Examkin

Soru

Zorluk: ZorThird-Party Risk Management and Supply Chain Oversight

An enterprise organization is procuring custom network appliances from a third-party manufacturer. To mitigate the risk of hardware supply chain tampering and unauthorized firmware modification during transit, the security team must establish a verification mechanism to validate device authenticity prior to deployment. Which of the following controls provides the MOST effective verification of hardware and firmware integrity upon receipt?

  1. Verifying the hardware root of trust and cryptographic signatures against the vendor's published measurements alongside a signed Software Bill of Materials (SBOM)Cevap
  2. B
    Requiring the third-party manufacturer to provide an annual SOC 2 Type II audit report certifying their physical facility security controls
  3. C
    Executing an Interconnection Security Agreement (ISA) and Non-Disclosure Agreement (NDA) with the logistics provider delivering the hardware
  4. D
    Placing the newly received network appliances into an isolated VLAN behind an inline Web Application Firewall (WAF) during initial staging

Cevap

Verifying the hardware root of trust and cryptographic signatures against the vendor's published measurements alongside a signed Software Bill of Materials (SBOM)
The correct answer provides cryptographic proof of hardware and firmware authenticity. A hardware root of trust (such as a Trusted Platform Module) combined with cryptographic signature verification against a vendor-provided Software Bill of Materials (SBOM) allows the receiving organization to detect unauthorized hardware additions, firmware alterations, or supply chain interdiction prior to connecting the device to the production environment.

Adım Adım Çözüm

1
Analyze the threat context in the scenario
Identified supply chain tampering and unauthorized firmware modification during transit as the primary risks.
Supply chain security requires direct verification of physical and logical components prior to commissioning.
2
Evaluate potential control mechanisms for hardware/firmware integrity
Determined that technical validation using hardware roots of trust (e.g., TPM/Secure Boot hashes) and signed SBOMs ensures components match expected vendor baselines.
Cryptographic attestations provide tamper-evident proof of component authenticity.
3
Differentiate technical integrity verification from administrative attestations and perimeter defenses
Ruled out SOC 2 reports, NDAs/ISAs, and WAF network controls as ineffective for detecting physical supply chain tampering prior to deployment.
Administrative reports and network firewalls do not inspect or validate hardware microcode or device component supply chain integrity.

Anahtar Kavram

Supply Chain Security and Hardware Integrity Verification
Bu soruyu puanla

Konular

Third-Party Risk Management and Supply Chain Oversight

Bu konudan daha fazla soru