IT Supply Chain: National Security-Related Agencies Need to Better Address Risks
Released: 2012-03-23T00:00:00

Letter

Background

Information systems can be complex undertakings consisting of a multitude of pieces of equipment, software products, and service providers. Each of these components may rely on one or more supply chains. Obtaining a full understanding of the sources of a given information system during initiation and development can also be extremely complex. According to the Software Engineering Institute (SEI), the identity of each product or service provider may not be visible to others in the supply chain. Typically, an acquirer (such as a federal agency) will only know about the participants directly connected to it in the supply chain. As a result, an acquirer will have little visibility into the supply chains of its suppliers.

For example, a program office at a federal agency may rely on a prime contractor to acquire, develop, and maintain an information system. In turn, the prime contractor may obtain the equipment, software, and services that constitute the system through various means, including the reuse of existing equipment or legacy software; outsourcing of system development to an additional supplier; development of the capability in-house; or acquisition of the capability directly from a supplier or commercial off- the-shelf-vendor, or through open-source means.

In addition, the complexity of corporate structures, in which a parent company (or its subsidiaries) may own or control IT companies that conduct business under different names in multiple countries, presents additional challenges to obtaining a full understanding of the source of an information system. According to NIST, today’s complex global economy and manufacturing practices make corporate ownership and control more ambiguous when assessing supply chain vulnerabilities. For example, foreign-based companies sometimes manufacture and assemble products and components in the United States, and U.S.-based companies sometimes manufacture products and components overseas, or domestically employ foreign workers.

Commercial providers of IT use a global supply chain to design, develop, manufacture, and distribute hardware and software products throughout the world. Many of the manufacturing inputs required for those products— whether physical materials or knowledge—are acquired from various sources around the globe. Figure 1 depicts the potential countries of origin of the common suppliers for various components within a commercially available computer.

Federal procurement law and policies promote the acquisition of commercial products when they meet the government’s needs. For example, provisions of the Federal Acquisition Streamlining Act of 1994 are designed to encourage the government to buy commercial items by (1) requiring a preference for commercial items where feasible, and (2) making exceptions to certain government requirements that previously discouraged commercial vendors from offering their products and services to the government. In addition, Office of Management and Budget (OMB) Circular A-130 requires that agencies select investments in information technology (such as computers, software, firmware, and support services) that, among other things, make maximum use of commercial, off-the-shelf technology. OMB Circular A-130 also requires that agencies acquire off-the-shelf software from commercial sources unless developing custom software has been documented as more cost- effective.

The Comprehensive National Cybersecurity Initiative Recognizes Supply Chain Risk to Federal IT

In 2008, the Bush administration began to implement a series of initiatives, referred to as the Comprehensive National Cybersecurity Initiative (CNCI), aimed primarily at improving cybersecurity within the federal government. Specifically, CNCI is composed of a set of 12 initiatives with the objective of safeguarding federal executive branch information systems by reducing potential vulnerabilities; protecting against intrusion attempts; and anticipating future threats through defensive, offensive, educational, research and development, and counterintelligence efforts.

One of the CNCI initiatives focused on developing a multipronged approach for addressing global supply chain risk management. Specifically, the initiative stated that risks stemming from both the domestic and global supply chains must be managed in a strategic and comprehensive way over the entire life cycle of products, systems, and services. It further states that managing this risk will require a greater awareness of the threats, vulnerabilities, and consequences associated with acquisition decisions; the development and employment of tools and resources to technically and operationally mitigate risk across the life cycle of products (from design through retirement); the development of new acquisition policies and practices that reflect the complex global marketplace; and partnership with industry to develop and adopt supply chain risk management standards and best practices.

In March 2010, we reported on the actions that had been taken to develop interagency mechanisms to plan and coordinate CNCI activities and the challenges the CNCI faced in achieving its objectives related to securing federal information systems. We determined that the White House and federal agencies had taken steps to plan and coordinate CNCI activities by establishing several interagency work groups. We also determined that the CNCI faced several challenges in meeting its objectives, including defining roles and responsibilities, establishing measures of effectiveness, and establishing an appropriate level of transparency (including for supply chain risk management activities). We made six recommendations to OMB to address the identified challenges. OMB concurred with five of our six recommendations and has since taken steps to address most of these challenges, including clarifying cybersecurity responsibilities and activities among federal entities.

Federal Law Requires Agencies to Establish Information Security Programs, and Implementing Standards and Guidelines Provide for Management of Supply Chain-Related Risk

The Federal Information Security Management Act of 2002 (FISMA) establishes federal agency information security program requirements that support the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program. FISMA requires every federal agency to establish an information security program. Additionally, the act assigns responsibility to NIST to provide standards and guidelines to agencies on information security.

FISMA directed NIST to promulgate federal standards for (1) the security categorization of federal information and information systems based on the objective of providing appropriate levels of information security according to a range of risk levels, and (2) minimum security requirements for information and information systems in each such category. NIST subsequently issued two Federal Information Processing Standards (FIPS):

FIPS 199 is to be used to categorize information and information systems, thereby providing a common framework for expressing security. Under this standard, a system is categorized (high, moderate, or lowa loss of confidentiality, integrity, or availability. ) based on the type of impact that would result from

FIPS 200 addresses the specification of minimum security In requirements for federal information and information systems. particular, FIPS 200 directs federal agencies to meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53 (SP 800-53).

NIST, FIPS Publication 200: Minimum Security Requirements for Federal Information and Information Systems (Gaithersburg, Md.: March 2006).

NIST identified several specific measures that organizations could use to provide additional supply chain protections. These include, but are not limited to, conducting a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware, software, firmware, or services; using trusted shipping and warehousing for information systems, information system components, and information technology products; and employing independent analysis and penetration testing against delivered information systems, information system components, and information technology products.

SP 800-53, Revision 3, also includes a security control for system and Thus, for systems services acquisition policy and procedures (SA-1). where both controls are selected, agencies should develop, disseminate, and review acquisition policy and implementing procedures that help protect against supply chain threats throughout the system development life cycle.

Other policy requires SP 800-53 controls to be selected for both non- national security and national security systems. Specifically, OMB Circular A-130 states that federal agencies are required to use SP 800-53 in selecting and specifying controls for non-national security programs. Also, in October 2009, the Committee on National Security Systems published Instruction 1253, which establishes SP 800-53 as a common foundation for information security controls for national security systems. Under this instruction, all national security systems are directed to select SA-1 as part of their initial control baselines. Further, all national security systems that are categorized as high or moderate impact for integrity are directed to select SA-12 as part of their initial control baselines.

In March 2011, NIST published SP 800-39, which provides an approach for organizationwide management of information security risk, including those related to supply chains. Among other things, the publication states that risk management requires organizations to monitor risk on an ongoing basis as part of a comprehensive risk management program. Monitoring programs can aid agency officials in oversight of currently implemented security controls. To support risk monitoring, organizations are expected to describe how compliance with security requirements is verified and how the organization will determine the effectiveness of risk response activities.

In addition, the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 included provisions related to supply chain security. Specifically, Section 806 authorizes the Secretaries of Defense, the Army, the Navy, and the Air Force to exclude a contractor from specified types of procurements on the basis of a determination of significant supply chain risk to a covered system. Section 806 also establishes requirements for limiting disclosure of the basis of such procurement action.

In June 2010, NIST released a draft interagency report, Piloting Supply Chain Risk Management Practices for Federal Information Systems, which, when finalized and published, is intended to provide agencies with supply chain risk mitigation strategies integrated with the information systems development life cycle. Its methodology for handling supply chain risk included, among other things, determining which procurements should consider supply chain risk, working with agency stakeholders to help mitigate supply chain risk, and describing roles and responsibilities within the agency. NIST plans to release the final version of the report by the end of fiscal year 2012.

In February 2012, NIST released for comment the initial public draft of SP 800-53, Revision 4, which, when finalized and published, is intended to provide, among other things, additional supply chain-related guidance and protection measures. The draft revised SA-12 guidance and incorporated supply chain considerations into, among other things, security measures related to incident handling and reporting. NIST anticipates the publication of the final document in July 2012.

IT Supply Chain Presents Numerous Information Security Risks to Federal Agencies

Reliance on a global supply chain introduces multiple risks to federal information systems and underscores the importance of threat assessments and risk mitigation. These risks include threats posed by actors—such as foreign intelligence services or counterfeiters—who may exploit vulnerabilities in the supply chain, thus compromising the confidentiality, integrity, or availability of the end-system and the information it contains. This in turn can adversely affect an agency’s ability to carry out its mission.

The IT Supply Chain Faces Threats

Supply chain-related threats are present at various phases of the system development life cycle. Each of the key threats presented in table 1 could create an unacceptable risk to federal agencies.

Threat actors can use the supply chain to insert hardware or software containing malicious logic through tampering during the development and implementation of an information system. Malicious logic is hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose. For example, viruses and Trojan horses are two forms of malicious logic that could be included in a system via the supply chain. A virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user. A Trojan horse is a computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program.

Malicious logic can cause significant damage by allowing attackers to take control of entire systems and thereby read, modify, or delete sensitive information; disrupt operations; launch attacks against other organizations’ systems; or destroy systems. For example, it was reported in 2008 that hardware similar to flash memory drives that was released by a major U.S. electronics manufacturer contained malicious code that could allow an attacker to take over an infected system. Additionally, recent information reported by DHS indicates that malicious code attacks are prevalent in the federal environment. Specifically, according to the United States Computer Emergency Readiness Team (US-CERT), approximately 27 percent of the 42,854 agency-reported security incidents during fiscal year 2011 involved malicious code. Although not necessarily the result of an IT supply chain attack, these incidents highlight the impact that such attacks could have on agency operations.

Counterfeit information technology is hardware or software that contains nongenuine component parts or code. A component is not genuine if it (1) is an unauthorized copy; (2) does not conform to the design, model, or performance standards as prescribed by the original component manufacturer; (3) is not produced by the original component manufacturer or is produced by an unauthorized contractor; (4) is an off-specification, defective, or used original component manufacturer product sold as “new” or working; or (5) has incorrect or false markings or documentation.

The Defense Department’s Information Assurance Technology Analysis Center has reported that counterfeit information technology threatens the integrity, trustworthiness, and reliability of information systems for several reasons, including the facts that (1) counterfeits are usually less reliable and therefore fail more often and more quickly than genuine parts, and (2) counterfeiting presents an opportunity for the counterfeiter to insert malicious logic or backdoors into the replicas or copies that would be far more difficult in more secure manufacturing facilities. Federal agencies have unintentionally purchased counterfeit IT products. For example, according to a Cisco report about the counterfeiting of its products, one case involved the illegal modification of routers with fake seals and Cisco tape to appear as if they contained security protections of a model valued at twice as much as a standard version. These routers were then purchased by a reseller and sold to the federal government through an official government solicitation for purchase. Additionally, according to the United States Attorney’s Office for the Southern District of Texas, the Marine Corps, Air Force, Federal Aviation Administration, and Federal Bureau of Investigation (FBI) allegedly purchased counterfeit Cisco products that had originated in China. As a result, these agencies were at increased risk of installing products that were less reliable or secure than authentic IT equipment.

Failure or disruption in the production or distribution of a critical product could affect the availability of information technology equipment that is used to support federal information systems. Both man-made (e.g., disruptions caused by labor or political disputes) and natural causes (e.g., earthquakes, fires, floods, or hurricanes) could disrupt the supply of IT products critical to the operations of federal agencies. For example, following a severe Japanese earthquake in March 2011, it was reported that damage to Japan’s semiconductor industry could affect the availability of computer memory on the global market, because approximately 40 percent of certain types of computer memory is In addition, according to the U.S.-China manufactured in Japan. Economic and Security Commission, rare earth elements are a collection of 17 elements that are critical to commercial and military high-technology applications. These elements are distributed globally, with China reportedly producing approximately 97 percent of the current world supply. As a result, a disruption in the supply chain for rare earth elements could reduce the availability of material necessary for the U.S. government to develop systems.

Contractors and other service providers may, by virtue of their position, have access to federal data and systems. As we have previously reported, service providers could attempt to use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. We have also reported that the FBI has identified multiple sources of threats, such as foreign entities engaged in intelligence gathering and information warfare, criminals, and disgruntled employees or contractors working within an organization. As an example of this type of threat, according to a United States Attorney’s Office press release, a contract programmer was charged with stealing software code from the Federal Reserve Bank of New York. Further, an FBI official alleged that this individual took advantage of the access associated with his position in order to steal highly sensitive source code.

Unintentional vulnerabilities are hardware, software, or firmware that are included or inserted in a system and that inadvertently present opportunities for compromise. It has been reported that attackers focus their efforts on, among other things, finding and exploiting existing defects—such as buffer overflows—in the code, which are usually the result of unintentional coding errors. For example, DHS recently released an alert that identified vulnerabilities in certain firmware used by industrial control systems. The vulnerabilities identified could allow remote attackers to, among other things, cause a denial of service.

Vulnerabilities in Acquisition or Information Security Controls Are Exploitable

The threats described above can pose risk to federal information systems. Specifically, threat actors can introduce the above-mentioned threats by exploiting vulnerabilities that could exist at multiple points in the global supply chain. In addition, supply chain vulnerabilities can include weaknesses in agency acquisition or information security procedures, controls, or implementation related to a federal information system. If a threat actor exploits an existing vulnerability, it could lead to the loss of confidentiality, integrity, or availability of the end-system and associated information. Table 2 describes examples of the types of vulnerabilities that could be exploited.

Three National Security-Related Agencies Have Not Fully Addressed IT Supply Chain Risk

Although the four agencies in our review have acknowledged the risks presented by supply chain vulnerabilities, two of the agencies—Energy and DHS—have not yet defined supply chain protection measures for department information systems and are not in a position to have implementing procedures or monitoring capabilities to verify compliance with and effectiveness of any such measures. Justice has identified supply chain protection measures, but has not developed procedures for implementing or monitoring compliance with and the effectiveness of these measures. In contrast, Defense has made greater progress through its incremental approach to supply chain risk management. Specifically, it has defined supply chain protection measures and implementing procedures, and plans to develop outcome-based performance measures as the agency’s supply chain risk management capabilities mature.

According to the NIST SP 800-53 control for supply chain protection, agencies should define which security measures, if any, should be employed to protect against supply chain threats. In addition, the NIST SP 800-53 control for system and service acquisition calls for agencies to develop, document, and disseminate procedures to ensure the effective implementation of these measures. These procedures can be developed for the agency’s security program in general, or for a particular information system when required. Finally, according to NIST SP 800-39, agencies should also implement monitoring mechanisms to verify compliance with, and determine the effectiveness of, established security controls and associated supply chain protection measures.

Energy Lacks IT Supply Chain Measures, Documented Procedures, and Monitoring Capabilities

Energy has not defined security measures that information system owners should employ to protect against supply chain threats. In May 2011, the department revised its information security program, which sets forth requirements and responsibilities to protect departmental information and information systems. The program document requires Energy components to implement its provisions based on requirements and guidance defined by NIST and the Committee on National Security Systems, which includes the IT supply chain protection control. According to Energy’s chief information security officer (CISO), the department is in the process of implementing the program, and a large percentage of the department will be covered by the end of fiscal year 2012. However, the department was unable to provide details on implementation progress, milestones for completion, or how supply chain protection measures would be defined.

Additionally, without defined supply chain security measures, Energy is not in a position to develop, document, and disseminate procedures to ensure the effective implementation of supply chain protection. The development of implementation procedures relies on the department defining its supply chain security measures.

Further, Energy is not in a position to implement a monitoring capability to verify compliance with, and determine the effectiveness of, any such protections. The department’s information security program does describe high-level efforts to monitor risks to Energy information systems. However, it does not specify any monitoring or compliance efforts related to IT supply chain measures because Energy has not yet defined what supply chain measures will be employed by system owners.

Until Energy ensures that IT supply chain protection measures and implementing procedures are developed, documented, and disseminated, officials will be without essential guidance that facilitates the effective and consistent implementation of supply chain protection on departmental information systems. Further, senior Energy leadership will not have an effective monitoring capability to provide them with the information necessary to make informed decisions on supply chain protection activities. Implementing a monitoring capability for any supply chain security measures can help ensure that measures are adequate in the face of changes in threats, departmental operations, or level of compliance.

DHS Lacks IT Supply Chain Measures, Documented Procedures, and Monitoring Capabilities

Although its information security guidance mentions the SP 800-53 control related to supply chain protection, DHS has not defined the measures that system owners should employ. Under DHS’s information security program, the department’s CISO is responsible for issuing departmentwide information security policy that incorporates NIST guidelines and applicable OMB memorandums and circulars for all DHS systems and networks. The department’s information security policy manager stated that DHS had not addressed IT supply chain security through its policy. The official stated that DHS is currently in the process of developing such policy, but provided no details on when it would be completed.

Additionally, in the absence of defined supply chain security measures, DHS is not in a position to develop, document, or disseminate procedures to ensure the effective implementation of supply chain protection. DHS issued a handbook to provide specific techniques and procedures for implementing the department’s information security policy; however, it does not include any supply chain-related implementation guidance. This is due to the fact that the department has not yet defined what supply chain measures will be employed by system owners.

The department also is not in a position to implement a monitoring mechanism to assess the compliance with and effectiveness of IT supply chain security measures. DHS’s information security policy does describe high-level monitoring for compliance and effectiveness of its information security program, including its components performing assessments against the controls identified in NIST SP 800-53. However, the policy does not specify any monitoring or compliance efforts related to IT supply chain measures, because the department has not yet defined what supply chain measures will be employed by system owners.

Until DHS updates its information security policy to ensure that IT supply chain protection measures and implementing procedures are developed and documented, officials will be without essential guidance that is required to effectively implement supply chain protection on departmental information systems. Further, senior DHS leadership will not have an effective monitoring capability that provides the information that is necessary to make informed decisions on supply chain protection activities. Implementing a monitoring capability for any supply chain security measures can help ensure that measures are adequate in the face of changes in threats, departmental operations, or level of compliance.

Justice Has Defined Supply Chain Measures, but Lacks Documented Procedures and Monitoring Capabilities

Justice has defined specific security measures that information system owners should employ to protect against supply chain threats. The department’s minimum security control requirements specify that supply chain protection for high-impact systems is to be provided through the use of vendor acquisition contracts and agreements. In particular, Justice officials identified two generic contract provisions that could be used to address supply chain threats: (1) a citizenship and residency requirement and (2) a national security risk questionnaire (including a Foreign Ownership Control and Influence review).

However, Justice has not developed, documented, and disseminated procedures to ensure the effective implementation of these supply chain protection measures. Specifically, Justice officials were not able to identify which acquisitions would need to have the provisions inserted. Although the Justice CISO stated that the agency would require a national security risk questionnaire based on a national security and departmental mission impact determination, Justice officials could not identify documented criteria that would help security officers and other officials make this determination.

Further, Justice has not implemented a monitoring mechanism to verify compliance with, and determine the effectiveness of, its supply chain security measures. Justice’s CISO stated that the department did not have a system to track the use and effectiveness of the contract provisions across all components. As a result, departmental officials were not able to identify the frequency with which the provisions had been inserted into contracts for IT equipment, software, or services. In addition, Justice officials stated that the results of the Foreign Ownership Control and Influence reviews conducted under the provisions were generally kept with the program offices and acquisitions officials. Justice’s CISO stated that one reason for not monitoring is that the department is waiting for CNCI initiative 11 and the Committee on National Security Systems to produce guidance related to monitoring supply chain risk.

Until the department develops, documents, and disseminates procedures to implement its policy on IT supply chain protection, and implements a process to monitor that policy, Justice officials have limited assurance that departmental information systems are being adequately protected against supply chain threats.

Defense Has Issued, and Monitors Compliance with, Supply Chain Measures and Implementation Procedures

Defense’s supply chain risk management efforts began in 2003 and include multiple policies that specify measures to be employed for supply chain protection. For example, in February 2009, the department issued policy that requires that supply chain risk be addressed early and across the entire system life cycle. This policy applies to those systems that handle information that the agency determines is critical—in terms of both content and timeliness—to the readiness or effectiveness of the armed forces. The policy calls for the incremental implementation of supply chain risk management through a series of pilot projects. According to the policy, the target date for achieving full operational capability for supply chain risk management is fiscal year 2016. An official from Trusted Mission Systems and Networks, an office within the Defense Office of the Chief Information Officer, stated that lessons learned from the pilots should aid in the implementation of supply chain protection throughout the system development life cycle in a manner that enables systems to meet departmental cost, schedule, and performance requirements.

In addition, the 2009 policy states that the supply chain pilots shall include, among other things, processes to assess threats from potential suppliers providing critical components to applicable systems; processes to detect the occurrence, reduce the likelihood of occurrence, and mitigate the consequences of products containing counterfeit components or malicious functions; and enhanced developmental and operational test and evaluation capabilities, including software vulnerability detection methods and automated tools.

In addition, a July 2011 memorandum, which was issued by the Principal Deputy Under Secretary of Defense for Acquisition, Technology, and Logistics, requires every acquisition program to submit and update a “program protection plan” at each milestone of Defense’s system acquisition process. Among other things, program protection is intended to be the integrating process for managing risks to advanced technology and mission-critical system functionality from supply chain exploits or design vulnerabilities throughout the acquisition life cycle.

Defense has developed, documented, and disseminated procedures to facilitate the effective incremental implementation of supply chain protection measures. In February 2010, the department released a supply chain risk management Key Practices and Implementation Guide, which describes 32 specific measures that an organization could take to enhance supply chain protection. Examples of these measures include maximizing visibility into suppliers; choosing programming languages, subsets, and tools that counter weaknesses; and reducing supply chain risks during software updates and patch management.

Defense has also developed, documented, and disseminated procedures related to program protection plans. According to these procedures, program protection plans should guide a program office’s security measures, and should be updated as threats and vulnerabilities change or are better understood. The procedures identify at least four ways in which Defense programs should manage supply chain risk. Specifically, the procedures recommend that program officials identify critical program information, critical functions, and components; document how supply chain threat assessments will be used to influence system design, development environment, and procurement practices; assess the need for trusted suppliers for integrated circuits; and identify specific counterfeit protection measures.

Defense has also implemented a monitoring mechanism to determine the status and effectiveness of its supply chain protection pilots. Trusted Mission Systems and Networks is responsible for collecting supply chain risk management data and metrics on pilot efforts and reporting the results of the pilots conducted between 2009 and 2010. For example, this office issued a limited release report, dated April 2011, that described the findings and lessons learned related to supply chain protection. According to the report, this information was based on data collected from the 2010 supply chain pilots conducted in fiscal years 2009 and 2010. An official within Trusted Mission Systems and Networks stated that the office has continued to provide quarterly reports on the status and lessons learned from ongoing pilot activities.

In addition, Defense has monitored compliance with, and the effectiveness of, program protection policy and procedures for several acquisition programs. According to the Deputy Director for Program Protection, Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, the office has conducted six milestone reviews since July 2011. We observed evidence that, for four of the milestone reviews, appropriate Defense officials had verified whether or not the acquisition program had complied with the July 2011 memo and procedures related to program protection planning. For example, the documentation associated with one review conditioned approval on program officials completing an analysis to identify critical components and information within 180 days of the milestone review decision. Regarding the two remaining programs, Defense Systems Engineering officials documented deficiencies in the program protection plan for one of the programs, and, according to the Deputy Director for Program Protection, Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, these deficiencies were communicated to senior officials prior to the milestone review decision. The remaining program was not approved for continued development.

According to Trusted Mission Systems and Networks officials, the department is collecting metrics to assess the effectiveness of the supply chain risk management aspects of protection planning. Specifically, officials stated that the department is currently collecting data concerning the extent to which the department has engaged with program managers to understand supply chain threats, conducted criticality analyses to identify critical functions, and developed appropriate countermeasures and mitigations. According to an official within Trusted Mission Systems and Networks, the department had conducted 63 such engagements during fiscal year 2011.

National Security-Related Agencies Participate in Governmentwide Efforts to Address Supply Chain Security

The four national security-related agencies also participate in interagency efforts to address supply chain security. These include participation in the CNCI, development of technical and policy tools, and collaboration with the intelligence community.

In support of the CNCI, Defense and DHS jointly lead an interagency initiative on supply chain risk management to address issues of globalization affecting the federal government’s IT. Defense’s pilot program is intended to provide a basis for supply chain risk management policy recommendations to other federal agencies. In April 2011, Defense reported conducting supply chain risk management pilots and developed findings related to the need for (1) effective staffing and funding of supply chain risk management activities, (2) enterprise governance of supply chain risk management issues and mitigations, (3) processes and procedures to enhance trust and reduce risk in IT, (4) legal and contractual methods—including new legislation—to avoid using those suppliers determined to present elevated supply chain risk, and (5) revised agency policy to address supply chain risk management.

Additionally, DHS has developed a comprehensive portfolio of technical and policy-based product offerings for federal civilian departments and agencies. These services are incorporated into the set of capabilities offered by DHS’s National Cyber Security Division’s Supply Chain Risk Management Program, including technical assessment capabilities, acquisition support, and incident response capabilities. These services include the following:

Technical risk assessments: A comprehensive set of technical risk assessment capabilities that includes destructive and nondestructive analysis, code review and assessment, development of attack graphs, vulnerability assessments, and mitigation recommendations.

Acquisition threat and risk assessments: Department and agency program managers can submit system acquisition requirements for review and comment and will receive vendor risk assessment reports on vendors competing for the acquisition and potential mitigations for any identified risk.

Incident response and supply chain risk management analysis: The Supply Chain Risk Management Program has been working in cooperation with US-CERT to develop integrated analysis and response capabilities for supply chain incidents into its existing missions.

DHS supply chain risk management product offerings: Operational activities to support federal civilian department and agency efforts to manage information technology supply chain risk. These include assessment of agencies’ supply chain risk management capabilities and support of ongoing or future acquisitions, as well as technical analysis of hardware and software.

Additionally, in March 2012, the Committee on National Security Systems issued a directive that directs agencies with national security systems to implement a supply chain risk management program. The directive lists available best practices, tools, and resources, including those developed under CNCI efforts and Defense’s supply chain pilots. According to Defense and DHS officials, departments and agencies from Defense, the intelligence community, and the civilian agencies collaborated in developing this directive.

Further, Energy, DHS, Defense, and a component of Justice–the FBI— have contributed, to varying degrees, to the development of a common methodology for conducting threat assessments on entities that do business with the national security community. Under this initiative, which is led by the Office of the National Counterintelligence Executive, agencies are requested to provide copies of threat assessments to a centrally maintained database where they are stored for future use by components of the national security community. In addition, officials from Energy, DHS, Defense, and the FBI stated that they have, or have had, agency officials assigned to the office to facilitate threat information sharing. According to National Counterintelligence Executive officials, the four national security-related agencies have contributed 40 percent of the threat assessments available since 2009. Specifically, Energy has contributed 1 percent, DHS has contributed 4 percent, FBI has contributed 9 percent, and Defense or its components have contributed 26 percent of the threat assessments. Officials further stated that the vast majority of these assessments relate to firms within the IT industry, and the remainder relate to Defense weapons systems.

Formerly an independent agency, the Office of the National Counterintelligence Executive is now a component of the Office of the Director of National Intelligence. The duties of the National Counterintelligence Executive are set forth in part in the Counterintelligence Enhancement Act of 2002. One of these duties is to act in coordination with other agencies to assess the vulnerabilities of the U.S. government, as well as the private sector, to intelligence threats in order to identify the areas, programs, and activities that require protection from such threats.

Agencies Have Not Determined the Extent of Foreign- Developed IT Telecommunications Equipment, Software, or Services

Officials within the offices of the chief information officer at the Departments of Energy, Homeland Security, and Defense, and the Justice Management Division stated that their respective agencies have not determined and do not currently track the extent to which their telecommunications networks contain foreign-developed equipment, software, or services.

Federal law and regulation do not require federal agencies to track the country of origin of the telecommunications equipment, software, and services that they procure. Although a number of federal laws authorize a preference for American supplies or end products, these laws are of limited use for enhancing information assurance. For example, the Buy American Act, which is designed to promote national commerce and industry, generally (1) restricts federal agencies’ purchase of nondomestic (“foreign”) manufactured products, and (2) requires that each federal agency report to Congress annually for fiscal years 2009-2011 on the amount of acquisitions it made from entities that manufactured end products outside the United States. Under the act, however, an end product can be considered domestic even if it contains foreign components. Moreover, as implemented, the act does not apply to the acquisition of commercial IT products, which means that the government may purchase commercial IT without regard to the Buy American Act and its reporting requirements. Similarly, the Berry Amendment, which requires domestic sourcing by Defense of specialty metals, also has limited value for IT assurance. Specifically, the Berry Amendment does not apply to either electronic components or commercially available off- the-shelf items containing specialty metals.

In addition, federal officials from four components of the national security community provided reasons why the cost of tracking IT equipment’s country of origin outweighs the potential benefits. First, officials from the Director of National Intelligence and the National Security Agency stated that the relationship between a company and a foreign military or intelligence service is a more reliable indicator of a potential security risk than whether a product was manufactured outside the United States. Second, officials from the Director of National Intelligence, Defense Intelligence Agency, and the National Security Agency stated that tracking the country of origin alone would not be helpful because the country of origin does not necessarily reveal the origin of component technology that a supplier integrates into the final product. Third, officials from the Central Intelligence Agency and the Director of National Intelligence stated that tracking the country of origin for every IT component used in the agency’s telecommunications networks would be prohibitively expensive and infeasible, based on the mechanisms that are currently readily available.

Conclusions

IT supply chain risk management is an emerging and complex area. The organizations, people, activities, information, and resources used to create and distribute commercial IT to federal agencies introduce a myriad of security risks to federal information systems. If exploited, supply chain vulnerabilities—such as purchasing IT from gray markets or poor inspection and testing procedures—can introduce threats to the confidentiality, integrity, and availability of federal information systems. Should this occur on a critical information system, the potential exists for serious adverse impact on an agency’s operations, assets, or employees.

Despite acknowledging these risks, the Departments of Energy and Homeland Security have not developed clear policies that define what security measures, if any, should be implemented to protect against supply chain threats. Further, the Departments of Energy, Justice, and Homeland Security have neither developed and documented procedures for implementing supply chain protection measures nor established monitoring capabilities that are necessary to verify compliance with, and the effectiveness of, these measures. Until comprehensive policies, procedures, and monitoring capabilities are developed, documented, and implemented, it is more likely that these national security-related agencies will rely on security measures that are inadequate, ineffective, or inefficient to manage emergent information technology supply chain risks. In contrast, Defense has made greater progress by defining supply chain protection measures and implementing procedures.

Recommendations for Executive Action

To assist three national security-related agencies in better addressing IT supply chain-related security risks for their departmental information systems, we are making the following eight recommendations.

To assist the Department of Energy in protecting against IT supply chain threats, we recommend that the Secretary of Energy direct the appropriate agency officials to take the following three actions: develop and document departmental policy that defines which security measures should be employed to protect against supply chain threats; develop, document, and disseminate procedures to implement the supply chain protection security measures defined in departmental policy; and develop and implement a monitoring capability to verify compliance with, and assess the effectiveness of, supply chain protection measures.

To assist the Department of Homeland Security in protecting against IT supply chain threats, we recommend that the Secretary of Homeland Security direct the appropriate agency officials to take the following three actions: develop and document departmental policy that defines which security measures should be employed to protect against supply chain threats; develop, document, and disseminate procedures to implement the supply chain protection security measures defined in departmental policy; and develop and implement a monitoring capability to verify compliance with, and assess the effectiveness of, supply chain protection measures.

To assist the Department of Justice in protecting against IT supply chain threats, we recommend that the Attorney General direct the appropriate agency officials to take the following two actions: develop, document, and disseminate procedures to implement the supply chain protection security measures defined in departmental policy; and develop and implement a monitoring capability to verify compliance with, and assess the effectiveness of, supply chain protection measures.

Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of Defense, Energy, Homeland Security, and Justice (including the FBI), the Office of the Director of National Intelligence, and the Department of Commerce’s NIST for their review and comment.

Energy provided written comments on a draft of our report (see app. II), signed by the department’s Chief Information Officer. In its comments, Energy stated that it concurred with the spirit of our recommendations. Energy also expressed concern that the recommendations are not fully aligned with the administration’s initiatives and stated that it believes policies and standards to address IT supply chain risk management must be coordinated at the national level, not independently through individual agencies. We agree that national or federal policies and standards should be coordinated and promulgated at the national or federal level. We also believe, as intended by our recommendations, that federal departments are responsible for developing departmental policies and procedures that are consistent and aligned with federal guidance. Our recommendations to Energy are based on and consistent with federal guidance on supply chain risk management. Energy also stated that our report may significantly underestimate the deep complexities and interdependencies posed by the supply chain threat. Our report recognizes the unique characteristics related to understanding and mitigating the risks associated with the emerging IT supply chain threat. In particular, we identified potential threats to federal information systems that are beyond the failure or disruption in the production or distribution of critical IT products, including the introduction of hardware or software containing malicious logic at any point in a system’s life cycle.

DHS also provided written comments on a draft of our report (see app. III), signed by DHS’s Director of Departmental GAO-OIG Liaison Office. In its comments, DHS concurred with our recommendations and stated that the department’s Chief Information Security Officer had begun coordinating with the appropriate program offices to develop departmental policy to define security measures to protect against supply chain threats, with an estimated completion date of October 31, 2012. DHS also indicated that the Chief Information Security Officer will (1) examine the best available risk management procedures and (2) explore viable options for verifying compliance with, and assessing the effectiveness of, IT supply chain protection measures, with estimated completion dates of June 30, 2013, and October 31, 2013, respectively. We also received technical comments via e-mail from DHS officials responsible for IT supply chain-related efforts that were incorporated, where appropriate.

In addition, Justice concurred with the recommendations via an e-mail from the Acting Assistant Director, Audit Liaison Group, Internal Review and Evaluation Office, Justice Management Division. We also received technical comments via e-mail from FBI’s audit liaison that were incorporated, where appropriate.

We also received technical comments via e-mail from additional officials responsible for IT supply chain-related efforts at Defense, Commerce’s NIST, and the Office of the Director of National Intelligence. These comments were incorporated, where appropriate.

We are sending copies of this report to interested congressional committees; the Secretaries of the Departments of Defense, Energy, and Homeland Security; the Attorney General; the Administrator of the General Services Administration; the Director of the Office of Management and Budget; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify (1) the key risks associated with the supply chains used by federal agencies to procure information technology (IT) equipment, software, or services; (2) the extent to which selected national security-related agencies have addressed information technology supply chain risks; and (3) the extent to which national security-related federal agencies have determined that their telecommunication networks contain foreign-developed equipment, software, or services.

To identify the key risks, we collected, reviewed, and analyzed relevant supply chain-related practices, guidance, reports, policies, articles, press releases, and other materials from the Departments of Commerce, Defense, Homeland Security (DHS), and Justice. We also collected, reviewed, and analyzed articles from organizations, such as the Information Assurance Technology Analysis Center, the Software Assurance Forum for Excellence in Code, and the Supply Chain Management Center at the University of Maryland’s Robert H. Smith School of Business. Using these materials, we identified supply chain- related threats and vulnerabilities based on whether multiple source documents acknowledged the same or similar threats. On the basis of our analysis, we created common descriptions of the key threats and vulnerabilities related to the supply chain. We then validated our list of key threats by sharing them with, and soliciting feedback from, officials from the Office of the Director of National Intelligence, the Office of the National Counterintelligence Executive, the Defense Intelligence Agency, the Central Intelligence Agency, and the National Security Agency.

To identify the extent to which selected national security-related agencies have addressed IT supply chain risks, we analyzed agency policies and procedures related to information security and system acquisition at the Departments of Energy, Justice, Homeland Security, and Defense. We selected these national security-related departments because each is authorized to perform duties connected to national security, law enforcement, intelligence, or homeland defense. In particular, we evaluated whether an agency had, consistent with National Institute of Standards and Technology (NIST) Special Publication 800-53 controls SA-1 and SA-12, defined measures and developed implementing procedures to protect against information technology supply chain threats. We did not assess the effectiveness or legality of any defined measures or developed implementing procedures. In addition, we interviewed officials at each of the four agencies. For Energy, we interviewed officials from the National Nuclear Security Administration Office of the Chief Information Officer; Department of Energy Office of the Chief Information Officer; the Office of Health, Safety, and Security; the Office of Security Technology and Assistance; and the Office of Intelligence and Counterintelligence. For Justice, we interviewed officials from the Federal Bureau of Investigation and the Justice Management Division. For DHS, we interviewed officials from the National Cyber Security Division (Supply Chain Risk Management Group), the Office of the Chief Information Officer/Security Officer, and the Intelligence and Analysis Office. For Defense, we interviewed officials from the Defense Intelligence Agency, the Office of the Defense Chief Information Officer (Trusted Mission Systems and Networks), the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics (Systems Engineering), the National Security Agency, the Defense Information Assurance Program, and the U.S. Army.

To identify the extent to which national security-related federal agencies have determined that their telecommunications networks contain foreign- developed equipment, software, or services, we conducted a legal analysis and interviewed agency officials. Specifically, to determine whether agencies were required to make determinations related to the presence of foreign-developed equipment, software, or services in their telecommunications networks, we analyzed federal statutes, regulations, and agency policies. Sources consulted include provisions of the United States Code such as the Buy American Act, as well as other public laws; the Federal Acquisition Regulation and relevant supplements, including the Defense Federal Acquisition Regulation Supplement; Defense Federal Acquisition Regulation Procedures, Guidance, and Information; Department of Homeland Security procurement regulations; Office of Management and Budget Circular A-130; selected Homeland Security Presidential Directives; selected Executive Orders; and related GAO products. To determine whether the selected national security-related federal agencies had made determinations related to the presence of foreign-developed equipment, software, or services on their telecommunications networks, we interviewed officials from Justice’s Management Division and the Offices of the Chief Information Officer for the Departments of Energy, Homeland Security, and Defense. In order to identify potential costs and benefits associated with tracking the country of origin of IT equipment, software or services, we also interviewed officials from the Director of National Intelligence, the Defense Intelligence Agency, the National Security Agency, and the Central Intelligence Agency.

We conducted this performance audit from November 2010 through March 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Energy

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

GAO staff who made significant contributions to this report include Michael W. Gilmore, Assistant Director; Bradley W. Becker; Kami J. Corbett; Richard J. Hagerman; Kush K. Malhotra; Lee A. McCracken; Sylvia Shanks; and Adam Vodraska.