A methodology for cybersecurity risk assessment in supply chains

Gokkaya, Betul, Aniello, Leonardo, Karafili, Erisa and Halak, Basel (2023) A methodology for cybersecurity risk assessment in supply chains. The 4th International Workshop on Cyber-Physical Security for Critical Infrastructures Protecstion, , The Hague, Netherlands. 28 Sep - 29 Oct 2023.

Abstract

Supply chain cyberattacks are on the rise as attackers increasingly exploit the intricate network of supplier connections between companies. Critical infrastructures too have been successfully targeted using this strategy, which
calls for cybersecurity risk assessment strategies to be revised to stress the focus
on threats originating from suppliers. This work proposes a novel supply chain
cybersecurity risk assessment tailored for companies with limited cybersecurity
expertise and constrained resources to execute risk assessment. Through a set of simple questions, this methodology first captures the perceived likelihood and impact of vulnerabilities and threats that derive from suppliers and target specific organisational assets, and then generates cybersecurity risk scores for each relevant threat. A preliminary validation of the methodology is carried out, where generated risk scores are compared to evaluations provided by cybersecurity experts.

The results show that the methodology produces risk scores that on average differ by 8% from those deriving from the experts’ assessment, which corroborates the hypothesis that the methodology is reliable even though it does not require detailed information about the suppliers’ cyber posture.

This record has no associated files available for download.

Contributors

Author: Betul Gokkaya

Author: Leonardo Aniello

Author: Erisa Karafili

Author: Basel Halak

Download statistics