Episode 208: Getting Serious about Hardware Supply Chains with Goldman Sachs’ Michael Mattioli

In this week’s Security Ledger Podcast, sponsored by Trusted Computing Group, we’re talking about securing the hardware supply chain. We’re joined by Michael Mattioli, a Vice President at Goldman Sachs who heads up that organization’s hardware supply chain security program. When we think about cyber threats to the hardware supply chain, we often think about defense contractors making missiles and fighter jets. But these days, hardware supply chain security affects a wide range of companies – not just technology giants like Intel or cloud computing providers like Amazon and Google, but banks and financial services companies, healthcare companies, consumer electronics firms and more.  Despite media attention to the problem, the awareness of hardware supply chain risks is still low within companies. Tools and talent to address it are hard to find and expensive. What’s a company to do? Hardware Supply Chain Is Everyone’s Problem In this episode of the Podcast we welcome Michael Mattioli into the Security Ledger studio. Michael leads the Hardware Engineering team within Goldman Sachs. There, he is responsible for the design and engineering of the firm’s digital experiences and technologies. He is also responsible for the overall strategy and execution of hardware innovation both within the firm and within the broader technology industry. Michael Mattioli Michael is a Vice President and leads the hardware engineering team at Goldman Sachs. “Grandma deserves to know that her iPhone is genuine in the way that a corporation deserves to know if their $30,000 server is genuine.”Michael Mattioli, Goldman Sachs Michael is the author of a paper Consumer Exposure to Counterfeit Hardware. In it, he notes that many of the methods used to ensure hardware supply chain integrity are fallible. Visual inspection of installed parts or open source research on sellers don’t scale and are unreliable. He’s trying to sound the alarm about the threat that hardware supply chain insecurity poses to our entire economy. TCG Tackles Hardware Supply Chain Michael’s part of a new working group at Trusted Computing Group and the GSA that is working to develop standards based technology and tools to enforce hardware integrity at scale. In this interview, Michael and I talk about the growing risk of hardware supply chain risk and the need for coordination throughout the industry to address hardware security threats.Goldman Sachs joined the TCG in February as it looks for partners in securing FinTech, where activities like mobile transactions are growing by leaps and bounds.    To start off, I asked Michael to describe the work he does at Goldman Sachs and why a financial services company employs a hardware security expert. Download the MP3