IG Report Flags Widespread Gaps in DOE’s Software Supply Chain Security
When the Heartbleed bug struck federal agencies in 2014, the head of incident response for a Department of Energy contractor had a simple question: “Where are we exposed?”
See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]
The agency lacked the source code for many of its IT systems and no commercial tool could identify which devices ran the vulnerable software library. “The truth was, I had no way to answer it,” said Thomas Pace, who went on to co-found and lead supply chain security firm NetRise. Pace said he ended up reverse engineering binary code just to confirm the risk.
A decade later and supply chain visibility is still a weak point. An August report from the Energy inspector general shows that many systemic failures remain, including weaknesses in supply chain oversight, authenticity verification and vendor risk management.
Auditors found little to no progress in implementing basic supply chain risk management at multiple departmental sites, including national laboratories and contractor-operated facilities. Three locations lacked formal policies, failed to assign oversight responsibilities and had not implemented cybersecurity requirements into procurement processes, earning them the lowest possible maturity rating, “ad-hoc.”
Component authenticity controls were also either weak or nonexistent at several DOE-operated sites. One facility had anti-counterfeit policies on paper but no training in practice, while others had no detection mechanisms at all, conditions the report warns could allow counterfeit parts into DOE systems.
The audit reflects what Pace describes as a lingering blind spot across the agency: The department cannot reliably identify where it’s exposed without a comprehensive, enterprise-wide program that assesses the actual software running in devices – not just what vendors claim.
Software bills of material “generated from source code don’t solve this problem, because not only doesn’t DOE even have access to source code, in most cases SBOMs don’t reflect what’s compiled into the binary,” Pace said. The U.S. cyber defense agency in August published a draft update to its SBOM guidance, seeking public input on tooling and adoption practices aimed at turning software ingredient lists from abstract ideals into practical tools for vulnerability management, supply chain transparency and operational security (see: CISA Seeks Input on SBOM Update to Tackle Real-World Gaps).
DOE’s lack of risk assessments at several audited sites, combined with an over-reliance on self-certifications and a shortage of control policies, has left the department’s infrastructure exposed to cyberattacks. Analysts told Information Security Media Group that DOE should conduct comprehensive, program-level risk assessments that account for third party risk, geopolitical exposure and potential compromise vectors, and should strengthen oversight by implementing tracking mechanisms and vendor performance reporting based on key indicators, benchmarking and milestone reviews. The department did not respond to several requests for comment.
“For the DOE to align with federal best practices, it must swiftly and proactively pivot to embedding and operationalizing [supply chain risk management] principles as a core capability,” said April Lenhard, a cyberthreat intelligence expert and principal product manager at the security firm Qualys. “Active oversight and strategic risk planning are not optional: They’re integral to ensuring that the DOE can reliably support and protect the nation’s critical infrastructure.”
Even where policies existed, implementation was inconsistent, auditors found. The report says some facilities had not fully enacted the department’s cybersecurity supply chain risk management program, which aims to set cybersecurity standards for performance across all levels of the department with a specific focus on enhancing risk management.
The guidance aligns with the National Institute of Standards and Technology risk management framework detailed in special publication 800-37, which lays out how federal agencies should identify, assess and mitigate risk across an entire system’s life cycle. The directive forces federal organizations to treat security as a continuous process throughout the supply chain life cycle rather than a one-off compliance exercise.
Those facilities likely relied almost entirely on vendor assurances rather than independent verification, a gap auditors and analysts said significantly increases the risk of counterfeit or compromised components entering critical systems.