3 ms·

> Information and communications technology supply chain security is core to DHS’s cybersecurity mission How true is this? I know US-CERT is within DHS, but wh

> Information and communications technology supply chain security is core to DHS’s cybersecurity mission How true is this? I know US-CERT is within DHS, but what else does DHS do in this area? I did a bit of searching and found https://fcw.com/articles/2018/02/14/dhs-supply-chain-security.aspx https://fcw.com/articles/2018/02/14/dhs-supply-chain-securit..., which seems to imply that until 8 months ago, DHS wasn't doing much (or anything) in this area. If that's the case, I don't see how a statement from them regarding supply chain security can carry any weight. You don't go from nothing to being an expert in 8 months.

jhabdas 8y ago
There's an Oscar Wilde quote in there somewhere.
AndrewKemendo 8y ago
The DOD and the IC broadly have been very focused on Supply Chain Risk Management for a long time. Unfortunately the way the SCRM process works inside the govt is that it's legally focused and limited to primarily defense products, specifically things like hardware used in missiles, planes and equipment. The major shift over the last decade or two to the commercial world being the source of a lot of risk vectors that impact the govt, means that govt capabilities to have oversight and control, or even warning, is severely limited. This case is a great example of that, as more and more threats to the govt are coming through commercial and personal devices. Said another way, foreign adversaries don't need to target military equipment to have major capacity to spy on, or impact US government activities and policies. Private companies have to request support from DHS when there isn't a known risk to military supply chain. 99% of companies don't do this because 1. They don't want to, 2. The govt makes it hard to do and 3. It's not advertised well. The US Govt is not structured to handle this at scale and there is no real solution without making a HUGE shift in private sector oversight that would be incredibly unconstitutional.

jhabdas 8y ago

There's an Oscar Wilde quote in there somewhere.

AndrewKemendo 8y ago

The DOD and the IC broadly have been very focused on Supply Chain Risk Management for a long time. Unfortunately the way the SCRM process works inside the govt is that it's legally focused and limited to primarily defense products, specifically things like hardware used in missiles, planes and equipment. The major shift over the last decade or two to the commercial world being the source of a lot of risk vectors that impact the govt, means that govt capabilities to have oversight and control, or even warning, is severely limited. This case is a great example of that, as more and more threats to the govt are coming through commercial and personal devices. Said another way, foreign adversaries don't need to target military equipment to have major capacity to spy on, or impact US government activities and policies. Private companies have to request support from DHS when there isn't a known risk to military supply chain. 99% of companies don't do this because 1. They don't want to, 2. The govt makes it hard to do and 3. It's not advertised well. The US Govt is not structured to handle this at scale and there is no real solution without making a HUGE shift in private sector oversight that would be incredibly unconstitutional.