Supply Chain Cybersecurity: A Linear Optimization Model

This chapter presents a mixed integer linear programming formulation for optimization of cybersecurity investment in the global supply chains. Using a recursive linearization procedure, a complex nonlinear stochastic combinatorial optimization model with a classical exponential function of breach probability is transformed into its linear equivalent. The obtained linear optimization model is capable of selecting optimal portfolio of security controls to minimize cybersecurity investment and expected cost of losses from security breaches in a supply chain. The new efficiency measures of cybersecurity investment are introduced: cybersecurity value and cybersecurity ratio. In addition, the proposed linear model has been enhanced for the Hurwicz-type, best-worst criterion to minimize a convex combination of the minimal and the maximal supply chain node vulnerability, under limited budget. The resulting compromise cybersecurity investment aims at balancing vulnerability across the entire supply chain, independent of cyberattack probabilities and potential losses by security breaches, thereby hardening the weaker critical nodes. The findings indicate a crucial role of intrinsic vulnerability, determined by the architecture of supply chain information system and highlight “design for cybersecurity” as an important emerging area of research.