NIST gives agencies new guidance to prepare for next SolarWinds-like hack
Summary
The National Institute of Standards and Technology on Thursday published updated guidance meant to help agencies and organizations protect against cyberthreats in the supply chain, a major focus of the Biden administration’s cybersecurity executive order last year. The revised publication on cybersecurity supply chain risk management gives acquirers and users of software and other technologies key practices, processes and controls to consider as they look to protect against such threats that can emerge from that tangled web of global suppliers and manufacturers from which companies develop technology products. “Managing the cybersecurity of the supply chain is a need that is here to stay,” NIST’s Jon Boyens, one of the publication’s authors, said in a statement. “If your agency or organization hasn’t started on it, this is a comprehensive tool that can take you from crawl to walk to run, and it can help you do so immediately.” President Biden’s May 2021 cybersecurity executive order required NIST to issue updated guidance within a year in response to the increase in cyber risks and incidents occurring throughout the software and IT supply chain. For instance, with the notorious late 2020 breach involving SolarWinds’ Orion product, Russian hackers embedded malicious code at the source of the SolarWinds software and then moved upstream to gain potential access to 18,000 customers’ networks, including those of numerous federal agencies.