Group aims to draw the line on counterfeit IT
Connecting state and local government leaders
The Open Group's standard could help government ensure that COTS products do not contain backdoors or counterfeit components.
An international industry consortium has released a standard for certifying trusted partners in the global IT supply chain, a set of best practices that could help agencies ensure that commercial products do not contain backdoors or counterfeit components.
The Open Group, an industry standards development organization, spent several years identifying and compiling the standards in cooperation with several U.S. agencies.
“The federal government is very concerned about products that could have tainted or maliciously inserted components,” said Andras Szakal, chief technology officer of IBM U.S. Federal and a member of The Open Group’s Trusted Technology Forum. “We’ve had quite a few incidents in the military market where contactors acquired a product and inserted it into a solution,” only to find that it failed earlier than expected because it was counterfeit.
Some examples include counterfeit parts found on Air Force aircraft made by Boeing, Lockheed Martin and L-3, non-functioning memory chips installed within the missile defense system, and bogus Cisco routers slated for government offices.
The standard provides criteria based on industry best practices, Szakal said. “The goal is to make the best practices common practices across industry.”
Agencies actively participating in the project include the Defense Department and NASA.
Work on the Open Trusted Technology Provider Standard (O-TTPS) began in 2009 with a meeting of government and industry representatives, said Sally Long, director of the forum. “Government came to us and asked, ‘How do we know what businesses can be trusted?’” she said. They wanted a formal process to identify trusted providers of IT products and components.
Although the first version of O-TTPS has been published and is available, the accreditation program for vendors still is in a pilot phase. The Open Group expects to authorize third-party laboratories to perform accreditation of vendors. Long said she expects accreditation to begin within a year.
Government concern about the trustworthiness of supply chains has increased in recent years because of the twin trends toward use of off-the-shelf IT products by agencies and outsourcing by vendors to foreign suppliers.
“Today, nothing is created entirely in-house,” Long said.
“It is completely unrealistic in today’s environment that you are going to see U.S.-only products,” Szakal said.
Supply chain concerns were highlighted by the recent investigation by the House Permanent Select Intelligence Committee of two leading Chinese telecom manufacturers that concluded that “the risks associated with Huawei’s and ZTE’s provision of equipment to U.S. critical infrastructure could undermine core U.S. national-security interests.”
Because of the companies’ ties to the Chinese government and lack of transparency, the report recommended that neither agencies nor contractors working on sensitive programs should include Huawei or ZTE equipment or components in their systems.
The new standard could help provide a scheme for identifying trusted vendors. Fiona Pattinson, director of business development and strategy for atsec information security and a forum member, said the standard focuses on company policies and processes and that accreditation also would include spot-checks of products. It codifies best practices across the product lifecycle, including the design, sourcing, build, fulfillment, distribution, sustainment, and disposal phases.
The Open Group also works with the International Standards Organization, which develops and publishes internationally recognized standards, and is considering submitting O-TTPS for formal recognition. It also is working with the National Information Assurance Partnership, which oversees government Common Criteria evaluation, to help ensure that the standard is compatible with Common Criteria.
The two are different animals, Pattinson said. Common Criteria evaluates products, not processes. “They give very different assurances, but they fit together quite well,” she said. “This standard will harmonize with Common Criteria.”
NEXT STORY: 6 steps to secure systems for sequester