486
B. Russell
10.3.1.5 Gaining Visibility into Your Supply Chain
It is difficult to understand the cyber security posture of your IoT system without
having full visibility into the libraries and third-party components that together make
up your software and firmware. As an IoT system developer, make sure to establish
processes to document all components used within your system – a bill of materials
(BOM).
Communicating the BOM to your customers is also important. This allows
the customers that implement your products to understand their risk exposure
by providing visibility into the dozens or hundreds of libraries used across their
enterprise systems. This also provides customers with a valuable tool to determine
what patches must be applied to their IoT systems to ensure that they do not remain
vulnerable. Today, there are two competing standards that can be used to create a
bill of materials. Software Package Data Exchange (SPDX) Tools is available from
The Linux Foundation [11]. Cisco offers a propriety tool known as SWID.
The US National Telecommunications and Information Administration (NTIA)
has spearheaded a project to create a standardized bill of materials (BOM) for
software. The premise is that third-party software introduces risk into the supply
chain and must be properly tracked to be able to close vulnerabilities quickly.
A good example of this problem was seen in 2018 when a bug was found by
researchers GraphicsFuzz in the Qualcomm Adreno 630 graphics driver [12]. This
bug in the Adreno driver was able to be exploited to cause a reboot of the Samsung
Galaxy S9.
Adreno 630 is a graphics card used in the Qualcomm Snapdragon 845 System-on-Chip
(SoC) used in a variety of smartphones. A bug in the 630 driver could have impacts on not
only the Samsung Galaxy S9 but also on other mobile phones that make use of that driver.
This means that when a bug is found in the driver associated with one mobile phone, other
mobile phone manufacturers should take action to patch their systems as soon as possible.
Without good visibility into the libraries used within your systems though, that would be
difficult at best.
10.3.1.6 Working with the Security Research Community
In 2018, the IoTSF conducted a study to analyze the vulnerability disclosure programs across consumer IoT companies. The study found that 90% of consumer IoT
companies did not have a formal vulnerability disclosure process in place [13]. This
means that security researchers have not pre-defined method of communicating bugs
and vulnerabilities found in those company’s products. A vulnerability disclosure
process establishes formal procedures for accepting inputs from external sources.
Make sure to provide a Pretty Good Privacy (PGP) public key on your organization’s
website to support encrypted submissions.
The security research community has led the creation of a grassroots vulnerability research function. Researchers across the globe are constantly analyzing
products to identify new vulnerabilities. As a developer of IoT products and systems,
B. Russell
10.3.1.5 Gaining Visibility into Your Supply Chain
It is difficult to understand the cyber security posture of your IoT system without
having full visibility into the libraries and third-party components that together make
up your software and firmware. As an IoT system developer, make sure to establish
processes to document all components used within your system – a bill of materials
(BOM).
Communicating the BOM to your customers is also important. This allows
the customers that implement your products to understand their risk exposure
by providing visibility into the dozens or hundreds of libraries used across their
enterprise systems. This also provides customers with a valuable tool to determine
what patches must be applied to their IoT systems to ensure that they do not remain
vulnerable. Today, there are two competing standards that can be used to create a
bill of materials. Software Package Data Exchange (SPDX) Tools is available from
The Linux Foundation [11]. Cisco offers a propriety tool known as SWID.
The US National Telecommunications and Information Administration (NTIA)
has spearheaded a project to create a standardized bill of materials (BOM) for
software. The premise is that third-party software introduces risk into the supply
chain and must be properly tracked to be able to close vulnerabilities quickly.
A good example of this problem was seen in 2018 when a bug was found by
researchers GraphicsFuzz in the Qualcomm Adreno 630 graphics driver [12]. This
bug in the Adreno driver was able to be exploited to cause a reboot of the Samsung
Galaxy S9.
Adreno 630 is a graphics card used in the Qualcomm Snapdragon 845 System-on-Chip
(SoC) used in a variety of smartphones. A bug in the 630 driver could have impacts on not
only the Samsung Galaxy S9 but also on other mobile phones that make use of that driver.
This means that when a bug is found in the driver associated with one mobile phone, other
mobile phone manufacturers should take action to patch their systems as soon as possible.
Without good visibility into the libraries used within your systems though, that would be
difficult at best.
10.3.1.6 Working with the Security Research Community
In 2018, the IoTSF conducted a study to analyze the vulnerability disclosure programs across consumer IoT companies. The study found that 90% of consumer IoT
companies did not have a formal vulnerability disclosure process in place [13]. This
means that security researchers have not pre-defined method of communicating bugs
and vulnerabilities found in those company’s products. A vulnerability disclosure
process establishes formal procedures for accepting inputs from external sources.
Make sure to provide a Pretty Good Privacy (PGP) public key on your organization’s
website to support encrypted submissions.
The security research community has led the creation of a grassroots vulnerability research function. Researchers across the globe are constantly analyzing
products to identify new vulnerabilities. As a developer of IoT products and systems,