Information Security: Supply Chain Risks Affecting Federal Agencies

IT systems are essential to the operations of the federal government. The supply chain—the set of organizations, people, activities, and resources that create and move a product from suppliers to end users—for IT systems is complex and global in scope. The exploitation of vulnerabilities in the IT supply chain is a continuing threat. Federal security guidelines provide for managing the risks to the supply chain.

This testimony statement highlights information security risks associated with the supply chains used by federal agencies to procure IT systems. The statement also summarizes GAO's 2012 report that assessed the extent to which four national security-related agencies had addressed such risks. To develop this statement, GAO relied on its previous reports, as well as information provided by the national security-related agencies on their actions in response to GAO's previous recommendations. GAO also reviewed federal information security guidelines and directives.

Reliance on a global supply chain introduces multiple risks to federal information systems. Supply chain threats are present during the various phases of an information system's development life cycle and could create an unacceptable risk to federal agencies. Information technology (IT) supply chain-related threats are varied and can include:

installation of intentionally harmful hardware or software (i.e., containing “malicious logic”);

installation of counterfeit hardware or software;

failure or disruption in the production or distribution of critical products;

reliance on malicious or unqualified service providers for the performance of technical services; and

installation of hardware or software containing unintentional vulnerabilities, such as defective code.

These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials needed to develop systems. These threats can be introduced by exploiting vulnerabilities that could exist at multiple points in the supply chain. Examples of such vulnerabilities include the acquisition of products or parts from unauthorized distributors; inadequate testing of software updates and patches; and incomplete information on IT suppliers. Malicious actors could exploit these vulnerabilities, leading to the loss of the confidentiality, integrity, or availability of federal systems and the information they contain.

GAO reported in 2012 that the four national security-related agencies in its review—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks. Of the four agencies, Defense had made the most progress addressing the risks. It had defined and implemented supply chain protection controls, and initiated efforts to monitor the effectiveness of the controls. Conversely, Energy and DHS had not developed or documented policies and procedures that defined security measures for protecting against IT supply chain threats and had not developed capabilities for monitoring the implementation and effectiveness of the measures. Although Justice had defined supply chain protection measures, it also had not developed or documented procedures for implementing or monitoring the measures.

Energy and Justice fully implemented the recommendations that GAO made in its 2012 report and resolved the deficiencies that GAO had identified with their supply chain risk management efforts by 2016. DHS also fully implemented two recommendations to document policies and procedures for defining and implementing security measures to protect against supply chain threats by 2015, but could not demonstrate that it had fully implemented the recommendation to develop and implement a monitoring capability to assess the effectiveness of the security measures.

In its 2012 report, GAO recommended that Justice, Energy, and DHS take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. The departments generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation.

Thank you for the opportunity to testify at today’s hearing on keeping  adversaries away from the homeland security supply chain. As you know,  federal agencies and the owners and operators of our nation’s critical  infrastructure rely extensively on information technology (IT) and IT  services to carry out their operations. Securing this technology, its supply  chain, and the information it contains is essential to protecting national  and economic security.

Since 1997, we have identified federal information security as a  governmentwide high-risk area. In 2003, we expanded this high-risk area  to include protecting systems supporting our nation’s critical  infrastructure.

My statement provides an overview of the information security risks  associated with the supply chains used by federal agencies to procure IT  equipment, software, or services. The statement also discusses our  2012 assessment of the extent to which four national security-related  agencies—the Departments of Defense, Justice, Energy, and Homeland  Security (DHS)—had addressed these risks.

In developing this testimony, we relied on our previous reports, as well  as information provided by the national security-related agencies on their  actions in response to our previous recommendations. We also  considered information contained in special publications issued by the  National Institute of Standards and Technology (NIST) and a directive  issued by DHS. A more detailed discussion of the objectives, scope, and  methodology for this work is included in each of the reports that are cited  throughout this statement.

The work on which this statement is based was conducted in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions.  We believe that the evidence obtained provided a reasonable basis for  our findings and conclusions based on our audit objectives.

The design and development of information systems can be complex  undertakings, consisting of a multitude of pieces of equipment and  software products, and service providers. Each of the components of an  information system may rely on one or more supply chains—that is, the  set of organizations, people, activities, information, and resources that  create and move a product or service from suppliers to an organization’s  customers.

Obtaining a full understanding of the sources of a given information  system can also be extremely complex. According to the Software  Engineering Institute, the identity of each product or service provider may  not be visible to others in the supply chain. Typically, an acquirer, such as  a federal agency, may only know about the participants to which it is  directly connected in the supply chain. Further, the complexity of  corporate structures, in which a parent company (or its subsidiaries) may  own or control companies that conduct business under different names in  multiple countries, presents additional challenges to fully understanding  the sources of an information system. As a result, the acquirer may have  little visibility into the supply chains of its suppliers.

Federal procurement law and policies promote the acquisition of  commercial products when they meet the government’s needs.  Commercial providers of IT use a global supply chain to design, develop,  manufacture, and distribute hardware and software products throughout  the world. Consequently, the federal government relies heavily on IT  equipment manufactured in foreign nations.

Federal information and communications systems can include a multitude  of IT equipment, products, and services, each of which may rely on one  or more supply chains. These supply chains can be long, complex, and  globally distributed and can consist of multiple tiers of outsourcing. As a  result, agencies may have little visibility into, understanding of, or control  over how the technology that they acquire is developed, integrated, and  deployed, as well as the processes, procedures, and practices used to  ensure the integrity, security, resilience, and quality of the products and  services. Table 1 highlights possible manufacturing locations of typical  components of a computer or information systems network.

Moreover, many of the manufacturing inputs required for these  components—whether physical materials or knowledge—are acquired  from various sources around the globe. Figure 1 depicts the potential  countries of origin of common suppliers of various components in a  commercially available laptop computer.

Federal Laws and Guidelines Require the Establishment of Information Security Programs and Provide for Managing Supply Chain Risk

The Federal Information Security Modernization Act (FISMA) of 2014  requires federal agencies to develop, document, and implement an  agency-wide information security program to provide information security  for the information systems and information that support the operations  and assets of the agency. The act also requires that agencies ensure  that information security is addressed throughout the life cycle of each  agency information system. FISMA assigns NIST the responsibility for  providing standards and guidelines on information security to agencies. In  addition, the act authorizes DHS to develop and issue binding operational  directives to agencies, including directives that specify requirements for  the mitigation of exigent risks to information systems.

NIST has issued several special publications (SP) that provide guidelines  to federal agencies on controls and activities relevant to managing supply  chain risk. For example,

NIST SP 800-39 provides an approach to organization-wide  management of information security risk, which states that  organizations should monitor risk on an ongoing basis as part of a  comprehensive risk management program.

NIST SP 800-53 (Revision 4) provides a catalogue of controls from  which agencies are to select controls for their information systems. It  also specifies several control activities that organizations could use to  provide additional supply chain protections, such as conducting due  diligence reviews of suppliers and developing acquisition policy, and  implementing procedures that help protect against supply chain  threats throughout the system development life cycle.

NIST SP 800-161 provides guidance to federal agencies on  identifying, assessing, selecting, and implementing risk management  processes and mitigating controls throughout their organizations to  help manage information and communications technology supply  chain risks.

In addition, as of June 2018, DHS has issued one binding operational  directive related to an IT supply chain-related threat. Specifically, in  September 2017, DHS issued a directive to all federal executive branch  departments and agencies to remove and discontinue present and future  use of Kaspersky-branded products on all federal information systems.  In consultation with interagency partners, DHS determined that the risks  presented by these products justified their removal.

Beyond these guidelines and requirements, the Ike Skelton National  Defense Authorization Act for Fiscal Year 2011 also included provisions  related to supply chain security. Specifically, Section 806 authorizes the  Secretaries of Defense, the Army, the Navy, and the Air Force to exclude  a contractor from specific types of procurements on the basis of a  determination of significant supply chain risk to a covered system.  Section 806 also establishes requirements for limiting disclosure of the  basis of such procurement action.

IT Supply Chains Introduce Numerous Information Security Risks to Federal Agencies

In several reports issued since 2012, we have pointed out that the  reliance on complex, global IT supply chains introduces multiple risks to  federal information and telecommunications systems. This includes the  risk of these systems being manipulated or damaged by leading foreign  cyber-threat nations such as Russia, China, Iran, and North Korea.  Threats and vulnerabilities created by these cyber-threat nations, vendors  or suppliers closely linked to cyber-threat nations, and other malicious  actors can be sophisticated and difficult to detect and, thus, pose a  significant risk to organizations and federal agencies.

As we reported in March 2012, supply chain threats are present at  various phases of a system’s development life cycle. Key threats that  could create an unacceptable risk to federal agencies include the  following.

Installation of hardware or software containing malicious logic, which is hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose. Malicious logic can cause significant damage by allowing attackers to take control of entire systems and, thereby, read, modify, or delete sensitive information; disrupt operations; launch attacks against other  organizations’ systems; or destroy systems.

Installation of counterfeit hardware or software, which is hardware  or software containing non-genuine component parts or code.  According to the Defense Department’s Information Assurance  Technology Analysis Center, counterfeit IT threatens the integrity,  trustworthiness, and reliability of information systems for several  reasons, including the facts that (1) counterfeits are usually less  reliable and, therefore, may fail more often and more quickly than  genuine parts; and (2) counterfeiting presents an opportunity for the  counterfeiter to insert malicious logic or backdoors into replicas or  copies that would be far more difficult in more secure manufacturing  facilities.

Failure or disruption in the production or distribution of critical  products. Both man-made (e.g., disruptions caused by labor, trade,  or political disputes) and natural (e.g., earthquakes, fires, floods, or  hurricanes) causes could decrease the availability of material needed  to develop systems or disrupt the supply of IT products critical to the  operations of federal agencies.

Reliance on a malicious or unqualified service provider for the  performance of technical services. By virtue of their position,  contractors and other service providers may have access to federal  data and systems. Service providers could attempt to use their access  to obtain sensitive information, commit fraud, disrupt operations, or  launch attacks against other computer systems and networks.

Installation of hardware or software that contains unintentional  vulnerabilities, such as defects in code that can be exploited. Cyber  attackers may focus their efforts on, among other things, finding and  exploiting existing defects in software code. Such defects are usually  the result of unintentional coding errors or misconfigurations, and can  facilitate attempts by attackers to gain unauthorized access to an  agency’s information systems and data, or disrupt service.

We noted in the March 2012 report that threat actors can introduce  these threats into federal information systems by exploiting vulnerabilities  that could exist at multiple points in the global supply chain. In addition,  supply chain vulnerabilities can include weaknesses in agency acquisition  or security procedures, controls, or implementation related to an  information system. Examples of the types of vulnerabilities that could be  exploited include acquisitions of IT products or parts from sources other than the  original manufacturer or authorized reseller, such as independent  distributors, brokers, or on the gray market;  lack of adequate testing for software updates and patches; and  incomplete information on IT suppliers.

If a threat actor exploits an existing vulnerability, it could lead to the loss  of the confidentiality, integrity, or availability of the system and associated  information. This, in turn, can adversely affect an agency’s ability to carry  out its mission.

Four National Security-Related Agencies Have Acted to Better Address IT Supply Chain Risks for Their Information Systems

In March 2012, we reported that the four national security-related  agencies (i.e., Defense, Justice, Energy, and DHS) had acknowledged  the risks presented by supply chain vulnerabilities. However, the  agencies varied in the extent to which they had addressed these risks by  (1) defining supply chain protection measures for department information  systems, (2) developing implementing procedures for these measures,  and (3) establishing capabilities for monitoring compliance with, and the  effectiveness of, such measures.

Of the four agencies, the Department of Defense had made the most  progress addressing the risks. Specifically, the department’s supply chain  risk management efforts began in 2003 and included: a policy requiring supply chain risk to be addressed early and across  a system’s entire life cycle and calling for an incremental  implementation of supply chain risk management through a series of  pilot projects; a requirement that every acquisition program submit and update a  “program protection plan” that was to, among other things, help  manage risks from supply chain exploits or design vulnerabilities; procedures for implementing supply chain protection measures, such  as an implementation guide describing 32 specific measures for  enhancing supply chain protection and procedures for program  protection plans identifying ways in which programs should manage  supply chain risk; and a monitoring mechanism to determine the status and effectiveness of  supply chain protection pilot projects, as well as monitoring  compliance with and effectiveness of program protection policies and  procedures for several acquisition programs.

Conversely, our report noted that the other three agencies had made  limited progress in addressing supply chain risks for their information  systems. For example:

The Department of Justice had defined specific security measures for  protecting against supply chain threats through the use of provisions  in vendor contracts and agreements. Officials identified (1) a  citizenship and residency requirement and (2) a national security risk  questionnaire as two provisions that addressed supply chain risk.  However, Justice had not developed procedures for ensuring the  effective implementation of these protection measures or a  mechanism for verifying compliance with, and the effectiveness of  these measures. We stressed that, without such procedures, Justice  would have limited assurance that its departmental information  systems were being adequately protected against supply chain  threats.

In May 2011, the Department of Energy revised its information  security program, which required Energy components to implement  provisions based on NIST and Committee on National Security  Systems guidance. However, the department was unable to provide  details on implementation progress, milestones for completion, or how  supply chain protection measures would be defined. Because it had  not defined these measures or associated implementing procedures,  we reported that the department was not in a position to monitor  compliance or effectiveness.

Although its information security guidance mentioned the NIST control  related to supply chain protection, DHS had not defined the supply  chain protection control activities that system owners should employ.  The department’s information security policy manager stated that  DHS was in the process of developing policy that would address  supply chain protection, but did not provide details on when it would  be completed. In the absence of such a policy, DHS was not in a  position to develop implementation procedures or to monitor  compliance or effectiveness.

To assist Justice, Energy, and DHS in better addressing IT supply chain- related security risks for their departmental information systems, we made  eight recommendations to these three agencies in our 2012 report.  Specifically, we recommended that Energy and DHS: develop and document departmental policy that defines which security  measures should be employed to protect against supply chain threats.

We also recommended that Justice, Energy, and DHS: develop, document, and disseminate procedures to implement the  supply chain protection security measures defined in departmental  policy, and develop and implement a monitoring capability to verify compliance  with, and assess the effectiveness of, supply chain protection  measures.

The three agencies generally agreed with our recommendations and,  subsequently, implemented seven of the eight recommendations.  Specifically, we verified that Justice and Energy had implemented each of  the recommendations we made to them by 2016. We also confirmed that  DHS had implemented two of the three recommendations we made to  that agency by 2015.

However, as of fiscal year 2016, DHS had not fully implemented our  recommendation to develop and implement a monitoring capability to  verify compliance with, and assess the effectiveness of, supply chain  protections. Although the department had developed a policy and  approach for monitoring supply chain risk management activities, it could  not provide evidence that its components had actually implemented the  policy. Thus, we were not able to close the recommendation as implemented. Nevertheless, the implementation of the seven  recommendations and partial implementation of the eighth  recommendation better positioned the three agencies to monitor and  mitigate their IT supply chain risks.

In addition, we reported in March 2012 that the four national security- related agencies had participated in interagency efforts to address supply  chain security, including participation in the Comprehensive National  Cybersecurity Initiative, development of technical and policy tools, and  collaboration with the intelligence community. In support of the  cybersecurity initiative, Defense and DHS jointly led an interagency  initiative on supply chain risk management to address issues of  globalization affecting the federal government’s IT. Also, DHS had  developed a comprehensive portfolio of technical and policy-based  product offerings for federal civilian departments and agencies, including  technical assessment capabilities, acquisition support, and incident  response capabilities. The efforts of the four agencies could benefit all  federal agencies in addressing their IT supply chain risks.

In summary, the global IT supply chain introduces a myriad of security  risks to federal information systems that, if realized, could jeopardize the  confidentiality, integrity, and availability of federal information systems.  Thus, the potential exists for serious adverse impact on an agency’s  operations, assets, and employees. These factors highlight the  importance and urgency of federal agencies appropriately assessing,  managing, and monitoring IT supply chain risk as part of their agencywide  information security programs.

Chairmen King and Perry, Ranking Members Rice and Correa, and  Members of the Subcommittees, this completes my prepared statement. I  would be pleased to answer your questions.

If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other  key contributors to this statement include Jeffrey Knott (assistant  director), Christopher Businsky, Nancy Glover, and Rosanna Guerrero.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.