A linear model for optimal cybersecurity investment in Industry 4.0 supply chains

ABSTRACT

This paper presents a mixed integer linear programming formulation for optimisation of cybersecurity investment in Industry 4.0 supply chains. Using a recursive linearisation procedure, a complex nonlinear stochastic combinatorial optimisation model with a classical exponential function of breach probability is transformed into its linear equivalent. The obtained linear optimisation model is capable of selecting optimal portfolio of security safeguards to minimise cybersecurity investment and expected cost of losses from security breaches in a supply chain. The new efficiency measures of cybersecurity investment are introduced: cybersecurity value and cybersecurity ratio. In addition, the proposed linear model has been enhanced for the Hurwicz-type, best–worst criterion to minimise a convex combination of the minimal and the maximal supply chain node vulnerability, under limited budget. The resulting compromise cybersecurity investment aims at balancing vulnerability over the entire supply chain, independent of cyberattack probabilities and potential losses by security breaches, thereby hardening the weaker critical nodes. The findings indicate a crucial role of intrinsic vulnerability, determined by the architecture of Industry 4.0 supply chain, and highlight ‘design for cybersecurity’ as an important emerging area of research.

KEYWORDS:

• Industry 4.0
• cyber risk management
• cybersecurity investment
• safeguard portfolio
• mixed integer linear programming
• best–worst criterion

Acknowledgments

The author is grateful to three anonymous reviewers and an associate editor for reading the manuscript very carefully and providing many constructive comments which helped to improve this paper.

Disclosure statement

No potential conflict of interest was reported by the author.

Additional information

Notes on contributors

Tadeusz Sawik

Tadeusz Sawik is a Professor of Industrial Engineering and Operations Research in the Department of Engineering, Reykjavik University, Reykjavik, Iceland, and at AGH University of Science and Technology, Kraków, Poland. He received a MS degree in Automation Engineering, a PhD degree in Operations Engineering and a Habilitation degree in Operations Research, all from AGH University. He has been a visiting professor in Germany, Greece, Japan, Portugal, Spain, Sweden and Switzerland and has served as a research advisor of Motorola for several years. He is a sole author of numerous books, including Analysis and Synthesis of Multivariable Control Systems, AGH University Press, 1984; Discrete Optimisation in Flexible Manufacturing Systems, WNT Publishers, 1992; Operations Research for Industrial Engineers, AGH University Press, 1998; Production Planning and Scheduling in Flexible Assembly Systems, Springer, 1998; Scheduling in Supply Chains Using Mixed Integer Programming, Wiley, 2011 and Supply Chain Disruption Management Using Stochastic Mixed Integer Programming, Springer, 1st edition 2018, 2nd edition 2020, and more than 150 individual articles in many prestigious journals. He has been a recipient of various individual awards for research achievements, including 5 times of Scientific Excellence Award from the Minister of Science and Higher Education and over 25 times of Scientific Award from the Rector of AGH. In the World's Top 2% Scientists list recently released by Stanford University and published in PloS Biology, ranked #167 in Operations Research until the end of 2019, and #91 in Operations Research and #87 in Engineering during the single calendar year 2019. His current research interests include logistics and supply chain management, supply chain risk management, cyber and homeland security, planning and scheduling, mixed integer programming, stochastic and combinatorial optimisation.