Mitigating Risks in the Commercial Microelectronics Supply Chain

Mitigating Risks in the Commercial Microelectronics Supply Chain

The Department of the Air Force reviewed the Microelectronics Quantifiable Assurance efforts by the Office of the Under Secretary of Defense for Research and Engineering, as directed by the National Defense Authorization Act of 2023. The results of the review were just released on August 3.

This review involved an independent panel of 27 experts determining the best approach to mitigate risks in the commercial microelectronics supply chain and to ensure the security and integrity of microelectronic components used in Department of Defense (DoD) systems. 

The panel pinpointed three main strategies to ensure that commercial production meets the department’s needs:

Trusted Foundry: an overlay on a commercial flow offered by GlobalFoundries that offers protection against unauthorized disclosure of classified information (including data and government intellectual property) to unauthorized persons.

International Traffic in Arms Regulations/Export Administration Regulations for export-controlled microelectronics

Microelectronics Quantifiable Assurance: an emerging data-centric approach to independently assess integrity across the microelectronics development lifecycle including design and manufacturing 

These measures aim to bridge the gap between the DoD’s unique requirements and the commercial supply chain while maintaining a consistent security posture. The study emphasized the importance of these strategies to counter security risks associated with the procurement and utilization of commercial microelectronics in defense systems.

Microelectronic components, which play crucial roles in modern defense systems, include microprocessors, field programmable gate arrays, and custom integrated circuits.

Most of the microelectronics in DoD systems are commercial off-the-shelf components, with a majority of the DoD’s purchases not made through the trusted supply chain.

Under Secretary of Defense for Acquisition and Sustainment Dr. William LaPlante commented, “To stay ahead of our competitors, it is absolutely essential that DoD is able to access the commercial supply chain of microelectronics. The independent panel’s review is helping us better understand the risk-based approach we need to take to make that happen.”

Heidi Shyu, Undersecretary of Defense for Research and Engineering, explained that their trusted suppliers in the commercial supply chain help to keep the department prepared. “Our focus must be to maintain and strengthen that support,” Shyu said. “The work of the independent panel—confirming what we need in the Department of Defense and what areas present opportunities, and gaps, for mitigation—has been an essential part in the overall Microelectronics Quantifiable Assurance effort and will inform evolving standards such as the Department of Defense Manual 5200 series.”

Dr. Victoria Coleman, Chief Scientist of the Air Force, remarked that there has been a false dichotomy between Trusted Foundry and Microelectronics Quantifiable Assurance. “While Microelectronics Quantifiable Assurance is focused on the entire lifecycle of the microelectronics and offers enhanced integrity protection, Trusted Foundry focuses exclusively on fabrication, a protection that heightens our confidence that our classified information has been protected during the commercial manufacturing of the parts we use in Department of Defense systems,” Dr. Victoria Coleman explained.

Below are the key questions addressed by the panel review:

What are the national security implications of increasing our use of commercial microelectronics fabrication flows relative to the use of Trusted Foundry flows?

Access to commercial ME is essential for obtaining performant, trustworthy, and affordable parts to create mission-capable DoD systems. Not having access threatens our national security.

What are the risks entailed?

The risks include compromise to confidentiality, integrity, and availability of function of ME devices. These risks are lower during mask and wafer fabrication and higher during design, testing, and configuration. ME is not free of risk but is not the greatest risk by far.

How can we mitigate these risks in a practical way?

Risks can be mitigated by creating a rational ME Assurance risk management regime, combining TF with MQA overlays over commercial practices, designing for assurance/defense in depth, and creating and implementing standards.

Will the risk reduction be enough?

There is no perfection but the risk can be managed to be as low as reasonably practicable.

How are we going to implement in practice a viable risk reduction regime?

By creating the ME Assurance EA, the ME Assurance Standards Board, by resourcing the ME Assurance governance appropriately, and by aligning execution of the CHIPS program with DoD needs.

—————
Boost Internet Speed–
Free Business Hosting–
Free Email Account–
Dropcatch–
Free Secure Email–
Secure Email–
Cheap VOIP Calls–
Free Hosting–
Boost Inflight Wifi–
Premium Domains–
Free Domains