I-SCRAM: A Framework for IoT Supply Chain Risk Analysis and Mitigation Decisions

Supply chain security is becoming an important factor in security risk analysis for modern information and communication technology (ICT) systems. As Internet of Things (IoT) devices proliferate and get adopted into critical infrastructure, the role of suppliers in risk assessment becomes all the more significant. IoT security risks are affected by supplier trust since suppliers possess the capacity to modify black box systems without detection. The risks posed by potentially malicious or compromised suppliers are compounded by interdependence among suppliers. In this paper, we propose I-SCRAM, a framework to analyze supply chain risks in IoT systems and to support risk mitigating decisions. After defining an expanded system model that consists of interconnected components and a hierarchy of component vendors, we develop and propose metrics to quantify systemic risks. Finally, we present a decision framework that helps in selection of vendors to mitigate supply chain risk. Through a case study and simulation, we show that I-SCRAM successfully minimizes system risk as higher budget and more reliable component sources become available, while allowing flexibility in prioritizing sources of risk.

[1]  Quanyan Zhu,et al.  Modeling and Assessment of IoT Supply Chain Security Risks: The Role of Structural and Parametric Uncertainties , 2020, 2020 IEEE Security and Privacy Workshops (SPW).

[2]  Quanyan Zhu,et al.  RIoTS: Risk Analysis of IoT Supply Chain Threats , 2020, 2020 IEEE 6th World Forum on Internet of Things (WF-IoT).

[3]  Enrico Zio,et al.  The evolution of system reliability optimization , 2019, Reliab. Eng. Syst. Saf..

[4]  Yang Wei,et al.  Supply Chain of Things: A Connected Solution to Enhance Supply Chain Productivity , 2019, IEEE Communications Magazine.

[5]  Robert Lagerström,et al.  Threat modeling - A systematic literature review , 2019, Comput. Secur..

[6]  Karen Scarfone,et al.  Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks , 2018 .

[7]  Gary B. Wills,et al.  Towards Mapping the Security Challenges of the Internet of Things (IoT) Supply Chain , 2018, KES.

[8]  Aleksandar Vakanski,et al.  A secure architecture for IoT with supply chain risk management , 2017, 2017 9th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS).

[9]  Chris Rose,et al.  The Security Implications Of The Internet Of Things , 2017 .

[10]  Nadya Bartol,et al.  Supply Chain Risk Management Practices for Federal Information Systems and Organizations , 2015 .

[11]  Marco Gribaudo,et al.  Exploiting Bayesian Networks for the Analysis of Combined Attack Trees , 2015, PASM.

[12]  Barbara Kordy,et al.  DAG-based attack and defense modeling: Don't miss the forest for the attack trees , 2013, Comput. Sci. Rev..

[13]  David A. Schmidt,et al.  Aggregating vulnerability metrics in enterprise networks using attack graphs , 2013, J. Comput. Secur..

[14]  Ronald S. Ross,et al.  Guide for Conducting Risk Assessments , 2012 .

[15]  Dong Seong Kim,et al.  Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees , 2012, Secur. Commun. Networks.

[16]  Nancy G. Leveson,et al.  Engineering a Safer World: Systems Thinking Applied to Safety , 2012 .

[17]  Indrajit Ray,et al.  Dynamic Security Risk Management Using Bayesian Attack Graphs , 2012, IEEE Transactions on Dependable and Secure Computing.

[18]  Vaidas Matuzas,et al.  Analysis of large fault trees based on functional decomposition , 2011, Reliab. Eng. Syst. Saf..

[19]  Daniele Sgandurra,et al.  Hierarchical, model-based risk management of critical infrastructures , 2009, Reliab. Eng. Syst. Saf..

[20]  Sushil Jajodia,et al.  An Attack Graph-Based Probabilistic Security Metric , 2008, DBSec.

[21]  Michael T. Todinov.  3 – METHODS FOR ANALYSIS OF COMPLEX RELIABILITY NETWORKS , 2007 .

[22]  Michael Todinov,et al.  Risk-Based Reliability Analysis and Generic Principles for Risk Reduction , 2006 .

[23]  Xinming Ou,et al.  A scalable approach to attack graph generation , 2006, CCS '06.

[24]  Christopher S. Tang.  Perspectives in supply chain risk management , 2006 .

[25]  Sjouke Mauw,et al.  Foundations of Attack Trees , 2005, ICISC.

[26]  Somesh Jha,et al.  Two formal analyses of attack graphs , 2002, Proceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15.

[27]  Somesh Jha,et al.  Automated generation and analysis of attack graphs , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.

[28]  Edward G. Amoroso,et al.  Fundamentals of computer security technology , 1994 .

[29]  C. H. Lie,et al.  Fault Tree Analysis, Methods, and Applications ߝ A Review , 1985, IEEE Transactions on Reliability.

[30]  J. B. Fussell,et al.  MOCUS: a computer program to obtain minimal sets from fault trees , 1974 .

[31]  D. W. Goodall.  A New Similarity Index Based on Probability , 1966 .