring  compliance with and effectiveness of program protection policies and  procedures for several acquisition programs. Three National Security-Related Departments Need to Take Action to Better Address IT Supply Chain Risks

To assist the three national security-related agencies in better addressing  IT supply chain-related security risks for their departmental information  systems, we made several recommendations to the Secretaries of Energy  and Homeland Security and the Attorney General. Justice concurred with the recommendations. Until these agencies develop  comprehensive policies, procedures, and monitoring capabilities,  increased risk exists that they will be vulnerable to IT supply chain  threats.
Why GAO Did This Study

Information technology (IT) systems and the products and services that support them are essential to the operations of the federal government. These products and services are delivered through a complex global supply chain, and the exploitation of vulnerabilities in the IT supply chain is an emerging threat. Federal law requires establishment of information security programs, and implementing standards and guidelines provide for managing supply chain risk.
GAO was asked to testify on its recently issued report that, among other things, identified key risks associated with the supply chains used by federal agencies to procure IT equipment, software, and services, and assessed the extent to which four national security-related agencies have addressed such risks. In producing that report, GAO analyzed federal acquisition and information security laws, regulations, standards, and guidelines; examined departmental policies and procedures; and interviewed officials from four national security-related departments, the intelligence community, and nonfederal entities.

What GAO Found

Reliance on a global supply chain introduces multiple risks to federal information systems and underscores the importance of threat assessments and mitigation. Supply chain threats are present at various phases of a systems development life cycle and could create an unacceptable risk to federal agencies. Key supply chain-related threats include
installation of intentionally harmful hardware or software (i.e., containing malicious logic);
installation of counterfeit hardware or software;
failure or disruption in the production or distribution of critical products;
reliance on malicious or unqualified service providers for the performance of technical services; and
installation of hardware or software containing unintentional vulnerabilities, such as defective code.
These threats can have a range of impacts, including allowing attackers to take control of systems or decreasing the availability of critical materials needed to develop systems. These threats can be introduced by exploiting vulnerabilities that could exist at multiple points in the supply chain. Examples of such vulnerabilities include acquisition of products or parts from unauthorized distributors; application of untested updates and software patches; acquisition of equipment, software, or services from suppliers without knowledge of their past performance or corporate structure; and use of insecure delivery or storage mechanisms. These vulnerabilities could by exploited by malicious actors, leading to the loss of the confidentiality, integrity, or availability of federal systems and the information they contain.
The four national security-related agencies in GAOs reviewthe Departments of Energy, Homeland Security, Justice, and Defensevaried in the extent to which they have addressed supply chain risks. Specifically, Energy and Homeland Security had not yet defined supply chain protection measures for department information systems and are not in a position to develop implementing procedures and monitoring capabilities. Justice has defined supply chain protection measures but has not developed implementation procedures or monitoring capabilities. Until these agencies develop comprehensive policies, procedures, and monitoring capabilities, increased risk exists that they will be vulnerable to IT supply chain threats. By contrast, the Department of Defense has made greater progress: it has defined supply chain protection measures and implementing procedures and initiated efforts to monitor compliance and effectiveness. In addition, various interagency efforts are under way to address supply chain risks affecting federal IT.

What GAO Recommends

In its report, GAO recommended that the Departments of Energy, Homeland Security, and Justice take steps, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. In commenting on a draft of the report, the departments generally concurred with the recommendations.