Code in supply chain a threat

Agencies that focus on national security data and programs need to do more to secure their information technology supply chains, a government watchdog said.

04/03/2012


ISS SourceAgencies that focus on national security data and programs need to do more to secure their information technology supply chains, a government watchdog said.

Federal agencies are not required to track “the extent to which their telecommunications networks contain foreign-developed equipment, software or services,” the Government Accountability Office (GAO) report said, and they typically are aware only of the IT vendors nearest to them on the supply chain, not the numerous vendors downstream.

That has left IT systems at the Energy, Homeland Security and Justice departments more vulnerable to malicious or counterfeit software installed by other nations’ intelligence agencies or by nonstate actors and hackers.

U.S. enemies could use that malicious software to secretly pull information from government systems, erase or alter information on those systems, or even take control of them remotely.

The Justice Dept. identified measures to protect its supply chain but has not developed procedures to implement those measures, the report said. Energy and Homeland Security haven’t identified measures to protect their supply chains at all, according to GAO.

The watchdog agency also examined the Defense Dept., which it said had designed and effectively implemented a supply chain risk management program.

Defense has reduced its supply chain risk through a series of pilot programs and expects to have “full operational capability for supply chain risk management” by 2016, the report said. Those pilots focus on assessing the risk posed by particular vendors’ supply chains and on testing and evaluating the purchased systems for malicious components, GAO said.

The U.S. Computer Emergency Readiness Team inside DHS found about one-fourth of roughly 43,000 agency-reported security incidents during fiscal 2011 involved malicious code that could have been installed somewhere along the supply chain, GAO said.

Globally sourced IT hardware buys can prove embarrassing for agencies that deal with national security data even if there’s no malicious or counterfeit technology inside the machines.



No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
World-class manufacturing: A recipe for success: Finding the right mix for a salad dressing line; 2015 Salary Survey: Manufacturing slump dims enthusiasm
2015 Top Plant: Phoenix Contact, Middletown, Pa.; 2015 Best Practices: Automation, Electrical Safety, Electrical Systems, Pneumatics, Material Handling, Mechanical Systems
A cool solution: Collaboration, chemistry leads to foundry coat product development; See the 2015 Product of the Year Finalists
Digital oilfields: Integrated HMI/SCADA systems enable smarter data acquisition; Real-world impact of simulation; Electric actuator technology prospers in production fields
Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Getting ready for industrial IoT; Visualizing the (applied) automation continuum; Preventing VFD faults and failures; Using wireless for closed-loop applications
Migrating industrial networks; Tracking HMI advances; Making the right automation changes
Understanding transfer switch operation; Coordinating protective devices; Analyzing NEC 2014 changes; Cooling data centers

Annual Salary Survey

After almost a decade of uncertainty, the confidence of plant floor managers is soaring. Even with a number of challenges and while implementing new technologies, there is a renewed sense of optimism among plant managers about their business and their future.

The respondents to the 2014 Plant Engineering Salary Survey come from throughout the U.S. and serve a variety of industries, but they are uniform in their optimism about manufacturing. This year’s survey found 79% consider manufacturing a secure career. That’s up from 75% in 2013 and significantly higher than the 63% figure when Plant Engineering first started asking that question a decade ago.

Read more: 2014 Salary Survey: Confidence rises amid the challenges

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
This article collection contains several articles on the vital role that compressed air plays in manufacturing plants.