BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.3 Supply Chain Protection

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 3 Platform Integrity Verification part of 3

Title

Supply Chain Protection

Control

Organizations are increasingly at risk of supply chain compromise, whether intentional or unintentional. Managing cyber supply chain risks requires, in part, ensuring the integrity, quality, and resilience of the supply chain, its products, and its services. Cyber supply chain risks may include counterfeiting, unauthorized production, tampering, theft, and insertion of malicious or otherwise unexpected software and hardware, as well as poor manufacturing and development practices in the cyber supply chain [8] [9] [10] .

Special technologies have been developed to help ascertain the authenticity and integrity of platform hardware, including its firmware and configuration. These technologies help ensure that platforms are not tampered with or altered from the time that they are assembled at the manufacturer site to the time that they arrive at a customer data center ready for installation. Verification of these platform attributes is one aspect of securing the supply chain. 1 Some technologies include an additional feature for locking the boot process or access to these platforms until a secret is provided that only the customer and manufacturer know.

Please refer to the following technology examples in the appendices for more information:

• Intel Transparent Supply Chain (TSC)

• Intel PFR with Protection in Transit (PIT)

• Cisco Supply Chain Protection

1 For more information on supply chain security, see the National Cybersecurity Center of Excellence (NCCoE) Supply Chain Assurance project page at https://www.nccoe.nist.gov/supply-chain-assurance .