Critical Read

Shoring up supply chain security

world map

What: A new report advising governments on how to make their information and communications technology (ICT) supply chains more secure, written by the New America Foundation's Danielle Kriz and published by the Council on Foreign Relations.

Why: Governments that are increasingly reliant on ICT to do business are demanding that vendors get more secure. But some policy proposals for doing so are wrongheaded, Kriz wrote.

Supply chain measures should address clear gaps in policy, work globally, improve the government's ICT procurement practices and boost cyberthreat information sharing with vendors, she said. They should not, however, discriminate against products from a certain country.

The broad nature of the challenge means several U.S. agencies have weighed in on ICT supply chain security, including the Defense Department, the Department of Homeland Security and the Office of Management and Budget.

The report notes a "plethora of worrisome approaches" to securing ICT supply chains that ignored their global nature. For example, in 2013, DOD proposed making vendors use a particular security technology. U.S. laws that require closer scrutiny of ICT products from certain countries are also misguided, Kriz said. The report also faults India and China for protectionist procurement policies.

Kriz argued that country-of-origin requirements hurt ICT security because software development processes can have a greater impact on security than where the product is made.

Verbatim: "Policies mandating certain technologies, standards or practices cannot keep up with threats that evolve constantly and affect each firm uniquely. A check-the-box compliance regime will likely deter firms from responding to risks for fear of violating a regulation, and divert resources from where security is needed and from developing responses to new risks."

Click here to read the full report.

About the Author

Sean Lyngaas is a former FCW staff writer.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.