Supply Chain: Difference between revisions

From CyberWiki
Jump to navigation Jump to search
(Created page with "# Supply Chain Security ## Executive Summary Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access. ## Key Findings ### Undocumented Hardware and Communications - Hidden cellular, Wi...")
 
No edit summary
Line 1: Line 1:
# Supply Chain Security
= Supply Chain Security =


## Executive Summary
== Executive Summary ==


Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access.  
Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access.  


## Key Findings
== Key Findings ==


### Undocumented Hardware and Communications
=== Undocumented Hardware and Communications ===


- Hidden cellular, Wi-Fi, and Bluetooth capabilities were discovered during field assessments.  
* Hidden cellular, Wi‑Fi, and Bluetooth capabilities were discovered during field assessments.  
- Undocumented communications undermine assumptions regarding trusted deployments.  
* Undocumented communications undermine assumptions regarding trusted deployments.  
- Hardware configurations did not always align with manufacturer documentation.  
* Hardware configurations did not always align with manufacturer documentation.  


### Supply Chain Visibility Gaps
=== Supply Chain Visibility Gaps ===


- Utilities have limited visibility into sourcing, manufacturing, firmware provenance, and component supply chains.  
* Utilities have limited visibility into sourcing, manufacturing, firmware provenance, and component supply chains.  
- Counterfeit or modified equipment remains difficult to identify and validate.  
* Counterfeit or modified equipment remains difficult to identify and validate.  


### Security Control Weaknesses
=== Security Control Weaknesses ===


- Default credentials remain common across deployed systems.  
* Default credentials remain common across deployed systems.  
- Many systems lack lockout, throttling, and credential-guessing protections.  
* Many systems lack lockout, throttling, and credential-guessing protections.  
- Security approaches frequently rely on trusted environments instead of technical controls.  
* Security approaches frequently rely on trusted environments instead of technical controls.  


## Risks
== Risks ==


### Operational Risks
=== Operational Risks ===


- Coordinated manipulation of IBRs and BESS could contribute to grid instability.  
* Coordinated manipulation of IBRs and BESS could contribute to grid instability.  
- Unauthorized remote access may enable coordinated shutdowns and operational disruption.  
* Unauthorized remote access may enable coordinated shutdowns and operational disruption.  


### Cyber Risks
=== Cyber Risks ===


- Wireless communications extend the attack surface beyond facility boundaries.  
* Wireless communications extend the attack surface beyond facility boundaries.  
- Cellular connectivity removes geographic constraints for attackers.  
* Cellular connectivity removes geographic constraints for attackers.  
- Supply-chain tampering may remain undetected throughout the asset lifecycle.  
* Supply-chain tampering may remain undetected throughout the asset lifecycle.  


## Recommendations
== Recommendations ==


### Procurement Controls
=== Procurement Controls ===


- Require Software Bills of Materials (SBOMs).  
* Require Software Bills of Materials (SBOMs).  
- Require Hardware Bills of Materials (HBOMs).  
* Require Hardware Bills of Materials (HBOMs).  
- Validate vendor secure-development practices.  
* Validate vendor secure-development practices.  
- Require vulnerability disclosure programs.  
* Require vulnerability disclosure programs.  


### Detection and Monitoring
=== Detection and Monitoring ===


- Perform wireless spectrum assessments.  
* Perform wireless spectrum assessments.  
- Continuously inventory assets and communications pathways.  
* Continuously inventory assets and communications pathways.  
- Establish supply-chain forensic and investigative capabilities.  
* Establish supply-chain forensic and investigative capabilities.  


### Mitigation
=== Mitigation ===


- Disable unnecessary remote-access capabilities.  
* Disable unnecessary remote-access capabilities.  
- Eliminate default credentials.  
* Eliminate default credentials.  
- Implement network segmentation.  
* Implement network segmentation.  
- Deploy multifactor authentication where practical.
* Deploy multifactor authentication where practical.

Revision as of 16:30, 21 October 2026

Supply Chain Security

Executive Summary

Supply chain assessments identified significant risks associated with globally sourced inverter-based resources (IBRs) and battery energy storage systems (BESS). Limited visibility into hardware, firmware, and communications capabilities creates opportunities for malicious modification, hidden functionality, and unauthorized remote access.

Key Findings

Undocumented Hardware and Communications

  • Hidden cellular, Wi‑Fi, and Bluetooth capabilities were discovered during field assessments.
  • Undocumented communications undermine assumptions regarding trusted deployments.
  • Hardware configurations did not always align with manufacturer documentation.

Supply Chain Visibility Gaps

  • Utilities have limited visibility into sourcing, manufacturing, firmware provenance, and component supply chains.
  • Counterfeit or modified equipment remains difficult to identify and validate.

Security Control Weaknesses

  • Default credentials remain common across deployed systems.
  • Many systems lack lockout, throttling, and credential-guessing protections.
  • Security approaches frequently rely on trusted environments instead of technical controls.

Risks

Operational Risks

  • Coordinated manipulation of IBRs and BESS could contribute to grid instability.
  • Unauthorized remote access may enable coordinated shutdowns and operational disruption.

Cyber Risks

  • Wireless communications extend the attack surface beyond facility boundaries.
  • Cellular connectivity removes geographic constraints for attackers.
  • Supply-chain tampering may remain undetected throughout the asset lifecycle.

Recommendations

Procurement Controls

  • Require Software Bills of Materials (SBOMs).
  • Require Hardware Bills of Materials (HBOMs).
  • Validate vendor secure-development practices.
  • Require vulnerability disclosure programs.

Detection and Monitoring

  • Perform wireless spectrum assessments.
  • Continuously inventory assets and communications pathways.
  • Establish supply-chain forensic and investigative capabilities.

Mitigation

  • Disable unnecessary remote-access capabilities.
  • Eliminate default credentials.
  • Implement network segmentation.
  • Deploy multifactor authentication where practical.
Retrieved from "https://cyberwiki.epri.com/index.php?title=Supply_Chain&oldid=539"