THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SR-11

Component Authenticity

US National Institute of Standards and Technology (NIST) · cited in 10 of our lessons

Explanation

What it asks for. The organisation must develop and implement anti-counterfeit policy and procedures to detect and prevent counterfeit components from entering the system, and report counterfeit components to the source, external reporting organisations or designated personnel.

In practice. This means buying hardware and software from authorised channels, verifying signatures and hashes on software, checking hardware provenance for critical components and having a reporting route when tampering or counterfeits are suspected. Auditors look for procurement rules, verification steps and records of any reported issues. Staff handling hardware intake should know what signs of tampering to look for.

Common gaps. Purchases through grey-market resellers or marketplaces to save cost or time bypass these checks. Software integrity verification is often skipped for updates and open source packages. Organisations seldom know where to report a suspected counterfeit.

Open SP 800-53 at NIST
The official text
a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system components to [Selection: source of counterfeit component; {{ insert: param, sr-11_odp.02 }} ; {{ insert: param, sr-11_odp.03 }} ]. Discussion: Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.