SoK: Combating threats in the digital supply chain
Arne Roar Nygård, Sokratis Katsikas
Abstract
Supply chain attacks have been a security concern for many years, and their number and severity are expected to continue to grow in the years to come. In the ICT domain, ensuring the integrity of the supply chain is becoming an essential concern, as components are often manufactured, owned, and operated by different entities across the globe; thus, the cascading effects from a single attack may have a widely propagated impact. This is even more so when components are used in industrial control systems in critical infrastructures. It is therefore important to understand such attacks and attack vectors, the security challenges thereof, and measures to mitigate these; it is also important to educate cybersecurity professionals on these issues. This paper systematizes the security threats and challenges in digital supply chains, as well as relevant cybersecurity measures, discusses the necessary knowledge and skills that cybersecurity professionals should possess to ensure efficient management of the cyber risks in the digital supply chain, and systematizes areas where further research is needed.