Purpose This paper aims to discuss the ethical aspects of hardware reverse engineering (HRE) and propose an ethical framework for HRE when used to mitigate cyber risks of the digital supply chain of critical infrastructure operators. Design/methodology/approach A thorough review and analysis of existing relevant literature was performed to establish the current state of knowledge in the field. Ethical frameworks proposed for other areas/disciplines and identified pertinent ethical principles have been used to inform the proposed framework’s development. Findings The proposed framework provides actionable guidance to security professionals engaged with such activities to support them in assessing whether an HRE project conforms to ethical principles. Recommendations on action needed to complement the framework are also proposed. According to the proposed framework, reverse engineering is neither unethical nor illegal if performed honourably. Collaboration with vendors and suppliers at an industry-wide level is critical for appropriately endorsing the proposed framework. Originality/value To the best of the authors’ knowledge, no ethical framework currently guides cybersecurity research, far less of cybersecurity vulnerability research and reverse engineering.

Cyber-attacks on digital supply chains are rising, and Critical Infrastructures (CIs) such as the Smart Grid are prime targets. There is increasing evidence that vendors, service providers, and outsourced IT -providers are at equal risk of being used by malicious actors to gain a foothold in the power grid - delivering exploits that can disrupt electric power delivery and severely damage our economy. Long digital supply chains with components from different manufacturers require a new approach and methods to ensure the needed security in Critical Infrastructures. Hardware Reverse Engineering (HRE), commonly used for verifying the security of an embedded system, includes disassembling to analyse, test, and document the functionality and vulnerability of the target system. This paper proposes leveraging HRE for improving both the security and the resilience of the power infrastructure against cyber-attacks enabled through the digital supply chain, by organising HRE activities, and how this can be organized within the equipment procurement process in a Distribution System Operator (DSO).

Supply chain attacks have been a security concern for many years, and their number and severity are expected to continue to grow in the years to come. In the ICT domain, ensuring the integrity of the supply chain is becoming an essential concern, as components are often manufactured, owned, and operated by different entities across the globe; thus, the cascading effects from a single attack may have a widely propagated impact. This is even more so when components are used in industrial control systems in critical infrastructures. It is therefore important to understand such attacks and attack vectors, the security challenges thereof, and measures to mitigate these; it is also important to educate cybersecurity professionals on these issues. This paper systematizes the security threats and challenges in digital supply chains, as well as relevant cybersecurity measures, discusses the necessary knowledge and skills that cybersecurity professionals should possess to ensure efficient management of the cyber risks in the digital supply chain, and systematizes areas where further research is needed.