Welcome to part 3 of our video series on cyber security.
So far, we discussed the perspective of operators of critical infrastructures and their ISMS.
But how are suppliers to critical infrastructures affected?
We will illustrate this by following the steps of the ISMS again.
Step #1: Suppliers love to deliver...
...products, systems, documentation, and services for cybersecurity.
Step #2: Suppliers create inventories, covering...
...all datapoints, logic functions and communication interfaces of their products.
An example scenario:
Imagine that you own a gorgeous, brand-new car.
After 25,000km you receive an invitation for an inspection.
So you go.
You enter the car, check the date, switch on the radio. You are reminded to use the seat belt.
Because the outside temperature is low, you switch on the seat heating.
But here comes the cybersecurity aspect:
A car includes a large amount of information and communication interfaces.
It knows the current date and your name, ...
...and there is a sensor in the seat tracking your body weight over time.
Also, outside temperature + seat heating may help to deduce the condition of your lumbar spine.
All that is possible. But we don't know if it is really happening...
...unless documentation tells us.
Complete datapoint lists, communication functions, interfaces and...
...options of their deactivation.
This means cybersecurity in a car, and it illustrates what an inventory actually is:
An inventory is a documentation of the contained information, communication interfaces and the options to deactivate them.
Step #3: Suppliers help to identify the risks.
We suppliers know the vulnerabilities of our products.
So we can name and categorize the corresponding risks. That helps our customers to establish their ISMS.
We know how to attack our own equipment.
But the cybersecurity risks of a critical infrastructure depend on the operation and can only be managed by the operator.
Step #4: Suppliers can help to quantify the operational risks coming with their products and systems.
Step #5: Evaluated risks lead to security measures, such as...
Measure #1: Awareness training
Imagine a visitor leaving an attractive USB stick in your office.
This USB stick should not be used in your daily business.
Awareness trainings can be procured by suppliers.
Measure #2: Vulnerability notifications
Suppliers must monitor their own products for recently discovered vulnerabilities.
Only then can they notify customers and explain the newly detected risks.
Measure #3: Patch management
Knowing vulnerabilities allows suppliers to create and deliver patches.
Measure #4: Security-related refurbishments
Refurbishment projects offer many options, from steel doors to sophisticated cybersecurity functions.
Don't forget that cybersecurity lives in processes, products, systems, training, documentation and refurbishments and notifications...
between operators of critical infrastructures, their suppliers and...
...their sub-suppliers.