digest
Short Summary
Main recommendation: Block hardware-based supply chain attacks through prevention, not just detection, because the video frames prevention as the best way to stop hackers who "wait with a lot of patience for the mistake they make." The interviewee, Tamir Pardo, a former Mossad director and chairman of Sepio, argues that supply chain attacks are a global strategic threat that affects every network user, from small offices to state agencies. He also says Sepio is the only company he knows that can solve this kind of problem.
Key Points
- Supply chain attacks began as a state tactic, planting malicious components in peripherals such as keyboards, mice, and servers, and in the last six or seven years criminal gangs have started using the same capabilities.
- Attacks can be carried out by a man in the middle or by supplying the compromised components themselves.
- Hacker methods keep evolving, so blocking one attack vector can be quickly followed by a new one, which Pardo calls "an endless game."
- Pardo says the public hears little about hardware attacks because less than one percent are published; he adds that without a solution like Sepio's, victims cannot solve the problem and so keep quiet to limit damage to their companies.
- He explains that because networks are interconnected in a "global village," a compromised supplier or subcontractor becomes a gateway to other networks, which is why victims often cover up incidents rather than report them.
Details Worth Noting
- Concrete instructions: Prevent hardware-based attacks by using capabilities that block them, which Pardo says every network user should do, including small law offices and industry as well as state agencies. Avoid buying goods from vendors you believe could be used to plant a "silent enemy" in your networks, which he says is an obvious step if you are under attack or fear a country could cause harm. Plan new security goals precisely, and before launching a company, prepare a proper business plan, since he says many young startups with brilliant solutions fail without one.
- Pardo says some countries have banned devices from identified vendors. He says this is easy for powerful states to do and that such a ban is justified when a manufacturer could build control or a delayed-trigger attack into products sold to another country.
- He says the hardware threat has changed from simple malware used by all kinds of attackers to new opportunities for damage or intelligence gathering on rivals.
- Pardo's suggested sales pitch centers on Sepio's solution, which he describes as the only available answer to this type of hardware attack.
Bottom Line
Pardo's core message is that hardware supply chain attacks are a growing threat that organizations of every size should address through prevention. Note that his endorsement of Sepio and the claim that it is the only solution come from his own position as chairman of that company and are not independently verified in the transcript.
