This paper provides the first large-scale data-driven analysis to evaluate the predictive power of digital supply chain attributes for assessing risk of cyberattack data breaches. Motivated by rapid increase in the complexity of digital supply chains and related third-party enabled cyberattacks, the paper provides the first quantitative empirical evidence that digital supply-chain attributes are significant predictors of enterprise cyber risk. The analysis leverages externally observable cybersecurity ratings that aim to capture the quality of the enterprise internal cybersecurity management, but augments these with original supply chain features that are inspired by observed third-party cyberattack scenarios, as well as concepts from network science research. The main quantitative result of the paper is to show that these supply chain network features add significant detection power to predicting enterprise cyber risk, relative to merely using enterprise-only attributes. In particular, compared to a base model that relies only on internal enterprise features, the supply chain network features improve the out-of-sample AUC by 2.3%. Given that a cyber data breach on a specific enterprise is a low probability high impact risk event, these improvements in the prediction power have significant value. Additionally, the model highlights several cybersecurity risk drivers related to third-party cyberattack and breach mechanisms and provides important insights as to what key metrics should be monitored and what interventions might be effective to mitigate these risks.

First-generation comparison-shopping software tools in general have limitations in dealing with bundled products. A new generic model for e-commerce comparison-shopping, based on a logical unBundling of sellers' offerings, is presented. The model captures dominance relationship between offerings and consumer requirements and may serve as a foundation for a variety of shopping decision support software tools. The model provides a basis for defining notions of bargains and designing algorithms for searching for them. Various implications and remaining challenges are outlined.

Protocols which include key-distribution and data exchange phases in an asynchronous, shared key, multidomain environment are examined. A model of a distributed system is presented and the goals of the multidomain protocols are formulated. The minimal number of messages for two variants of such protocols is proved. Two multi-domain protocols which contain the minimal number of messages are presented. The results are compared with previously published work.

The notion of trust is fundamental in inter-domain authentication protocols. The goal is to develop an effective formalism for explicit expressions of trust relations between entities involved in authentication protocols. Different relevant types of trust are identified and classified. A formalism for expressing trust relations is presented along with an algorithm for deriving trust relations from recommendations. The advantages of the approach are demonstrated by analyzing and comparing the trust relation requirements of a few known authentication protocols.>

The problem of setting up two principals in a distributed asynchronous environment for a secure data-exchange session is examined. A model is presented and a theorem regarding necessary and sufficient conditions for establishing an upper bound on the duration between events is proved. The goals of secure data exchange protocols are motivated and precisely stated. A minimality result – establishing the minimal number of messages that are required to achieve these goals, is derived. Finally, a secure data exchange protocol which contains the minimal number of messages is presented, analyzed, and compared with previously published protocols.

A mechanism is presented for reasoning about belief as a systematic way to understand the working of cryptographic protocols. The mechanism captures more features of such protocols than that given by M. Burrows et al. (1989) to which the proposals are a substantial extension. The notion of possession incorporated in the approach assumes that principles can include in messages data they do not believe in, but merely possess. This also enables conclusions such as 'Q possesses the shared key', as in an example to be derived. The approach places a strong emphasis on the separation between the content and the meaning of messages. This can increase consistency in the analysis and, more importantly, introduce the ability to reason at more than one level. The final position in a given run will depend on the level of mutual trust of the specified principles participating in that run.>