Cybersecurity in Supply Chains: Quantifying Risk. Issue 3 (4th May 2023)

• Record Type: Journal Article
• Authors: Deane, Jason; Baker, Wade; Rees, Loren
• Is Part Of: Journal of computer information systems. Volume 63:Issue 3(2023)
• Page Start: 507
• Page End: 521
• Publication Date: 2023-05-04
• Subjects: Supply chain -- risk management -- IT security breaches -- cybersecurity -- information security; Electronic data processing -- Study and teaching -- Periodicals; 658.4038011
• DOI: 10.1080/08874417.2022.2081882
• Languages: English
• ISSNs: 0887-4417

Abstract

ABSTRACT: Sharing information in a supply chain can bring benefits to many, if not all, members of the chain; however, the impact of information sharing and information technology (IT) implementation on supply chain risk is not well understood. Reports from corporate board meetings indicate that while concern is expressed over such risk, there are no accepted principles or best practices for quantification of supply chain risk. To increase understanding of cybersecurity risk in supply chains from a more grounded quantitative perspective, we identify four different ways an organization in a chain can be attacked as well as the principal factors putting that firm at risk to each of the four types of attack. Using data from detailed forensic analyses of approximately 2000 companies and/or organizations that experienced attacks, we answer fundamental, data-driven questions both external and internal to a firm belonging to a supply chain.