Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials

Abstract

The evolution of cyber‐physical infrastructure has made its security more challenging. The last few years have witnessed a convergence of hardware and software segments in various domains, including operational technology (OT) which is responsible for carrying out critical tasks such as monitoring and controlling power grids, nuclear plants, transportation, and emergency services. Both hardware and software encapsulate numerous open source and proprietary subcomponents, making it crucial for end‐users to understand the composition of the products they are using. For example, wind turbines incorporate thousands of lines of code (software) used for the turbine's design, planning, operation, and analytics in addition to the numerous hardware subcomponents that construct it. Due to the highly complex nature of software and hardware, knowledge of the components and subcomponents is required to mitigate cyber vulnerabilities and to defend against cyberattacks. There has also been a transformation from a traditional linear supply chain into a global, dynamic, diverse, and interconnected system. The digitization of the supply chain makes it easier to find and exploit vulnerabilities. Critical infrastructures (e.g., power grids, oil, natural gas, water, and wastewater) rely on OT to function, and if the OT is compromised, equipment damage and potential interruption of services could result. A significant security measure to protect OT systems from disruption is to develop a supply chain bill of materials (BoM) corresponding to the software and hardware used in OT, along with attestations amongst vendors and asset owners. A supply chain BoM is a proactive way to understand the inherent vulnerabilities in the system and mitigate them in advance of being exploited. BoMs bolster the trust placed in the digital infrastructure and enhance software supply chain security by sustaining the management of component obsolescence and compliance, along with the seclusion of unsafe segments of a specific product. Adopting BoM tools is becoming increasingly important across various government sectors, as evidenced by the recent U.S. executive order on cybersecurity (NIST 2021). This paper aims to classify BoMs based on structure, functionality, component type, and architecture. The work also discusses case studies to further highlight the benefits of BoMs. In addition, it identifies missing pieces in existing BoM implementations so that future research may identify bounds on where it could expect to make improvements and directly enable researchers to identify promising areas for exploration. Further, the authors provide valuable recommendations to tool developers, researchers, and standardizing organizations (policymakers), additionally benefitting critical infrastructure owners and government executives. This aids in paving a path for future work, thereby, providing suggestions to determine a tool for consumers that best suit their needs.

Analysis of factors and solutions to poor supply chain quality in a manufacturing organisation

“…Manufacturing organisations use inventory data to make key decisions; thus, inaccurate inventory will result in supply chain decisions that are not feasible, leading to poor supply chain quality (Mashayekhy et al 2022). For instance, if a bill of materials is inaccurate, products will not be produced up to the required or agreed specifications (Arora, Wright & Garman 2022). In addition, their study added that inventory inaccuracies can lead to other supply chain issues such as longer lead time, quality problems and stockout.…”

Untitled

“…Vulnerabilities can be proactively addressed by automating supply chain security through continuous integration and delivery (CI/CD) pipelines(Koopman, 2019). Many risk-averse organizations, including governments and organizations, need a software bill of materials (SBOM) that outlines all parts to solve this(Arora et al, 2022).…”