Supply Chain Cybersecurity: Direct and Indirect Cyber Risks

In this chapter, a stochastic MIP (mixed integer programming) model is presented for optimization of cybersecurity investment and selection of security controls to mitigate the impact of direct and indirect (propagated) cyber risks in a supply chain. Using a recursive network transformation to compute the reduced vulnerabilities of secured supply chain nodes and the first-order Taylor series approximation of natural logarithm to linearize the nonlinear constraints, a nonlinear stochastic combinatorial optimization model is approximated by its linear equivalent. The problem objective is to determine an optimal cybersecurity investment under limited budget and portfolio of security controls for each node to balance the cybersecurity across the entire supply chain. The minmax objective functions are applied to minimize either the maximum breach probability or the maximum loss of supply chain nodes. Alternatively, maxmin objectives are used to maximize the minimum non-breach probability or the minimum savings of loss. The proposed solution approach is illustrated with results of computational study, and a comparison of approximated and exact solution values is presented. The decision-making insights are provided at the end of this chapter.