Managing supply chain risk and disruption from IT security incidents

Abstract

Supply chain practices often put companies and their supply chains at risk. One of the most serious risks is disruptions. While many types of disruptions have been considered, little attention has been given to disruptions caused by information technology (IT) security incidents. Partner cooperation can assist in preventing or mitigating damage from IT security breaches in supply chains, where breaches can disrupt production, cause loss of essential data, and compromise confidential information. We develop a generalizable mathematical model that quantifies IT security risk in the supply chain. We then show how to find solutions for optimal risk reduction under several definitions of optimality: minimizing upstream risk, minimizing downstream risk, and minimizing global (supply chain) risk. We show how to develop curves for each of the above scenarios that indicate when extra funds should be spent on security, which security controls should be implemented, and when subsidies among partners are beneficial.

An analytical framework for supply network risk propagation: A Bayesian network approach

“…Sawik, 2013). Deane et al (2009) developed a model of risk within a supply chain by developing a mixed integer programming model in the form of a network flow problem (Deane et al, 2009). Other models have taken a more operational perspective by introducing stochastic methods in petri-net models (e.g.…”

Managing cyber risk in supply chains: a review and research agenda

“…The cyber risk of deliberate assaults falls into two categories -direct attacks and indirect attacks. The first category comprises acts such as hacking attacks (Deane et al, 2009;Khursheed et al, 2016;Sharma and Routroy, 2016;Boone, 2017), denial-of-service (Faisal et al, 2007;Deane et al, 2010) or password sniffing (Warren and Hutchinson, 2000) for financial gains. Several authors, for example, Faisal et al (2007) and Tran et al (2016), include the risks of industrial espionage or compromises to intellectual property, under direct attack.…”

“…In connection with these acts of thoughtlessness, the literature also reports incidents in which employees consciously misuse or even sabotage a company's information. For example, opportunistic misuse of confidential data (Deane et al, 2009) or a premeditated personal vendetta against an employer (Sharma and Routroy, 2016). As the employee cyber threat is internal, whether deliberate or accidental, this is termed an insider threat.…”

“…As stated in Table IV, that information sharing is one of the most severe threats to cyberspaces. This is due to the level of support required to handle large volumes of highly sensitive information, without which human errors increase (Smith et al, 2007;Deane et al, 2009;Kim and Im, 2014).…”

A Mathematical Approach to Supply Complexity Management Efficiency Evaluation for Supply Chain

“…A lot of scholars recently indicate uncertainty as a risk factor of supply chain [1,[12][13][14][15][16][17][18]. Regarding such uncertainty in supply chain, Hur et al [2] make mention of the complexity of products as a determinant factor of supply chain structure, and Kim and Ham [19] mention that the types of products, the number of distribution centers and plants, and the types of transportation vehicles are the factors to increase complexity.…”