Software Acquisition and the Supply Chain Flashcards
Acquisition Lifecycle phases
Planning, contracting, development & testing, acceptance, delivery, deployment (installation), operations & monitoring (transitioning), and retirement.
Secure transfer involves
The protection of the delivery channels and processes so that the software is not only free of being tampered but authentic in its origin when it is transitioned from one supplier to another or to the acquirer. It is in the delivery phase of the acquisition Lifecycle.
The software can be acquired in one or more of the following ways:
Direct purchase, Original Equipment Manufacturer (OEM) licensing, partnering (alliance) with the software vendor, outsourcing, and managed Services.
Software provenance is when
A software is handed over from one supplier to another, the responsibility for protection the software shifts as well.
What is the primary instrument by which managed services are procured, delivered and enforced?
Service Level Agreements (SLAs).
Predictable execution ensures
The software demonstrates justifiable confidence that it functions reliably as expected.
Each entity of the supply chain assures the primary goal of predictable execution and minimizes the risk of a security breach meeting
Goals of conformance, trustworthiness, and authenticity.
Conformance ensures
The software is planned and undergoes a systematic set of activities to conform to the requirement specifications, standards and best practices.
Trustworthiness ensures
The software does not have vulnerabilities that are maliciously or accidentally introduced into the code. In other words, the software functions reliably assuring trust.
Authenticity ensures
The materials used in the production of the software is not counterfeited, pirated or in violation of any intellectual property rights.
How is the goal of predictable execution (integrity) is achieved?
When software meets the goal of conformance,
trustworthiness, and authenticity.
The most potential and predominant threat in the
software supply chain is
Tampering of software to introduce malicious software (malware) in code, during or after the development
of the software.
In the supply chain software, there are threats that are possible against the product (software or service).
Tampering of the code to circumvent existing security controls; Unauthorized disclosure, alteration, corruption, and/or deletion/ destruction of data; Diversion and/or re-routing of data causing disruptions and delays; Code sabotage by intentionally implanting vulnerabilities and malicious logic; Counterfeiting by substitution of legitimate products and/or data
with similar but bogus ones; Piracy and theft of intellectual property rights by reverse engineering
executable code.
In the supply chain software, there are threats that are possible against the processes and flows.
Bypass of legitimate flows and surreptitious diversion of legitimate channels to pirated ones; Insecure code transfer that does not maintain chain of custody; Violation of export control requirements; Improper configuration of software allowing undocumented
modifications and operational misuse.
In the supply chain software, there are threats that are possible against the people.
Undetected placement of a malicious threat agent (hacker, criminal, adversary) inside the company (e.g. insider); Social engineering insiders to commit fraud or perjury (i.e., subornation); Concerns related to Foreign Ownership and Control or Influence (FOCI). These concerns range from nation-state sponsored hackers
to individuals who are willing to do nefarious acts because of their affinity to hostile countries.
SCRM
Software Supply Chain Risk Management.
