A Reference Model for Information Security of Information and Communication Technology Product Supply Chain

Information and Communication Technology (ICT) products are becoming increasingly important in people's daily lives, and cyberspace security issues caused by ICT supply chains have attracted widespread attention. This paper reflects that, even while various contributions were made towards the construction of information security frameworks, there appears still to be an absence of an explicit reference model. The choice of research subject here is ICT supply chains, in which a reference security model framework for cyberspace security of ICT supply chains is discussed. The reference model developed is based on the application of the NIST information security reference model methodology. Conducting a thorough analysis of ICT supply chain structure and information security risk, we categorize the various kinds of information security attacks on ICT supply chain and catalog them on the security target reference model. This developed model of reference information security shall serve as an excellent articulation of how to boost the confidentiality, integrity, and availability of systems design, analysis, and verification to specific attack types through hacking. Therefore, the research methodology described herein is equally appropriate and transferrable for the information security studies of other information systems. Hence, the reference model framework proposed in this research may play an important role in fields related to information security and may promote the development of effective countermeasures against ICT supply chain attacks.