Software Transparency

CHAPTER 9Software Transparency in Operational Technology

Operational technology (OT) runs the most critical processes in the world, from missile platforms and defense missions, to water treatment plants and electric power, to critical manufacturing, airports, and more. Frequently these environments are highly isolated using air-gapped networks and may have restrictions against external connections, cloud, or mobile capabilities. Because of this, many of the techniques we rely on for software validation may not be useful here.

For instance, how does one validate the certificate revocation list (CRL) for a code-signing certificate against a signed firmware update when the Internet is not accessible? How does one look up and identify a component hash in a software bill of materials (SBOM), if it matches known malware repository entries? Do you still consider overly long expiration dates for Transport Layer Security (TLS) certificates to be an issue when you can't easily update trust information?

Additionally, when considering concerns with nation-state adversaries, many of these products are manufactured in or supported by operations in areas of the world we may consider adversarial. Topics of provenance for software become especially challenging as compliance requirements from the National Defense Authorization Act (NDAA) and various executive orders have sought to retract which nations are allowed to supply products to critical infrastructure.

For instance, in 2020, Executive ...