Quick Tutorial: Supply Chain Security

ISO/IEC 20243 provides a guideline document/standard for supply chain security, if applied, helps in mitigating risks of acquiring counterfeit and malicious products by manufacturers. Counterfeit products are developed by others but acquired as legitimate, while malicious products are developed by the genuine manufacturer but tampered with maliciously and acquired through the provider’s authorized channel. This article will walk through a high-level checklist applicable for companies to get some assurance of supply chain security.

Below is the high-level checklist that is helpful to have a quick overview to achieve supply chain security:

1. The product design process should be formally defined and documented.
2. Existence of configuration management to develop the product. It helps in tracking change in the development of a product.
3. A mature and documented process is used to develop a product.
4. Adequately defined Quality Management (QM) system available to develop secure products.
5. Support of product for the management of patches and defects of products.
6. Run-time Protection Techniques should be implemented to protect code against null pointers, buffer overflow, etc.
7. Threat Analysis and possible mitigation techniques should be employed.
8. Vulnerability analysis and techniques should be identified.
9. Patch management and remediation mechanisms should be implemented.
10. Follow secure engineering practice related to authentication, hardware design security, use of an appropriate flag, etc.
11. Implementation of physical security for the development and supply chain of a product.
12. Implementation of access control for intellectual property-related aspects of the product.
13. Ensure security and integrity of employee and supplier by background check
14. Provide training to improve security awareness in transmission and handling controls among personnel.
15. Mitigate counterfeit components and proper disposal procedures upon the end of life should be employed.
16. Identification and implementation of malware detection tools in the product development life cycle.

Conclusion

Implementation of ISO/IEC 20243 by an organization helps in achieving supply chain security. This standard provides practical guidelines, requirements, and recommendations by reducing the risk of acquiring maliciously tainted or counterfeit products in a supply chain.

Reference:

• ISO/IEC 20243-1:2018 - Information technology — Open Trusted Technology ProviderTM Standard (O-TTPS) — Mitigating maliciously tainted and counterfeit products