Trust-Based Information Risk Management in a Supply Chain Network

Abstract

Information risk management is crucial for an organization operating in an increasingly integrated and intensively communicated environment to mitigate risks and ensure core business functions. Given the open and dynamic nature of a supply chain network, information risk management is challenging and various factors must be considered. This article introduces a trust-based approach to facilitate supply chain participants to perform effective risk management. The major components of the proposed framework include supply chain member trust evaluation, data classification, and trust-based decision making. The major purpose of the framework is to control and mitigate information risks that a participant faces in a supply chain network (e.g., risks to information confidentiality, privacy, and integrity). We apply the principle of transitive trust for trust evaluation and use several decision tools for risk analysis and mitigation.