Supply Chain: Difference between revisions

From CyberWiki
Jump to navigation Jump to search
No edit summary
(Blanked the page)
Tag: Blanking
 
(13 intermediate revisions by the same user not shown)
Line 1: Line 1:
== Executive Summary ==


Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access.
== Key Findings ==
=== Undocumented Hardware and Communications ===
* Hidden cellular, Wi‑Fi, and Bluetooth capabilities were discovered during field assessments.
* Undocumented communications undermine assumptions regarding trusted deployments.
* Hardware configurations did not always align with manufacturer documentation.
=== Supply Chain Visibility Gaps ===
* Utilities have limited visibility into sourcing, manufacturing, firmware provenance, and component supply chains.
* Counterfeit or modified equipment remains difficult to identify and validate.
=== Security Control Weaknesses ===
* Default credentials remain common across deployed systems.
* Many systems lack lockout, throttling, and credential-guessing protections.
* Security approaches frequently rely on trusted environments instead of technical controls.
== Risks ==
=== Operational Risks ===
* Coordinated manipulation of IBRs and BESS could contribute to grid instability.
* Unauthorized remote access may enable coordinated shutdowns and operational disruption.
=== Cyber Risks ===
* Wireless communications extend the attack surface beyond facility boundaries.
* Cellular connectivity removes geographic constraints for attackers.
* Supply-chain tampering may remain undetected throughout the asset lifecycle.
== Recommendations ==
=== Procurement Controls ===
* Require Software Bills of Materials (SBOMs).
* Require Hardware Bills of Materials (HBOMs).
* Validate vendor secure-development practices.
* Require vulnerability disclosure programs.
=== Detection and Monitoring ===
* Perform wireless spectrum assessments.
* Continuously inventory assets and communications pathways.
* Establish supply-chain forensic and investigative capabilities.
=== Mitigation ===
* Disable unnecessary remote-access capabilities.
* Eliminate default credentials.
* Implement network segmentation.
* Deploy multifactor authentication where practical.
== Resources ==
* https://www.epri.com/research/programs/112046/results/3002012753

Latest revision as of 14:48, 23 October 2026

Retrieved from "https://cyberwiki.epri.com/index.php?title=Supply_Chain&oldid=580"