I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department of homeland security, department of justice, etc.) have any supply chain risks?
1 Answer
I'm guessing here that you're referring to software supply chains rather than physical ones as they've been in the news a bit lately.
The answer is that all companies which use software have some kind of supply chain. For example any IT devices you use constitue part of your sofware supply chain as the security of those devices and the software they run forms part of your IT security posture (e.g. if there's a bug in router software for a device you use, you could be breached as a result)
A recent presentation I saw which have more information is here (although it's targeted more at the UK financial services industry, a lot of the information applies generally)
-
thanks. do you know in what ways are outsourcing considered supply chain risk? Jul 4, 2015 at 7:48
-
1well if you outsource services to another company, the code developed by the outsourcing company and their IT security practices are a risk to your company. For example if an outsourcing company has poor security practices then if they have an incident, it would affect the security of your data. Jul 4, 2015 at 8:18