-: Let's talk for a few moments 2 2
about RMF and supply chain risk management. 3 3
This version of RMF incorporates an approach 4 4
to manage cyber risk in your supply chain. 5 5
There's good reason for this. 6 6
Most organizations rely on a lot of external providers 7 7
and commercial off the shelf products, systems and services. 8 8
These are all referred to as third parties 9 9
which is a term that comes from the contracting world. 10 10
And because of this dependency on third parties 11 11
cyber attackers are using the supply chain 12 12
as an attack vector and as an effective means 13 13
of breaking into our systems, 14 14
compromising their trustworthiness and gaining access 15 15
to our critical digital assets. 16 16
Because attacking third parties work so well, cyber attacks 17 17
or cyber disruptions to an organization's supply chain 18 18
are increasing and so are the negative impacts. 19 19
Let me give you a recent example. 20 20
SolarWinds is the maker 21 21
of remote network management software. 22 22
Users of this software included 425 of the Fortune 500, 23 23
the top 10 U.S. telecommunications companies, 24 24
the top five U.S. accounting firms, 25 25
all branches of the U.S. military, the Pentagon, 26 26
the State Department, as well as hundreds of universities 27 27
and colleges worldwide. 28 28
The cyber attackers exploited 29 29
the SolarWinds software making environment 30 30
and committed a software supply chain attack. 31 31
A Russian cyber exploitation group called Cozy Bear 32 32
and also known as Advanced Persistent Threat 29 33 33
gained access to many government and other systems 34 34
through this compromised update to the SolarWinds software 35 35
which resulted in massive damage. 36 36
Cleaning up the SolarWinds hack 37 37
may cost the American economy as much as $100 billion. 38 38
As U.S.government agencies 39 39
and private corporations spend months 40 40
finding and removing the malicious code. 41 41
And before SolarWinds, a data deleting worm called NotPetya 42 42
was delivered through a compromised software update 43 43
to a popular Ukrainian tax software package. 44 44
NotPetya ultimately caused over $10 billion in damage 45 45
as it stormed across Europe 46 46
and through many countries on other continents. 47 47
Supply chain risks include things 48 48
like untrustworthy suppliers, counterfeit parts, tampering, 49 49
theft of trade secrets, the insertion of malicious code, 50 50
and poor manufacturing and development practices 51 51
throughout the systems development life cycle. 52 52
As a result of all these real world concerns 53 53
RMF wants us to include supply chain risk management 54 54
so that it's integrated with our security 55 55
and privacy risk management practices.