Supply chain security: threats, defences and risk assessment methodology

Abstract

Global supply chains have become increasingly complex, with a large number of companies spanning multiple tiers. This complexity makes it difficult for enterprises to have full visibility into their supplier networks, leaving them vulnerable to cyberattacks. To target a specific company, attackers often exploit the weaker cybersecurity measures of its suppliers, using a compromised supplier as a stepping stone to reach the intended target. This cyberattack strategy, known as a supply chain attack, has seen a significant rise in recent years. To protect entire supply chains, each organisation needs to understand the threats, assess the interconnected supply chain risk, and implement appropriate mitigation strategies.

This thesis directly addresses this need by developing and validating a simplified risk assessment approach tailored to organisations with limited resources, specifically focusing on the unique challenges of supply chain security. We first analyse supply chain security threats, providing a comprehensive overview of threats and attacks for various types of supply chains, including digital, food, and pharmaceutical. Our analysis reveals that current cybersecurity solutions often lack broad security analysis and fail to provide extensive protection against cyberattacks. Therefore, we develop a novel cybersecurity risk assessment methodology tailored for companies with limited cybersecurity expertise and resources. The methodology involves a questionnaire-based approach to capture the perceived likelihood and impact of supplier-related cyber vulnerabilities and threats targeting specific organisational assets. It then utilises a systematic method to compute cybersecurity risk scores for each identified threat, enabling prioritisation of mitigation efforts. Moreover, the methodology was then implemented in a free web-based software application called Securechains to enhance its accessibility for organisations with limited resources. Additionally, recognising the heightened vulnerability of software supply chains, we extended our research to conduct a thorough analysis of attacks targeting this specific domain, encompassing common attack methods, recent trends, and the specific risks associated with open-source and third-party software components. This thesis aims to provide organisations with the knowledge and tools needed to better understand, assess, and mitigate the evolving cybersecurity risks to supply chain security, ultimately strengthening the resilience of global supply chains.

More information

Identifiers

ORCID for Betul Gokkaya: orcid.org/0009-0009-3632-9768

ORCID for Basel Halak: orcid.org/0000-0003-3470-7226

ORCID for Erisa Karafili: orcid.org/0000-0002-8250-4389

ORCID for Leonardo Aniello: orcid.org/0000-0003-2886-8445

Catalogue record

Export record