Supply Chain Cybersecurity: Security Controls with Maximum Cybersecurity Value

This chapter deals with optimization of cybersecurity investment in supply chains using stochastic programming approach. A classical exponential function of breach probability and the intuitive idea of the expected net benefits were applied to introduce the concept of cybersecurity value. The cybersecurity value of a security control is defined as the value gained by implementing a single control to secure a subset of components. The cybersecurity value of a control can be seen as a measure of its efficiency in reducing vulnerability of a secured system or component. A mixed binary optimization problem, next transformed into an unconstrained binary program, is developed to maximize total cybersecurity value of security control portfolio. The optimal solution to the binary program provides a simple formula to immediately obtain the portfolio of security controls with maximum total cybersecurity value and determine a rough-cut cybersecurity investment. This study also shows that portfolio of security controls with maximum total cybersecurity value reduces the losses from security breaches and mitigates the impact of cyber risk. The major decision-making insights are summarized at the end of this chapter.