Supply Chain: Difference between revisions

From CyberWiki
Jump to navigation Jump to search
(Created page with "# Supply Chain Security ## Executive Summary Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access. ## Key Findings ### Undocumented Hardware and Communications - Hidden cellular, Wi...")
 
(Blanked the page)
Tag: Blanking
 
(16 intermediate revisions by the same user not shown)
Line 1: Line 1:
# Supply Chain Security


## Executive Summary
Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access.
## Key Findings
### Undocumented Hardware and Communications
- Hidden cellular, Wi-Fi, and Bluetooth capabilities were discovered during field assessments.
- Undocumented communications undermine assumptions regarding trusted deployments.
- Hardware configurations did not always align with manufacturer documentation.
### Supply Chain Visibility Gaps
- Utilities have limited visibility into sourcing, manufacturing, firmware provenance, and component supply chains.
- Counterfeit or modified equipment remains difficult to identify and validate.
### Security Control Weaknesses
- Default credentials remain common across deployed systems.
- Many systems lack lockout, throttling, and credential-guessing protections.
- Security approaches frequently rely on trusted environments instead of technical controls.
## Risks
### Operational Risks
- Coordinated manipulation of IBRs and BESS could contribute to grid instability.
- Unauthorized remote access may enable coordinated shutdowns and operational disruption.
### Cyber Risks
- Wireless communications extend the attack surface beyond facility boundaries.
- Cellular connectivity removes geographic constraints for attackers.
- Supply-chain tampering may remain undetected throughout the asset lifecycle.
## Recommendations
### Procurement Controls
- Require Software Bills of Materials (SBOMs).
- Require Hardware Bills of Materials (HBOMs).
- Validate vendor secure-development practices.
- Require vulnerability disclosure programs.
### Detection and Monitoring
- Perform wireless spectrum assessments.
- Continuously inventory assets and communications pathways.
- Establish supply-chain forensic and investigative capabilities.
### Mitigation
- Disable unnecessary remote-access capabilities.
- Eliminate default credentials.
- Implement network segmentation.
- Deploy multifactor authentication where practical.

Latest revision as of 14:48, 23 October 2026

Retrieved from "https://cyberwiki.epri.com/index.php?title=Supply_Chain&oldid=580"