Preventing or mitigating adversarial supply chain attacks: A legal analysis

TY - GEN

T1 - Preventing or mitigating adversarial supply chain attacks

T2 - 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses, SCORED 2022

AU - Ludvigsen, Kaspar Rosager

AU - Nagaraja, Shishir

AU - Daly, Angela

N1 - Funding Information: The authors are supported by EPSRC funding under the PETRAS ROAST project. Publisher Copyright: © 2022 Copyright held by the owner/author(s). Publication rights licensed to ACM.

PY - 2022/11/8

Y1 - 2022/11/8

N2 - The world is currently strongly connected through both the internet at large, but also the very supply chains which provide everything from food to infrastructure and technology. The supply chains are themselves vulnerable to adversarial attacks, both in a digital and physical sense, which can disrupt or at worst destroy them. In this paper, we take a look at two examples of such successful attacks to put the idea of Supply Chain Attacks into perspective, and analyse how EU and national law can prevent these attacks or otherwise punish companies which do not try to mitigate them at all possible costs. We find that the current types of national regulation are not technology specific enough, and cannot force or otherwise mandate the correct parties who could play the biggest role in preventing supply chain attacks to do everything in their power to mitigate them. But, current EU law is on the right path, and further development of this may be what is necessary to combat these large threats, as national law may fail at properly regulating companies when it comes to cybersecurity.

AB - The world is currently strongly connected through both the internet at large, but also the very supply chains which provide everything from food to infrastructure and technology. The supply chains are themselves vulnerable to adversarial attacks, both in a digital and physical sense, which can disrupt or at worst destroy them. In this paper, we take a look at two examples of such successful attacks to put the idea of Supply Chain Attacks into perspective, and analyse how EU and national law can prevent these attacks or otherwise punish companies which do not try to mitigate them at all possible costs. We find that the current types of national regulation are not technology specific enough, and cannot force or otherwise mandate the correct parties who could play the biggest role in preventing supply chain attacks to do everything in their power to mitigate them. But, current EU law is on the right path, and further development of this may be what is necessary to combat these large threats, as national law may fail at properly regulating companies when it comes to cybersecurity.

KW - Cybersecurity

KW - Danish Law

KW - EU Law

KW - Irish Law

KW - Supply Chain Attacks

KW - Supply Chains

KW - UK Law

U2 - 10.1145/3560835.3564552

DO - 10.1145/3560835.3564552

M3 - Conference contribution

AN - SCOPUS:85143975669

SN - 9781450398855

SP - 25

EP - 34

BT - SCORED 2022

PB - Association for Computing Machinery

CY - New York, NY

Y2 - 11 November 2022 through 11 November 2022

ER -