A Robust Approach for Mitigating Risks in Cyber Supply Chains.

Area of Science:

• Information Technology Security
• Cybersecurity Risk Management
• Operations Research

Background:

• Growing concerns exist regarding risks in U.S. federal information technology (IT) supply chains.
• Prioritizing security mitigations is crucial for decision-makers to reduce IT supply chain risks.
• Existing models may provide average-case solutions that are unacceptable in certain high-risk circumstances.

Purpose of the Study:

• To extend existing stochastic models for IT supply chain risk management.
• To develop and evaluate robust optimization models that hedge against worst-case risks.
• To provide decision-makers with tools for managing cybersecurity risks under uncertainty.

Main Methods:

• Extension of stochastic expected budgeted maximum multiple coverage models.
• Development of three alternative robust optimization models: maximizing worst-case coverage, minimizing worst-case regret, and maximizing conditional value at risk (CVaR).
• Case study application to illustrate and compare robust methods with expected-value maximization.

Main Results:

• The robust models offer alternative solutions to expected-value maximization, particularly for decision-makers with different risk attitudes.
• Insights into mitigation selection are provided by comparing the solutions from robust methods.
• The study demonstrates the practical application of these models in a case study.

Conclusions:

• Robust optimization methods provide valuable tools for managing cybersecurity risks in IT supply chains.
• Decision-makers can leverage these models to select security mitigations based on their specific risk tolerance.
• The research enhances the ability to manage complex cybersecurity challenges under uncertainty.