Skip to main content
SpringerLink
Log in
Book cover

Cyber Security and Privacy Forum

CSP 2015: Cyber Security and Privacy pp 79–90Cite as

Medusa: A Supply Chain Risk Assessment Methodology

  • Conference paper
  • First Online:

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 530))

Abstract

Although efforts have been made to standardize Supply Chain (SC) security risk assessment, there is a lack of targeted methodologies. In this paper we propose Medusa, a SC risk assessment methodology, compliant with ISO28001. Medusa can be used in order to assess the overall risk of the entire supply chain. The derived overall risk values are used in order to generate a baseline SC security policy, identifying the least necessary security controls for each participant in the SC. In addition, Medusa assesses the risk of cascading threat scenarios within a SC. This enables the SC participants to fine-tune their security policies according to their business role as well as their dependencies.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    Following the ISO 28001 standard, we will call such operators as business partners.

References

  1. Aung, Z.Z., Watanabe, K.: A framework for modeling interdependencies in Japan’s critical infrastructures. In: Palmer, C., Shenoi, S. (eds.): 3rd IFIP International Conferenceon Critical Infrastructure Protection (CIP-2009), pp. 243–257. Springer, USA (2009)

    Google Scholar 

  2. De Porcellinis, S., Oliva, G., Panzieri, S., Setola, R.: A holistic-reductionistic approach for modeling interdependencies. In Palmer, C., Shenoi, S. (eds.): 3rd IFIP International Conference on Critical Infrastructure Protection (CIP-2009), pp. 215–227, Springer, USA (2009)

    Google Scholar 

  3. Giannopoulos, G., Filippini, R., Schimmer, M.: Risk assessment methodologies for Critical Infrastructure Protection. Part I: A state of the art. Joint Research Center Publication, JRC 70046, EUR 25286 EN, ISBN 978-92-79-23839-0, ISSN 1831-9424, doi: 10.2788/22260. Publications Office of the European Union, Luxembourg (2012)

  4. Haimes, Y., Santos, J., Crowther, K., Henry, M., Lia, N.C., Yan, Z.: Risk analysis in interdependent infrastructures. Crit. Infrastruct. Prot. 253, 297–310 (2007)

    Article  Google Scholar 

  5. Hokstad, P., Utne, I.B., Vatn, J. (eds.): Risk and interdependencies in critical infrastructures. A Guideline for Analysis. In: Springer Series in Reliability Engineering VIII, 252 (2013)

    Google Scholar 

  6. ISO, ISO 31000: Risk Management – Principles and Guidelines. Geneva (2009)

    Google Scholar 

  7. ISO, ISO 31010: Risk management – Risk assessment techniques. Geneva (2009)

    Google Scholar 

  8. ISO, ISO 27001: Information Security Management System Requirements. Geneva, Switzerland (2013)

    Google Scholar 

  9. ISO, ISO 27005: Information security risk management, Geneva (2011)

    Google Scholar 

  10. ISO, ISO 28001: Security management systems for the supply chain — Best practices for implementing supply chain security, assessments and plans — Requirements and guidance. Geneva, Switzerland (2007)

    Google Scholar 

  11. Kotzanikolaou, P., Theoharidou, M., Gritzalis, D.: Assessing n-order dependencies between critical infrastructures. Int. J. Crit. Infrastruct. 9(1/2), 93–110 (2013)

    Article  Google Scholar 

  12. NIST, Notional Supply Chain Risk Management Practices for Federal Information Systems. http://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7622.pdf

  13. Ntouskas, T., Polemi, N.: Collaborative security management services for port information systems. In: DCNET/ICE-B/OPTICS, pp. 305–308 (2012)

    Google Scholar 

  14. Pederson, P., Dudenhoeffer, D., Hartley, S., Permann, M.: Critical Infrastructure Interdependency Modeling: A Survey of U.S. and International Research, INL, INL/EXT-06-11464 (2006)

    Google Scholar 

  15. Peltier, T.R.: Information security risk analysis. Auerbach Publications, Boston (2001)

    Google Scholar 

  16. Polemi, N., Ntouskas, T.: Open issues and proposals in the it security management of commercial ports: the S-PORT national case. In: Gritzalis, D., Furnell, S., Theoharidou, M. (eds.) SEC 2012. IFIP AICT, vol. 376, pp. 567–572. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  17. Rinaldi, S.M., Peerenboom, J.P., Kelly, T.K.: Identifying, understanding and analyzing critical infrastructure interdependencies. IEEE Control Syst. 21, 11–25 (2001)

    Article  Google Scholar 

  18. Theoharidou, M., Kotzanikolaou, P., Gritzalis, D.: Risk assessment methodology for interdependent critical infrastructures. Int. J. Risk Assess. Manage. 15(2/3), 128–148 (2011)

    Article  Google Scholar 

  19. Zio, E., Sansavini, G.: Modeling interdependent network systems for identifying cascade-safe operating margins interdependency. IEEE Trans. Reliab. 60(1), 94–101 (2011)

    Article  Google Scholar 

Download references

Acknowledgements

The publication of this paper has been partly supported by the University of Piraeus Research Center. – This work is supported by the European Commission under grant agreement HOME/2013/CIPS/AG/4000005093 (MEDUSA: http://medusa.cs.unipi.gr/).

Author information

Authors and Affiliations

  1. Department of Informatics, University of Piraeus, Greece 80 Karaoli Dimitriou Street, 18534, Piraeus, Greece

    Nineta Polemi & Panayiotis Kotzanikolaou

Authors
  1. Nineta Polemi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Panayiotis Kotzanikolaou
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Panayiotis Kotzanikolaou .

Editor information

Editors and Affiliations

  1. Waterford Institute of Technology, Waterford, Ireland

    Frances Cleary

  2. Security and Cloud Lab, Hewlett-Packard Laboratories, Bristol, United Kingdom

    Massimo Felici

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer International Publishing Switzerland

About this paper

Cite this paper

Polemi, N., Kotzanikolaou, P. (2015). Medusa: A Supply Chain Risk Assessment Methodology. In: Cleary, F., Felici, M. (eds) Cyber Security and Privacy. CSP 2015. Communications in Computer and Information Science, vol 530. Springer, Cham. https://doi.org/10.1007/978-3-319-25360-2_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-25360-2_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-25359-6

  • Online ISBN: 978-3-319-25360-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation