Suppliers are the number one risk, but reducing attacks requires industry-wide collaboration.
Semiconductor manufacturers are wrestling with how to secure a highly specialized and diverse global supply chain, particularly as the value of their IP and their dependence upon software increases — along with the sophistication and resources of the attackers.
Where methodologies and standards do exist for security, they often are confusing, cumbersome, and incomplete. There are plenty of gaps, particularly among some of the smaller suppliers of IP, equipment, and materials, where security remains primitive at best. This is partly due to the fact that in the past, much of the focus was on vulnerabilities in chips and chipmakers. But there is an increasingly high level of interdependency between companies in the semiconductor industry. The number of interactions is growing as complexity increases, and as chip designs become increasingly heterogeneous. The weakest link puts the whole supply chain at risk, and it’s estimated that more than 50% of security threats are introduced by suppliers.
Manufacturing is a particularly high-value target, where stolen data can be used to jump start competition in highly complex technology. Even when attacks are successfully blocked, any breaches or inroads made by the attackers can increase delivery times, and they add costs for investigating the cause of the breach and the required remediation. They also are embarrassing for the victims of those attacks, which need to explain to customers and regulators what went wrong, when it happened, and what, if any action, was taken.
The industry is well aware of the widening threat landscape. Collaboration was a major theme at the Cyber Security Forum during this year’s SEMICON West. Heads of security at Intel, TSMC, Applied Materials, ASML, Lam Research, and PEER Group all pointed to the need for securing interactions between industry stakeholders, as well as security standards and processes that prevent data breaches and leakage — but without making security so burdensome that it gets in the way of doing business.
Security remains a challenge for every facet of technology, and it becomes more challenging as more processes and equipment are connected to the internet and to each other. No security is perfect, and no one solution is sufficient. Good security is a process, and requires a secure-by-design attitude, as well as resilience throughout the supply chain. As vulnerabilities arise, they need to be evaluated and addressed.
At SEMICON, several chief information security officers (CISOs) pointed out that some 60% to 90% of impactful security issues were introduced by a supplier.
Vulnerabilities, barriers, solutions
Successful breaches can have widespread effects. They can delay shipments, leak IP, and cause operational downtime. They also can result in infected products and impact a company’s brand.
Sharing data in the cloud or by other means, and the rapid adoption of smart manufacturing, have only increased awareness of the risks. Joon Ahn, vice president in IT division at Amkor Technology summarized the security gaps to be considered:
Threats can come from many directions, and they can target everything from IT to facilities to operational technology.
Robert Ivester, senior advisor for semiconductor engagement at the National Institute of Standards and Technology (NIST), pointed out in his description of operational technology that manufacturers and their supply chains increasingly depend on a broad range of programmable systems and devices that interact with the physical environment. That includes industrial control systems and building management systems.
Facilities, meanwhile, involve more than just a building. “We talk about facilities security because a machine cannot run without power, chemicals, gases, and also waste process management,” said James Tu, head of corporate information security at TSMC. “Facility security is critical to meet because it’s a safety issue. We focus on a combination of the facility security and infrastructure security.”
Others agree. “To address these security gaps several steps can be taken, such as conducting risk assessments, training employees, and implementing physical security measures,” said Amkor’s Ahn.
For software, achieving compliance requires understanding your footprint and building a sustainable security approach. “When we deliver software to different factories, there’s sometimes a special version or a special requirement,” said Mike Kropp, president and CEO of PEER Group. “So we actually have different personalities of our software. We need to think about how we can keep compliance. Maybe in those million lines of code that are on a piece of equipment there’s something that shouldn’t be there.”
Kropp explained that the key is understanding your footprint and then building repeatable processes around it. That footprint includes the number of employees with access to software IP (200), the number of customer factories (120+) and the associated equipment (> 4,000). For PEER Group’s wafer handling software, he said the installed base has more than 90,000 connections. But understanding your footprint also means understanding the number of operating systems your software needs to support, which in PEER Group’s case is dozens, and identifying the third-party libraries your software relies upon, which is 130.
Monitoring security is an ongoing process, but it needs to be as automated as possible and built into the development process.
“We are delivering to the best of our knowledge secure software,” Kropp said. “If a vulnerability is detected in our own software, we’re going to treat it like a defect. We’re going to assign a work item with a severity level and put that on the content developer’s work list. If we do this at the end of the process, it’s too late. This has to happen as part of our development environment. We changed our way of doing business to meet security as a routine way of operation.”
Fig. 1: Example of a software vulnerability process. Source: PEER Group
Data sharing and security is always a concern. “In addition to physical security, cloud information security has become an issue in our path toward the autonomous smart factory, especially when we try to embrace generative AI,” said James Lin, deputy division director for smart manufacturing at UMC. “Training the state-of-the-art generative AI models requires sensitive enterprise data in a big GPU environment. If we want to leverage an enterprise cloud solution, the highest level of information security certification is an absolute must.”
Generative AI is a new threat to securing data because of its ability to intelligently link together bits of data rather than trying to grab all of it in one place. According to one report, engineers used ChatGPT technology to optimize test sequences to identify faults in chips, and in a separate incident, to convert meeting notes into a presentation. In both cases, sensitive information was shared outside the company. [1]
The cloud itself includes state-of-the-art security, but that’s not the whole picture. “Most fabs will say data security (cloud versus on-prem) is the biggest issue. I believe that cloud data security by the big providers (AWS/Azure etc.) is more secure than any on-prem environment today,” said David Park, vice president of marketing at Tignis. “The biggest issue is not outside hacking, but improper credentialing of users. If you inappropriately give access to an employee, that is just as bad as allowing a hacker to breach your security. Internal security and permissions will be a big issue as smart manufacturing becomes the norm.”
Data in motion to and from the cloud, and data and software shared between different companies or offices, may be much less secure. And while encryption is the standard way of protecting such data, that doesn’t work across a complex supply chain because most companies block incoming encrypted data and software.
“Today in many ways we are not aligned with our business, particularly when it comes to our data,” observed Jason Callahan, vice president and chief information security officer at Lam Research. “We are operating from the zero-trust point of view. But we all share intellectual property. So obviously, there’s a lot of trust going on. We’ve been working with our suppliers and others to share information in an effective manner. From a network concept, we ran into the roadblock. Fundamentally, we as security people don’t trust encryption. I found that everybody was blocking encryption coming into their environment. If you’re a networking person, encryption can be bad. And fundamentally, this is our biggest weakness. We denied encryption, which is shocking to me because we’re the people that forced everybody to encrypt everything inside.”
There are three traditional concerns with encryption. First, it could contain malware or cause a breach, and there is no way of knowing that until it is decrypted. Second, it could conceal a mechanism for exfiltrating data. And third, it could hinder legal forensics or discovery in legal disputes.
Callahan disputed all of these concerns, noting that everyone has defense-in-depth as a cornerstone of their security program, including anti-virus software and endpoint detection and response (EDR) to detect malware and breaches. Data exfiltration is an insider risk issue, and companies have tools and systems in place to address it. Concerns related to legal forensics or discovery are a corner case. Allowing encryption on intellectual property to maintain safe transfer is far more important.
Supplier management for security
All the CISOs agreed that managing the security across the supply chain is absolutely necessary. However, this is easier said than done. The number of suppliers is huge, which makes this an immense challenge.
For a software supplier, this includes third-party libraries. For equipment suppliers, it’s component suppliers. And for factories, it’s manufacturing equipment, materials, software suppliers, and computer hardware. For example, Aernout Reijmer, CISO at ASML, said the company’s equipment consists of about 380,000 components provided by about 5,000 suppliers.
TSMC and ASML, among others, set up educational training for their suppliers. They also have set up alerts, which helps support smaller suppliers that often don’t have a large security group.
Standards
The NIST Cybersecurity framework [2] provides guidance for setting up organizations’ own practices. There also are several ISO standards (e.g., ISO 17001, 27110), but they focus on information security. In addition, these general standards do not readily apply to a complex factory setting in which external equipment is installed.
Fabs, in particular, include a combination of high-value targets, high complexity, along with a historical reluctance to update factory equipment. That combination makes fabs and foundries especially vulnerable to security issues, prompting SEMI members in Taiwan and North America to drive industry-specific standards related to equipment. Two SEMI tasks forces defined factory equipment security — E187 (Taiwan) and E188 (North America). Included in those standards:
SEMI E187: Cybersecurity for Fab Equipment
SEMI E188: Malware Free Equipment Integration
“The two standards are complementary,” said Doug Suerich, director of marketing at PEER Group. “SEMI E187 is about ensuring that equipment is designed and configured to a baseline level of security and maintainability when it first appears at the factory. SEMI E188 goes deeper on a subset of topics from SEMI E187 — specifically, providing requirements around reducing the risk of introducing malware to the factory during equipment installation and follow-up field support. The standards teams will work on expanding even further on different SEMI E187 topics.”
These standards are being rolled out, and manufacturers are requiring it for newly installed equipment.
Assessments
Security assessments are used to understand a supplier’s security level. The results can be used to influence purchases and to identify improvements at suppliers. TSMC’s Tu pointed to his company’s process for scoring a supplier, which includes a third-party online assessment and a self-assessment of 135 questions covering the following areas:
All major semiconductor manufacturers are performing as well as they need to and filling out assessments for their customers. But requiring that each company have its own assessment bogs down the whole industry. “We overload the industry with all kinds of security assessments,” said ASML’s Reijmer. “We haven’t got an idea what we already are rolling out within our supply chain. If we over-complicate it, if we over-engineer it, then we’re not going to get to work on solutions.”
Others agree. “I’ve got 15 people doing this full time, and they answered questions so I can sell my product,” said Brent Conran, Intel’s CISO. “What if I put that labor into actually doing cybersecurity? Isn’t that a better way? Everyone should consider that what was done in the last 20 years may not be sufficient because we’re so digital and because it’s moving so fast.”
Also, assessments are missing key attributes related to recovery and resilience. “There is no correlation between our efforts and the risk reduction,” said Kannan Perumal, CISO at Applied Materials. “We have a lot of things to help address this problem, but we are still struggling because we have so many suppliers and we can only do so much with available resources.”
Perumal pointed to the lack of standards for semiconductor supply chain cyber-risk assessment. As a result, every company has its own assessment performed by their supplier’s security team (if they have a dedicated team), which makes it a resource-intensive task. In addition, assessments don’t focus on all the things that matter, such as recovery and resilience.
Like the semiconductor industry, automotive also has a large set of suppliers to manage. Perumal examined how the two industries address security. The comparison confirms what several CISO’s highlighted — the chip industry needs an efficient framework, common criteria, and a third-party certification group to manage the process.
Fig. 2: Supply chain cybersecurity risk management comparisons. Source: K. Perumal, Applied Materials
Calling for collaboration
For the semiconductor industry, protections beyond the corporate boundary are necessary because of the deep interdependencies. With a complex operation and many entry points for security issues, working together is required to make it effective and economical. As Intel’s Conran aptly said, “We can’t do this alone. It’s going to take all of us to come together to work through the supply chain and understand many of the things we have to do in order to keep this machine going.”
Moving forward on cybersecurity collaboration involves not only agreeing to standards and an industry accepted assessment process for suppliers. It also requires joining the expertise across the major semiconductor factories and equipment suppliers. By doing so, the industry can learn as fast as possible to address the common threats. To enable this level of collaboration, SEMI is forming the Cyber Security Consortium.
— Susan Rambo contributed to this story.
References
Related Reading
Security Becomes Much Bigger Issue For AI/ML Chips, Tools
Lack of standards, changing algorithms and architectures, and ill-defined metrics open the door for foul play.
Chiplet Security Risks Underestimated
The magnitude of the security challenges for commercial chiplets is daunting.
 |
 |
 |
 |
 |
 |
 |  |
Leave a Reply