DHS official stresses cybersecurity is industry's responsibility

Contractors that fail to live up to security requirements in federal technology contracts should be held accountable, even if the vulnerabilities originated in products or capabilities provided by suppliers, a top Homeland Security Department official said.

In most business situations, "if we have a contractual arrangement and you fail [to meet the requirements], I have legal recourse," said Richard Marshall, director of global cybersecurity management at DHS. "Why wouldn't the same be true when the supply chain [is involved]? I'm buying a product from you, and you represent that it's a product with the following characteristics. If you fail, I have a right to sue you." He noted a number of examples where failures in the supply chain led to serious security implications, including a wave of hard drives infected with viruses that infiltrated the U.S. market from Asia in 2007 and a recent case in which thumb drives were shipped preinstalled with malicious software, eventually leading to the Defense Department imposing a temporary ban on the storage devices. "Buy from an authorized vendor and make sure that vendor has purchased from an authorized vendor," Marshall advised.