<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonospacing, li.xmsonospacing, div.xmsonospacing
{mso-style-name:x_msonospacing;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xparagraph, li.xparagraph, div.xparagraph
{mso-style-name:x_paragraph;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xcontentpasted0
{mso-style-name:x_contentpasted0;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="xmsonospacing"><span style="color:black"><o:p> </o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Office of the Director of
National Intelligence (ODNI) partnered with industry and government experts under the Enduring Security Framework (ESF) to release, “</span></span><span style="color:black"><a href="https://media.defense.gov/2022/Nov/17/2003116445/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER.PDF"><span style="font-family:"Franklin Gothic Book",sans-serif">Securing
the Software Supply Chain Recommended Practices Guide for Customers</span></a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">” and accompanying
</span></span><span style="color:black"><a href="https://media.defense.gov/2022/Nov/17/2003116444/-1/-1/1/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER_SLICKSHEET.PDF"><span style="font-family:"Franklin Gothic Book",sans-serif">fact sheet</span></a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">.”
</span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">In an effort to provide guidance to customers, ESF examined the events that led up to the SolarWinds attack. This examination made
clear that investment was needed to create a set of industry- and government-evaluated best practices focused on the needs of the software customer. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Historically, threat actors targeted commonly known vulnerabilities that were left unpatched. While this tactic is still used to compromise
unpatched customer systems, a new, less conspicuous method threatens software supply chains and undermines trust in systems patching themselves, something that has been critical to guarding against legacy attacks. Rather than waiting for public vulnerability
disclosures, threat actors proactively inject malicious code into products that are then legitimately distributed downstream through the global software supply chain. Over the last few years, these next-gen software supply chain compromises have significantly
increased for both open source and commercial software products. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Prevention is often seen as the responsibility of the software developer, as they are required to securely develop and deliver code,
verify third party components, and harden the build environment. Infiltration of the supplier’s network with malicious code prior to the final software product being delivered can also cause the supply chain to be compromised. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">If a software package injected with malicious code proliferates to multiple consumers, it is much more difficult to confine; it may
cause an exponentially greater impact compared to when a single customer is the target of a cyberattack. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Because of this, the customer also holds a critical responsibility in ensuring the security and integrity of software; not only do
they acquire the software, but they are also responsible for deploying it. To avoid network exploitation, they should assess threats by conducting supply chain risk management (SCRM) activities and define risk profiles during the security requirements process.
Developers and suppliers should also provide customers with guidance on how to verify the integrity of the software components. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Security is not just for the developers and suppliers, it’s for customers too. Until all stakeholders seek to mitigate concerns specific
to their area of responsibility, the software supply chain cycle will be vulnerable and at risk for potential compromise. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">This guidance for customers is the third and final segment in a three-part series on “Securing the Software Supply Chain.” Earlier
this year, ESF published the first part for developers and second for suppliers and can be found on
</span></span><span style="color:black"><a href="https://www.cisa.gov/nrmc-resources"><span style="font-family:"Franklin Gothic Book",sans-serif">NRMC Resources</span></a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">.
</span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xparagraph"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D8FA59.4BB201A0"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</body>
</html>