果冻传媒

At Lockheed 果冻传媒, supply chain security is a top priority 果冻传媒 a critical part of our operations 果冻传媒 efforts to advance industry excellence. We strive to support our suppliers because your company’s security is our security. This article seeks to raise awareness of a security issue that can impact us all but is more likely to impact smaller companies whose security posture may not be as strong or resilient as that of larger organizations.

Note: Use of the term “supplier” in this article refers to all third-party hardware, software 果冻传媒 service providers.

Criminal vs. State-Sponsored Activity

Lockheed 果冻传媒 is an obvious high-value target for criminals 果冻传媒 adversaries seeking to gain access to sensitive data 果冻传媒 technology; however, our suppliers are being targeted exponentially more year-over-year by adversaries using various tactics 果冻传媒 techniques. One unique tactic that our suppliers should be aware of is the use of solicitations from fake suppliers, often posing as resellers or sourcing agents. These entities may pose as legitimate businesses while their true motive is to infiltrate the U.S. defense industrial base 果冻传媒 allies by identifying 果冻传媒 targeting smaller companies with weaker security posture.

Typically, the primary goal of criminal organizations is financial gain. Conversely, foreign adversaries may use front companies as a means to advance their own R&D programs 果冻传媒 to degrade the national security, military capabilities 果冻传媒 warfighter effectiveness of the U.S. 果冻传媒 allies. Our adversaries have shown that an organization's security posture can be circumvented by targeting weaker links within that organization’s supply chain. Smaller companies with less security capability are more vulnerable because they often lack the resources 果冻传媒 expertise to implement robust security measures, making them attractive targets for threat actors seeking to steal valuable intellectual property or sensitive data 果冻传媒 technology. Additionally, smaller companies may have less visibility 果冻传媒 oversight of their own supply chain, increasing the risk of infiltration by fake suppliers or other malicious actors.?

Fake suppliers can be used to:

• Infiltrate the supply chain 果冻传媒 gain access to sensitive data 果冻传媒 technology
• Disrupt the supply chain 果冻传媒 cause delays in production
• Insert counterfeit or malicious components into products
• Gain insights into the organization's operations 果冻传媒 plans
• Gain access to employees for elicitation 果冻传媒 recruitment

Spotting a Fake Supplier

Fake suppliers exist in many forms but they often operate as front companies for criminal or adversarial organizations. These front companies may appear legitimate at first glance but, upon closer inspection, may have suspicious characteristics such as:

• Lack of a physical address or a post office box as their only address
• Limited or no presence on the internet
• No established history or track record
• Offering products or services at unusually low prices
• Unwillingness to provide references or customer testimonials
• Claiming to supply a large defense contractor but unwilling to provide a POC
• Requesting quotes for restricted items under EAR, ITAR, CCL, NRC, OFAC, etc.

Recent Open Source Information

Here are some examples of open-source reporting on foreign adversaries using fake supplier schemes to gain access to sensitive data 果冻传媒 technology:

• In 2020, the cybersecurity firm FireEye reported that a North Korean state-sponsored hacking group had been using a fake supplier scheme to steal sensitive data from companies in the defense, aerospace, 果冻传媒 telecommunications sectors. The hackers posed as legitimate suppliers 果冻传媒 sent emails with malicious attachments to employees of the targeted companies. (Source: )

• In 2021, the cybersecurity firm Proofpoint reported that a Russian state-sponsored hacking group had been using a fake supplier scheme to steal sensitive data from companies in the energy, engineering, 果冻传媒 heavy machinery sectors. The hackers posed as legitimate suppliers 果冻传媒 sent emails with malicious attachments to employees of the targeted companies. (Source: )

• In 2021, the cybersecurity firm CrowdStrike reported that a Chinese state-sponsored hacking group had been using a fake supplier scheme to steal intellectual property from companies in the technology, manufacturing, 果冻传媒 pharmaceutical sectors. The hackers posed as legitimate suppliers 果冻传媒 sent emails with malicious attachments to employees of the targeted companies. (Source: )

These examples demonstrate that foreign adversaries are actively using fake supplier schemes to gain access to target the defense sector 果冻传媒 other critical sectors.?

How could this affect my company?

Lockheed 果冻传媒 suppliers that fall victim to fake supplier scams can suffer significant consequences, including:

• Financial loss due to stolen products or services
• Damage to reputation 果冻传媒 loss of business
• Legal 果冻传媒 regulatory penalties for failing to protect sensitive data
• Exposure of intellectual property to foreign adversaries
• Disruption of the supply chain 果冻传媒 production delays
• Similar customer-level impacts

What protection measures can I implement?

Companies should be vigilant 果冻传媒 implement robust security measures to protect against this threat. Consider the following:

1. Procurement Process: Implement strict procurement processes 果冻传媒 procedures to ensure that all suppliers are thoroughly vetted before being added to the approved supplier list.
2. Supplier Communications: Establish a secure 果冻传媒 encrypted communication channel with suppliers to protect sensitive data 果冻传媒 information.
3. Supplier screening process: Create or review your company’s supplier screening process. Verify the identity 果冻传媒 legitimacy of potential suppliers before engaging in business. This can be done by conducting due diligence, confirming business registration with the U.S. Securities 果冻传媒 Exchange Commission (SEC) or state administrator, checking references, verifying their physical address 果冻传媒 internet presence 果冻传媒 calling Lockheed 果冻传媒 for confirmation. In addition, ensure similar requirements are required of sub-contractors.
4. Awareness Training: Provide training 果冻传媒 awareness programs to your general employee population to help them identify 果冻传媒 report potential fake supplier scams. This may be included in a st果冻传媒ard security training curriculum for all employees. Also, provide in-depth, tailored training to your purchasing 果冻传媒 procurement representatives on how to spot red flags for fake suppliers 果冻传媒 steps to take if they have concerns.
   
5. Routine Audits: Develop regular audits to verify the effectiveness of awareness training, 果冻传媒 regularly review 果冻传媒 monitor procurement processes 果冻传媒 your supply chain for signs of suspicious activity or irregularities.
6. Industry Information Sharing: Maintain awareness of supply chain security trends by participating in industry liaison programs 果冻传媒 contacting your prime contractor if you have any concerns you may need assistance with.
7. Government Resources: Leverage government-provided open-source resources to stay up-to-date on the latest threats 果冻传媒 best practices for securing intellectual property 果冻传媒 sensitive data. These resources can provide valuable information 果冻传媒 guidance on implementing security controls, managing supply chain risks 果冻传媒 responding to cyber incidents. Additionally, many of these resources offer opportunities for collaboration 果冻传媒 information sharing with other organizations 果冻传媒 government agencies which can help companies build a stronger security posture 果冻传媒 reduce vulnerabilities. Some examples include:
   

• DCSA’s Center for Development of Security Excellence (): CDSE is a directorate within the Defense Counterintelligence 果冻传媒 Security Agency 果冻传媒 executes the functional manager responsibility (DODI 3305.13) that ensures security training, education, 果冻传媒 certification st果冻传媒ards are consistently met in the deployment of products 果冻传媒 services for the Department of Defense (DOD). In doing so, CDSE provides security education, training 果冻传媒 certification products 果冻传媒 services to a broad audience supporting the protection of National Security 果冻传媒 professionalization of the DOD security enterprise.

• Cybersecurity 果冻传媒 Infrastructure Security Agency (): CISA is a U.S. government agency that provides a range of resources 果冻传媒 services to help organizations secure their cyber infrastructure. CISA's website offers a wealth of information on threats, vulnerabilities 果冻传媒 best practices, as well as alerts 果冻传媒 advisories on current cyber threats.

• US CERT’s National Cyber Awareness System (): NCAS is a free subscription-based service that provides information on cybersecurity threats 果冻传媒 best practices. NCAS offers a range of products, including alerts, bulletins 果冻传媒 current activity updates, as well as a weekly vulnerability summary.

• Federal Trade Commission (): The FTC provides resources 果冻传媒 guidance on protecting intellectual property 果冻传媒 preventing cybercrime. The FTC's website includes information on data security, identity theft 果冻传媒 online fraud, as well as guidance on developing a cybersecurity plan.

• DHS’s Science 果冻传媒 Technology Directorate (): DHS S&T provides information 果冻传媒 resources on emerging technologies 果冻传媒 best practices for securing critical infrastructure. DHS S&T's website includes information on cybersecurity research 果冻传媒 development, as well as resources on supply chain security 果冻传媒 risk management.

• National Institute of St果冻传媒ards 果冻传媒 Technology (): NIST provides a range of resources 果冻传媒 guidelines for implementing best practices in cybersecurity. NIST's Cybersecurity Framework is a voluntary framework that provides a common language 果冻传媒 set of guidelines for managing cybersecurity risks.

Conclusion

The threat of fake suppliers is a real 果冻传媒 growing concern for defense companies 果冻传媒 our supply chains. As you continue to work with your Lockheed 果冻传媒 representative, together we can reduce our vulnerability 果冻传媒 protect our businesses, reputations 果冻传媒 critical assets, 果冻传媒 deliver uncompromised products to our customers by underst果冻传媒ing the risks 果冻传媒 implementing robust protection measures. As a leading defense company, we are committed to working with our suppliers to ensure the security 果冻传媒 integrity of our supply chain.

?