4 ms·

This is it 100%. I work at a major financial institution and we invest ridiculous amounts of money, effort and, frankly, delay, in understanding our supply cha

by jcims 7y ago

This is it 100%. I work at a major financial institution and we invest ridiculous amounts of money, effort and, frankly, delay, in understanding our supply chain, its security posture and risk management model. It's a unbelievably gargantuan effort and if it weren't for the scary shit that we find all the time one could easily argue it's a waste.

victor9000 7y ago
What problems have you encountered that others should avoid?
- jcims 7y ago
  They run the gamut. Lack of a viable risk management program, lack of resiliency planning and testing, poor operational and change management controls, poor visibility and response planning for security events, poor SDLC security, etc. etc. The requirements vary based on our exposure.
- Spooky23 7y ago
  Over the years, I have run into: - Counterfeit components, like memory out of spec that creates scaled failures. - Fake products from the channel. - Fundamental mistruths with regard to how services are delivered. - Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester. - Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work. - Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. - Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets. Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.
  - 6510 7y ago
    I read when having bicycle frames made in Taiwan you get the best price/quality ratio if you have a permanent onsite observer in the factory. That guy doesn't really do anything but they wont cut corners if he is around.
    - notyourday 7y ago
      You get what you pay for. If you aren't paying for the guy to be the observer there's no one to observe.
      - dredmorbius 7y ago
        You don't get what you pay for. But generally value derives from multiple independent credible verifiable audit mechanisms.
        eru 7y ago
        Or from reputation. A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.
        dredmorbius 7y ago
        The value of trust. JS Mill has some interesting observations going back a ways. Auditing is still recommended.
        eru 7y ago
        Definitely, auditing is one way to speed up the process. Ignoring auditing for a moment: The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly. But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable. And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam https://en.wikipedia.org/wiki/Exit_scam
transpute 7y ago
> It's a unbelievably gargantuan effort Also applies to software supply chains: https://www.platformsecuritysummit.com/2019/speaker/sherman/ https://www.platformsecuritysummit.com/2019/speaker/sherman/ > Today’s software is largely assembled rather than written, and most of the assembly comes from open source components. The creation of components and their inclusion into applications creates a “supply chain” just like in conventional manufacturing. While physical supply chains have well established chains-of-custody to establish properties like refrigeration maintenance, authenticity or spoilage avoidance, the software supply chain is very much a wild, wild west, filled with vulnerabilities that can be (and are) inadvertently inserted into applications. As supply chain risk and mitigations are being explored by government and academia, a larger attack surface is being uncovered that needs to be addressed.
- jcims 7y ago
  We do that too. :)
robk 7y ago
What have you found? (Omitting any details that would be confidential of course)
hinkley 7y ago
I mean, imagine you have a 3 year contract with a supplier, and when you go to renew they get cagey and seem to be giving you the runaround. Later you find out that it's because they already signed a contract with one of your competitors that begins the day after your old contract expires. We laugh about golf and Vegas visits, but it's really hard to stab someone in the back when you're used to looking them in the eye. If they're just some suit you meet once every three years? Fuck 'em.
malandrew 7y ago
> the scary shit that we find all the time Curious to hear examples if you can share.

by jcims 7y ago

victor9000 7y ago

What problems have you encountered that others should avoid?

jcims 7y ago
They run the gamut. Lack of a viable risk management program, lack of resiliency planning and testing, poor operational and change management controls, poor visibility and response planning for security events, poor SDLC security, etc. etc. The requirements vary based on our exposure.
Spooky23 7y ago
Over the years, I have run into: - Counterfeit components, like memory out of spec that creates scaled failures. - Fake products from the channel. - Fundamental mistruths with regard to how services are delivered. - Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester. - Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work. - Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. - Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets. Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.
- 6510 7y ago
  I read when having bicycle frames made in Taiwan you get the best price/quality ratio if you have a permanent onsite observer in the factory. That guy doesn't really do anything but they wont cut corners if he is around.
  - notyourday 7y ago
    You get what you pay for. If you aren't paying for the guy to be the observer there's no one to observe.
    - dredmorbius 7y ago
      You don't get what you pay for. But generally value derives from multiple independent credible verifiable audit mechanisms.
      - eru 7y ago
        Or from reputation. A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.
        dredmorbius 7y ago
        The value of trust. JS Mill has some interesting observations going back a ways. Auditing is still recommended.
        eru 7y ago
        Definitely, auditing is one way to speed up the process. Ignoring auditing for a moment: The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly. But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable. And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam https://en.wikipedia.org/wiki/Exit_scam

transpute 7y ago

> It's a unbelievably gargantuan effort Also applies to software supply chains: https://www.platformsecuritysummit.com/2019/speaker/sherman/ https://www.platformsecuritysummit.com/2019/speaker/sherman/ > Today’s software is largely assembled rather than written, and most of the assembly comes from open source components. The creation of components and their inclusion into applications creates a “supply chain” just like in conventional manufacturing. While physical supply chains have well established chains-of-custody to establish properties like refrigeration maintenance, authenticity or spoilage avoidance, the software supply chain is very much a wild, wild west, filled with vulnerabilities that can be (and are) inadvertently inserted into applications. As supply chain risk and mitigations are being explored by government and academia, a larger attack surface is being uncovered that needs to be addressed.

jcims 7y ago
We do that too. :)

robk 7y ago

What have you found? (Omitting any details that would be confidential of course)

hinkley 7y ago

I mean, imagine you have a 3 year contract with a supplier, and when you go to renew they get cagey and seem to be giving you the runaround. Later you find out that it's because they already signed a contract with one of your competitors that begins the day after your old contract expires. We laugh about golf and Vegas visits, but it's really hard to stab someone in the back when you're used to looking them in the eye. If they're just some suit you meet once every three years? Fuck 'em.

malandrew 7y ago

> the scary shit that we find all the time Curious to hear examples if you can share.