Cybersecurity in Supply Chain Management

Comprehensive vocabulary flashcards covering key cybersecurity concepts, risk models, architectural paradigms, and regulatory frameworks in supply chain management.

Basic Risk Formula

A foundational quantitative model expressing potential loss as the product of likelihood and consequence: $\text{Risk} = \text{Probability} \times \text{Impact}$.

Cyber Risk Formula

A specialized three-factor calculation used in cybersecurity: $\text{Risk} = \text{Threat} \times \text{Vulnerability} \times \text{Asset Value}$, combining the likelihood of an attempt, the likelihood of successful exploit, and the cost of the breach.

AI/ML (Artificial Intelligence / Machine Learning)

Computer methods that perform tasks associated with human intelligence and learn patterns from data. Defenders use them for threat detection and anomaly detection, while attackers use them to craft phishing campaigns and adaptive malware.

Anomaly Detection

The identification of activity that differs from an expected pattern (e.g., a supplier account downloading unusually large amounts of data at midnight). It signals a need for investigation but does not automatically prove an attack.

Asset Value

The business importance or financial, reputational, and operational cost associated with a system, dataset, or resource if a breach occurs.

Attack Path

A sequence of steps an attacker could use to reach a valuable target, such as compromising a supplier's account to traverse a shared platform and access a manufacturer's production data.

Blockchain / Distributed Ledger

A shared recordkeeping system maintained across multiple computers using cryptographic links and validation rules to make unauthorized changes detectable, used to authenticate parts and trace provenance.

Chain of Trust

A series of linked checks that establish confidence in a system or component, where trusted hardware verifies startup software, which sequentially verifies downstream software before execution.

Common Vulnerability Scoring System (CVSS)

A standardized rating system used to evaluate the technical severity of a security vulnerability, typically scored on a scale from $0$ to $10$.

Concentration of Risk

The exposure created when many organizations rely on a small number of shared third-party software, cloud, or infrastructure providers, forming choke points that can trigger cascading failures.

Context-Based Access

An access decision mechanism that evaluates circumstances such as user identity, physical location, device security posture, and requested resources before granting permissions.

Continuous Exposure Monitoring

Ongoing observation and real-time scanning of systems, vendor ecosystems, firmware, and dependencies to detect anomalous behavior and newly disclosed vulnerabilities.

Crypto-Malware

Malicious software that uses encryption as part of an attack to lock a victim's files or operational databases until a ransom payment is made.

Cyber Resilience

The capacity of an organization or supply chain to prepare for, withstand, contain, respond to, and recover from cyber incidents while sustaining essential business operations.

Cyber Resilience Act (CRA)

An EU regulation establishing mandatory cybersecurity requirements and vulnerability-handling rules across the entire lifecycle of hardware and software products with digital elements.

Deepfake

AI-generated or synthetic media (audio, video, or images) designed to realistically imitate a person, often used in social engineering to manipulate personnel into divulging credentials or altering payments.

Dependency Transparency

Visibility into all direct and indirect software libraries, components, and external services a product or organization relies on, enabling rapid identification of vulnerable nodes.

DevSecOps

The integration of development, security, and operational practices to embed automated security testing, component auditing, and patching directly throughout the software lifecycle.

Device Posture Checking

The evaluation of an endpoint device's security state—including patch levels, configuration, and active defensive software—before or during access to protected systems.

Digital Signature

A cryptographic mechanism that validates the authenticity of the sender and verifies that digital content, software releases, or SBOMs have not been altered since signing.

Failover

The automated or operational transfer of workload to a secondary backup system, service, or connection when the primary environment experiences disruption or compromise.

Federated Learning

A decentralized machine learning method where partners train models on locally stored datasets and share only the model updates, enabling collaborative threat intelligence without disclosing raw data.

Firmware

Specialized, low-level software programmed directly into hardware (such as routers, IoT devices, and sensors) to control device functionality; unpatched firmware poses major entry risks.

Hardware Assurance

Practices and validation procedures that ensure physical hardware components are authentic, untampered, and functioning as intended throughout the manufacturing and supply lifecycle.

Impact / Consequence

The magnitude of damage or loss resulting from a risk event, measured in financial expenses, operational downtime, health and safety effects, or reputational damage.

Incident Response

A structured, coordinated process for detecting, investigating, containing, and recovering from cybersecurity breaches, including coordinated technical action across supply chain partners.

Indemnification

A contractual agreement in which one party commits to compensate or cover specified financial losses, legal costs, or damages incurred by another party following a breach.

Internet of Things (IoT)

Physical hardware devices equipped with sensors, processing software, and network connectivity that collect and exchange operational data across supply chains.

Islandable Segment

A network or operational zone engineered to disconnect from external connections during an attack and sustain essential functions independently to contain incident propagation.

Knowledge Graph

A network model that maps entities and relationships as interconnected nodes and edges, used to identify indirect vendor dependencies and multi-stage attack paths.

Least Privilege

A core security principle stating that users, systems, and vendor accounts should only be granted the minimum permissions strictly necessary to perform their explicit job functions.

Malware

Software intentionally constructed to damage systems, exfiltrate data, or execute unauthorized operations across IT and OT environments.

Micro-Segmentation

The architectural practice of dividing an internal network into isolated, granular security zones to restrict lateral attacker movement between connected systems.

NIS2 Directive

The European Union's updated cybersecurity legislation establishing mandatory risk-management controls, supply chain security assessments, and incident reporting for covered essential entities.

Open RAN (Open Radio Access Network)

A cellular radio network architecture built on open standards and multi-vendor interoperability, requiring rigorous provenance tracking and configuration validation across suppliers.

Patching

The process of deploying updates to software, applications, or firmware to remediate discovered security vulnerabilities or functional bugs.

Phishing

A fraudulent communication engineered to impersonate a legitimate contact or supplier to trick recipients into revealing sensitive credentials or downloading malicious payloads.

Post-Quantum Cryptography (PQC)

Cryptographic algorithms designed to withstand mathematical decryption attacks executed by future cryptographically relevant quantum computers, protecting encrypted data and signatures.

Probability

The likelihood that a defined adverse event will occur within a specified time frame, typically expressed as a decimal from $0$ to $1$ or a percentage from $0\%$ to $100\%$.

Provenance / Chain of Custody

The comprehensive record documenting the origin, ownership history, and custody transfers of a physical or digital component to verify authenticity and prevent tampering.

Public-Key Cryptography (RSA / ECC)

An asymmetric encryption scheme using mathematically paired public and private keys for secure communication and signatures, which is vulnerable to eventual compromise by quantum computers.

Red Team / Blue Team Simulation

A security exercise where offensive operators (Red Team) emulate adversarial attack techniques against supply paths while defenders (Blue Team) practice real-time detection and containment.

Redundancy

The duplication of mission-critical systems, network paths, and operational resources to prevent single points of failure and ensure service continuity after an outage.

Root of Trust (RoT)

A foundational hardware or low-level cryptographic component that provides an inherently secure baseline for measuring software authenticity during startup.

Smart Contract

Automated, self-executing software code recorded on a blockchain that executes contractual terms and transactions when predetermined conditions are validated.

Social Engineering

Psychological deception tactics aimed at manipulating people into performing unsafe actions, such as disclosing confidential vendor credentials or executing unauthorized payments.

Software Bill of Materials (SBOM)

A formal, machine-readable inventory listing all software components, open-source libraries, and dependencies integrated into an application or digital product.

SQL Injection

A web application exploit where malicious input alters a backend database query, allowing unauthorized extraction, tampering, or deletion of sensitive stored records.

Supply Chain Cyberattack

A cyber exploit that infiltrates an organization indirectly by compromising an upstream supplier, software update, external vendor, or third-party service provider.

Supply Chain Cybersecurity

The strategic practice of safeguarding interconnected supply networks, software dependencies, physical hardware, and data exchanges from cyber threats across all tiers.

Supply Chain Worm

Self-propagating malware that automatically spreads across interconnected organizational boundaries and partner networks via shared protocols and software trust channels.

Third-Party Risk Management (TPRM)

The systematic governance process of evaluating, auditing, and mitigating the security, operational, and compliance risks introduced by external vendors and contractors.

Threat Intelligence

Actionable, contextual information detailing threat actor behaviors, tactical methods, and indicators of compromise shared between organizations to coordinate collective defense.

Trusted Platform Module (TPM)

A specialized, tamper-resistant microcontroller embedded in hardware to securely store cryptographic keys, perform encryption, and authenticate platform boot integrity.

Vulnerability

A flaw, misconfiguration, or architectural defect in software, hardware, or processes that can be exploited by an adversary to gain unauthorized access.

Zero Trust

A perimeterless cybersecurity framework based on the mandate 'never trust, always verify,' requiring continuous verification of identity, device health, and context for every access request.