A methodology for cybersecurity risk assessment in supply chains

Supply chain cyberattacks are on the rise as attackers increasingly exploit the intricate network of supplier connections between companies. Critical infrastructures too have been successfully targeted using this strategy, whichcalls for cybersecurity risk assessment strategies to be revised to stress the focuson threats originating from suppliers. This work proposes a novel supply chaincybersecurity risk assessment tailored for companies with limited cybersecurityexpertise and constrained resources to execute risk assessment. Through a set of simple questions, this methodology first captures the perceived likelihood and impact of vulnerabilities and threats that derive from suppliers and target specific organisational assets, and then generates cybersecurity risk scores for each relevant threat. A preliminary validation of the methodology is carried out, where generated risk scores are compared to evaluations provided by cybersecurity experts.The results show that the methodology produces risk scores that on average differ by 8% from those deriving from the experts’ assessment, which corroborates the hypothesis that the methodology is reliable even though it does not require detailed information about the suppliers’ cyber posture