Hardware supply-chain risks: counterfeits, tampering and firmware vulnerabilities

Hardware risk is not one problem but several, each with different causes and controls. An HBOM does not remove any of them, but it is the record that makes them measurable.

The risk landscape

NIST SP 800-161 Rev. 1 describes the problem as reduced visibility into how technology is developed and delivered, with products that may contain “malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices” ^[1]. CISA’s HBOM Framework organises the purchaser’s view into compliance, security and availability use cases ^[2]. Combining the two gives six practical risk classes.

Counterfeit parts

Counterfeits are hard to detect once installed, so controls focus on sourcing. US defence procurement sets a clear model: DFARS 252.246-7007 requires contractors to operate risk-based processes that track electronic parts from the original manufacturer to acceptance, to buy from authorised suppliers, and to report counterfeit and suspect counterfeit parts to the contracting officer and the Government-Industry Data Exchange Program ^[3]. Organisations outside defence can adopt proportionate versions of the same controls for critical assets.

Tampering and malicious functionality

Tampering can target hardware or firmware at any point between factory and rack. The practical defences are knowing what should be present and checking it. NIST SP 800-193 frames firmware resiliency as protection against unauthorised changes, detection of changes that occur, and rapid, secure recovery ^[4]. An HBOM with expected firmware versions and hashes provides the baseline for detection.

Firmware vulnerabilities

Firmware flaws are attractive because they sit beneath operating system defences. BlackLotus, a UEFI bootkit, used CVE-2022-21894 to bypass Secure Boot and, running before the OS, could interfere with BitLocker, HVCI and Microsoft Defender Antivirus ^[5]. Responding to such issues requires knowing which devices run which firmware, then correlating that with advisories and CISA’s Known Exploited Vulnerabilities catalogue ^[6]. See Firmware BOMs.

Restricted and untrusted sources

Some rules prohibit specific sources. FAR 52.204-25, implementing Section 889 of the FY2019 NDAA, prohibits US federal procurement of covered telecommunications and video surveillance equipment from named producers when used as a substantial or essential component of any system ^[7]. In India, telecom licensees must connect only trusted products, as designated under licence amendments effective 15 June 2021 ^[8]. Both require knowing who manufactured the components, not just who sold the finished product.

Availability and obsolescence

The CISA framework’s availability category covers world events, single points of failure and supply-chain clustering, with factory shutdowns during COVID-19 given as an example ^[2]. Location and alternate-source fields let purchasers see where several products depend on one facility. Obsolescence is quieter but common: components past end of support stop receiving firmware fixes. Tracking EOL dates is covered in HBOM management.

Prioritising

• Start with assets whose compromise would disable other controls: management controllers, network cores, HSMs, hypervisor hosts.
• Apply sourcing and provenance controls at procurement, where they cost least.
• Automate firmware inventory and advisory correlation across the estate.
• Reserve physical inspection and deep firmware analysis for the highest-risk supply routes.

How IntelliXBOM helps

IntelliXBOM records hardware, firmware, supplier and lifecycle data in CycloneDX or SPDX HBOMs and correlates them with vulnerabilities, known-exploited lists and EOL dates. It links devices to the business services they support, so hardware risks can be prioritised by impact, and maps the result to framework controls.