An inside look at a large supply-chain security initiative

DIGITALISATION efforts in operational technology (OT) have caused a surge in cyberthreats, posing significant challenges to the security and resilience of industrial systems worldwide. As recent as March 2024, among these threats was a modification in the XZ Utils open-source software project that highlighted the risks in the supply chain and the need for a comprehensive approach to supply-chain security. The XZ Utils code was altered to incorporate a malevolent backdoor, granting attackers as much control as authorised administrators within impacted systems.

Supply-chain cybersecurity takes centre stage at Singapore’s Operational Technology Cybersecurity Expert Panel (OTCEP) forum this week (Aug 20-21), including a session where I will be giving an inside look at a large supply-chain security programme. The presentation offers a deep dive into the establishment and implementation of a thorough supply-chain security initiative, based on the example of Schneider Electric.

In the current OT landscape, characterised by escalating cyber risks and interconnectivity, this topic is relevant for industrial stakeholders and society at large in Singapore and globally. Financial losses are expected to reach US$81 billion in damages and lost revenue globally by 2026, according to Juniper Research in their May 2023 report. As supply chains continue to expand and with hacker techniques becoming more sophisticated, the resilience and security of suppliers are paramount to safeguarding critical infrastructure and ensuring the uninterrupted functioning of essential services.

Need for 360-degree vision

In its 2023 OT cybersecurity review, Dragos alerted that malicious actors such as hacker group Volt Typhoon could be capable of exfiltrating sensitive operational data related to OT networks and processes from critical infrastructures, potentially leading to widespread disruptions and risks. The realm of OT systems involves a plurality of actors with different levels of cybermaturity, which serves as a stark reminder of how vulnerabilities in the supply chain can significantly impact OT.

The risk underscores the imperative for a comprehensive approach to OT cybersecurity that encompasses the entire supply chain, from research and development and production to distribution and customer-facing activities, as illustrated by Schneider Electric’s Supply Chain Security initiative built around a 360-degree vision.

However, despite the industry’s increasing focus on cybersecurity frameworks and programmes, the efficacy of these measures is contingent upon original equipment manufacturers (OEMs) fulfilling their responsibilities. With varying regulations and standards on product security and supply-chain security globally, there are varying interpretations of the actions required. The lack of standardisation introduces complexity and inconsistency. While cybersecurity audits tend to be heavily weighted towards IT security, there remains a notable gap in adequately evaluating and monitoring product and supply-chain security, highlighting an area in need of urgent attention and alignment.

Building trust among supply chain stakeholders

At the core of Schneider Electric’s operations and collaborative engagements with partners lies an unwavering commitment to trust through transparency. This principle can serve as the cornerstone of the concerted efforts of stakeholders from diverse backgrounds to comprehend and surmount the challenges that increasingly impact the entire supply chain.

For all stakeholders within the value chain, fostering relationships among suppliers, partners, customers, and regulatory bodies is pivotal, and maintaining trust through transparency is a key part of this process. Each stakeholder can demonstrate their commitment to transparency by providing tangible evidence of their practices, conducting supply-chain audits, offering product attestations, and other definitive indicators of trustworthiness. For instance, an organisation can implement or externally obtain certifications to ensure that customer-facing personnel are adequately trained and equipped with secure tools and software during customer interactions.

The Cyber Security Agency of Singapore’s (CSA) Cybersecurity Labelling Scheme equips consumers with a straightforward means to gauge the security levels of smart devices, offering transparency and bolstering trust in an era marked by escalating digitalisation. These initiatives collectively exemplify the imperative of trust through collaborative cybersecurity endeavours amid an evolving landscape.

Public-private partnerships

Working together, we can forge a secure OT cyber environment.

Global entities, including CSA, are prioritising supply-chain security for its critical role in OT cybersecurity, as seen in Singapore’s updated OT Cybersecurity Masterplan 2024. This plan was shaped by inputs from a wide range of OT cybersecurity ecosystem stakeholders, including government, academia, OEMs, vendors, and professionals. Their involvement aims to ensure commitment to implementing supply-chain security requirements, emphasising the importance of public-private partnerships and leveraging insights from sector leaders to boost localised OT cybersecurity.

Industry leaders and government authorities are uniting through public-private partnerships to tackle supply-chain cybersecurity challenges globally.

The US Department Of Energy’s (DOE) Cyber Testing for Resilient Industrial Control Systems programme, with contributions from OEMs such as Schneider Electric, exemplifies this collaboration.

These efforts are further solidified by the endorsement of the DOE’s Supply Chain Cybersecurity Principles by OEMs, including GE Vernova, Honeywell, Rockwell, Siemens and Schneider Electric. These principles, rooted in standards such as the International Society of Automation’s IEC 62443 and the National Institute of Standards and Technology, define stakeholder roles within the value chain.

Such partnerships are vital for enhancing cybersecurity resilience in OT and are similar to the Singapore’s OT Cybersecurity Masterplan effort.

Collaboration needs structure to take its full significance. The OTCEP forum provides a platform for OT cybersecurity practitioners to draw upon the experiences and best practices from OTCEP members, enhancing the cyber resilience of Singapore’s OT sector.

These collaborative endeavours stress the vital role of partnerships in fortifying OT cybersecurity capabilities.

A comprehensive approach along the value chain is essential since supply chains now involve an increasing array of third-party partners. Amid the rise of disruptive technologies such as artificial intelligence or machine learning, navigating the complexities of a vast network of global suppliers is imperative to avert malicious attacks on OT systems.

Addressing cybersecurity requires a collective effort, promoting closer collaboration among authorities and private stakeholders to embrace a unified cyberposture against evolving risks. As a leader in this domain, our commitment extends to educating partners, customers, and third parties and articulating these responsibilities.

Proudly affiliated with the OTCEP Forum, I am dedicated to echoing this commitment and contributing to the cybersecurity landscape in Singapore and the Asia-Pacific. Let’s work as one team to secure our critical infrastructures and protect society as a whole.

The writer is vice-president, supply chain security at Schneider Electric. She is a speaker at the Cyber Security Agency of Singapore’s (CSA) Operational Technology Cybersecurity Expert Panel Forum 2024.