Information security in networked supply chains: impact of network vulnerability and supply chain integration on incentives to invest

Abstract

Recent supply chain reengineering efforts have focused on integrating firms' production, inventory and replenishment activities with the help of communication networks. While communication networks and supply chain integration facilitate optimization of traditional supply chain functions, they also exacerbate the information security risk: communication networks propagate security breaches from one firm to another, and supply chain integration causes breach on one firm to affect other firms in the supply chain. We study the impact of network security vulnerability and supply chain integration on firms' incentives to invest in information security. We find that even though an increase in either the degree of network vulnerability or the degree of supply chain integration increases the security risk, they have different impacts on firms' incentives to invest in security. If the degree of supply chain integration is low, then an increase in network vulnerability induces firms to reduce, rather than increase, their security investments. A sufficiently high degree of supply chain integration alters the impact of network vulnerability into one in which firms have an incentive to increase their investments when the network vulnerability is higher. Though an increase in the degree of supply integration enhances firms' incentives to invest in security, private provisioning for security always results in a less than socially optimal security level. A liability mechanism that makes the responsible party partially compensate for the other party's loss induces each firm to invest at the socially optimal level. If firms choose the degree of integration, in addition to security investment, then firms may choose a higher degree of integration when they decide individually than when they decide jointly, suggesting an even greater security risk to the supply chain.

Managing cyber risk in supply chains: a review and research agenda

“…Recent research has suggested several dimensions that have a substantial influence on a SC's vulnerability to cyber risk. These include different network configurations (Bandyopadhyay et al, 2010;Zhang et al, 2012), firm sizes (Tran et al, 2016), corporate cultures (Xue et al, 2013), industry sectors (Sharma and Routroy, 2016;Tran et al, 2016) and business principles (Durowoju et al, 2012;Charitoudi and Blyth, 2014). This research found that most studies take a generic perspective, and therefore, this study pinpoints the need for contextualised studies that address such dimensions in-depth to relate specific cyber risks to specific dimensions.…”

“…Smith et al (2007) recommend that SC integration, by aligning systems and processes, will yield better returns through standardised ways of working, shared security objectives and better general communication (see conceptual model, Figure 10). Bandyopadhyay et al (2010) argue that higher levels of integration and collaboration reduce free-riding behaviour when considering investment in cyber security.…”

Finding the Weakest Link in the Interdependent Security Chain Using the Analytic Hierarchy Process

“…For example, the well know Electronic Data Interchange (EDI) and the more recent Continuous Replenishment Program that link manufacturers, distributors, and retailers within a supply chain [15].…”

Information Security Risks in Supply Chain Management:

“…Nevertheless, better interconnection does not come without risks. Modern IT has eliminated security barriers around resources and systems thus, given supply chains more opportunities to achieve better profitability and customer satisfaction by reducing production and inventory wastes (Svensson 2002) while on the contrary, put them into a higher possibility of disruption (Smith et al 2007;Bandyopadhyay et al 2010;Kerschbaum et al 2011). An organisation loses private information related to its supply chain can negatively impact future contractual decisions of its partners.…”