The Effects of Cyber Supply Chain Risk Management in Financial Industry

Abstract

Cyber security had been a major concern for all market industry especially on the financial industry services sector. Cases of cyber fraud had been reported all over the world including Malaysia and had caused billions of financial losses ruined as well as reputation which are at risk until now. Therefore, this study analyzed the cyber supply chain risk management (CSCRM) which comes into effect that will have an impact on the financial performance with mediating effects of cyber-resilience and service performance on the financial industry. Data collection is based on an online survey questionnaires (structured questionnaires) designed and published which is distributed from the list of respective individual managers involved in operations and Information Technology (I.T.) in the financial institutions industry in Malaysia. The research methodology used in this study is to test the relationship whether significant or insignificant between cyber supply chain risk management, financial performance, cyber-resilience, service performance, financial performance, as well as mediating variables effects of cyber-resilience and service performance while addressing the research questions with the following hypothesis proposed. In a nutshell, cyber supply chain risk management is designed to handle cyber risks which were caused by attacks from outsiders or the failure to manage risks internally in terms of governance, systems integration and operations and its impacts towards financial performance.

Keywords: Cyber supply chainrisk managementfinancial performancecyber-resilienceservice performance

Introduction

The widespread used of internet banking had resulted in the new dependence upon computer systems and data captured within. As a result, computers contains millions of database records relating to commerce, healthcare, banking, defence and even our personal information. With all these information recorded and captured in the computer systems, it is a risk of either being misused for fraudulent purposes or information modified for malicious reasons. At the same time, the vulnerability of these systems to attack from malicious individuals or groups is growing tremendously in all over the world.

Background of the study

Cyber security is generally recognized as a critical priority within the nation of a country, and in the business security communities as well. Governments all over the world have begun to show sign of concerns from the threat to their global supply chain for Information and Communications Technology (ICT) products aspects. These concerns are based on the risk that an opposition might tamper with products during their development, manufacture, production or even during delivery stage. In answering to these concerns, some governments have begun to establish policies and requirements which are intended to reduce these supply chain risks.

This view on the cyber threat has been reflected at the highest levels of the U.S. government, stating that “ cyber threat is one of the most serious economic and national security challenges we face as a nation. ” (Obama, 2009) According to a report conducted by the Malaysian cybersecurity agency, it was quoted that “more than 2,100 servers in Malaysia have been compromised and hacked” (Mu, 2017). Most of these servers belong to government agencies, banks, universities and businesses from the market industry.

See Full Size >

Figure 01 shows an overview of cyber crimes with the definition and characteristics of “cybercrime” (Chung, Chen, Chang, & Chou, 2006). Due to that, cyber resilience is becoming increasingly recognized as a critical component of comprehensive cyber security practices. Cyber resilience can be described as a cyber-system’s ability to function properly and securely despite disruptions to that system. Disruptions can be cyber or physical; they can also be intentional, accidental, or random. Therefore, cyber supply chain risk management (CSCRM) is an integrative discipline combining elements of cyber security, supply chain management, and enterprise risk management into a new and powerful concept to exert strategic control over the end-to-end processes of the focal organization and its extended enterprise partners (Boyson 2014).

Cyber supply chain can be defined as an end to end integration of supply chain over secured and intricate digital network (Gani & Fernando, 2018). The whole set of main performer using cyber infrastructure such as network, information system, system integrators and software or hardware suppliers.

Therefore, service performance measurement is regarded as important due to the increasing significance of service activities, but it is also regarded as a more complicated one compared to the manufacturing context (Pawar, Beltagui, & Riedel, 2009). The risks management and concerns over the threat had actually affected the public as well as the image and reputation of the financial institutions industry as a whole.

Figure 02 presents some of the local and foreign banks in the financial institutions industry that offered internet banking or e-banking services in Malaysia which also comprises the top 9 local banks in Malaysia as well (Hamid, Amin, Lada, & Ahmad, 2007).

See Full Size >

Problem Statement

The reputation of financial firms for being secure is of critical importance, both for the firm and its customers. Financial institutions have a very large economic incentive to assure the security of their information. As a result, financial firms are very proactive about security and business continuity.

In addition to that, the cyber supply chain remains as the weakest link as it is mainly targeted by ransomware (CyberSecurity ASEAN, 2018). Therefore, a study is required to assess to what extent the bank is equipped for online banking transactions.

• The core issues or problems in this research paper are how to best deal with risk and uncertainty.

• This paper focuses on the severity of the cybercrime such as phishing on the Malaysian banking industry as it is ever constant looming threat upon the banking service industry (Gan, Ling, Yih & Eze, 2008).

• There are concerns relating to unintended access to supply chain information by unauthorized third parties (Rieback, Crispo, & Tanenbaum, 2006); Cai, Jun & Yang, 2010); (Kim, 2013) and disrupting the flow of information (Chopra & Sodhi, 2004); (Dynes, 2008); (Jones & Horowitz, 2012). This is because there is an increasing number of Malaysians who have transactions online (Ali, Samsuri, Sadry, Brohi, & Shah, 2016).

• This study will address the growing concern about information systems (IS) misuse, especially with Web-based systems (D'Arcy & Hovav, 2007). The explosive growth of the Internet has brought about an escalation of security concerns about IS misuse, specifically cyber misuse (Siponen, 2005).

Research Questions

• Is there a positive relationship between cyber supply chain risk management and financial performance?

• Does cyber supply chain risk management have significant effect on cyber-resilience?

• Is there a positive relationship between cyber supply chain risk management and service performance?

• Is there a positive relationship between cyber-resilience and financial performance?

• Is there a positive relationship between service performance and financial performance?

• Does the cyber-resilience mediate the relationship between cyber supply chain risk management and financial performance?

• Does the service performance mediate the relationship between cyber supply chain risk management and financial performance?

Purpose of the Study

Cyber supply chain risk management is an emerging topic in the risk management research. Organizations interact with their customer, supplier and business via IT network and information system to improve supply chain performance. Previous scholars have proven that collaboration and integration among business partner can improve firm supply chain performance. Hence, managing cyber risks or information security risks is very crucial for firm to achieve highest performance. This study is among the pioneer empirical study on the effect of cyber supply chain risk management on financial performance with mediating effects of cyber-resilience and service performance. This could make several significant contributions to the industry and practitioner. There are two contributions to this study (i.e. theoretical significance and practical significance).

See Full Size >

Research Methods

The review of the type of research design, data collection method, survey instrument, measurement of variables, data analysis is included in the dissertation. This study is to examine how all these research methods tested will have any significant or insignificant relationship with each other one way or another.

Findings

The findings will be based on the sample data gathered and collected for testing. A hypothesis test will also be conducted based on the evaluates of two mutually exclusive statements about a population to determine which statement is best supported by the sample data.

Conclusion

CSCRM is a topic which is increasingly receiving attention from the public due to the recent issues of cyber fraud in the marketplace and challenges faced by the financial institution organization.

This paper contributes to the objective focused on through the direct effect of cyber risk in the supply chain that explains the relationship between variables (independent and dependent variables together with mediators).

Cyber supply chain risk management is designed to handle cyber risks which were caused by attacks from outsiders or the failure to manage risks internally in terms of governance, systems integration and operations and its impacts towards financial performance. It also involves mediator variables such as cyber-resilience and service performance as well.

This study also emphasizes on the financial impact besides revenue, operating costs, and working capital under the financial performance aspects, it is also believed that an effective SCM can also be expected to impose positive contributions towards dependent variables such as cost-efficient and financial leverage based on a research methodology conducted. When this study is completed, we will be able to measure the hypothesized relationships outlined in this paper and subsequently be able to provide a detailed key research and practical implications which will include suggestions for future research as well.

References

1. Ali, N. I., Samsuri, S., Sadry, M., Brohi, I. A., & Shah, A. (2016). Online shopping satisfaction in Malaysia: A framework for security, trust and cybercrime. Paper presented at the Information and Communication Technology for The Muslim World (ICT4M), 2016, 6th International Conference on.
2. Avery, A., & Ranganathan, C. (2016). Financial Performance Impacts of Information Security Breaches.
3. Borucki, C. C., & Burke, M. J. (1999). An examination of service-related antecedents to retail store performance. Journal of organizational Behavior, 943-962.
4. Bowen, D. E., & Waldman, D. A. (1999). Customer-driven employee performance. Pulakos (Eds.), The changing nature of performance, 154, 191.
5. Boyson, S. (2014). Cyber supply chain risk management: Revolutionizing the strategic control of critical IT systems. Technovation, 34(7), 342-353. doi:
6. Boyson, S., Corsi, T., & Rossman, H. (2009). Building a cyber supply chain assurance reference model. Science Applications International Corporation (SAIC).
7. Cai, S., Jun, M., & Yang, Z. (2010). Implementing supply chain information integration in China: The role of institutional forces and trust. Journal of Operations Management, 28(3), 257-268.
8. Chopra, S., & Sodhi, M. (2004). Supply-chain breakdown. MIT Sloan management review, 46(1), 53-61.
9. Chung, W., Chen, H., Chang, W., & Chou, S. (2006). Fighting cybercrime: a review and the Taiwan experience. Decision Support Systems, 41(3), 669-682.
10. D'Arcy, J., & Hovav, A. (2007). Deterring internal information systems misuse. Communications of the ACM, 50(10), 113-117.
11. Dawes, J., & Rowley, J. (1998). Enhancing the customer experience: contributions from information technology. Management decision, 36(5), 350-357.
12. Dynes, S. (2008). Emergent risks in critical infrastructures. Paper presented at the International Conference on Critical Infrastructure Protection.
13. Gan, G. G. G., Ling, T. N., Yih, G. C., & Eze, U. C. (2008). Phishing: A growing challenge for internet banking providers in Malaysia. Communications of the IBIMA,5, 133-142.
14. Ganesin, A., Supayah, L., & Ibrahim, J. (2016). An Overview of Cyber Security In Malaysia. Kuwait Chapter of the Arabian Journal of Business and Management Review, 6(4), 12.
15. Gani, A. B. D., & Fernando, Y. (2018). Concept and Practices of Cyber Supply Chain in Manufacturing Context Encyclopedia of Information Science and Technology, Fourth Edition (pp. 5306-5316): IGI Global.
16. Grönroos, C. (1984). A service quality model and its marketing implications. European Journal of marketing, 18(4), 36-44.
17. Guraau, C. (2002). Online banking in transition economies: the implementation and development of online banking systems in Romania. International journal of bank marketing, 20(6), 285-296.
18. Hamid, M. R. A., Amin, H., Lada, S., & Ahmad, N. (2007). A comparative analysis of Internet banking in Malaysia and Thailand. Journal of Internet Business (4).
19. International Monetary Fund, (2013). Retrieved from <International Monetary Fund 2013.pdf>
20. Jones, R. A., & Horowitz, B. (2012). A system‐aware cyber security architecture. Systems Engineering, 15(2), 225-240.
21. Kim, D. Y. (2013). Relationship between supply chain integration and performance. Operations management research, 6(1-2), 74-90.
22. Ladhari, R., & Michaud, M. (2015). eWOM effects on hotel booking intentions, attitudes, trust, and website perceptions. International Journal of Hospitality Management, 46, 36-45.
23. Liao, H., & Chuang, A. (2004). A multilevel investigation of factors influencing employee service performance and customer outcomes. Academy of Management journal, 47(1), 41-58.
24. Mu, P. (2017). Local servers still at risk Cyber Security Malaysia. New Sabah Times, 7.
25. Muniandy, L., & Muniandy, B. (2012). State of cyber security and the factors governing its protection in Malaysia. International Journal of Applied Science and Technology, 2(4).
26. Obama, B. (2009). Obama’s remarks on cyber-security. New York Times.
27. Pawar, K. S., Beltagui, A., & Riedel, J. C. (2009). The PSO triangle: designing product, service and organisation to create value. International Journal of Operations & Production Management, 29(5), 468-493.
28. Pikkarainen, T., Pikkarainen, K., Karjaluoto, H., & Pahnila, S. (2004). Consumer acceptance of online banking: an extension of the technology acceptance model. Internet research, 14(3), 224-235.
29. Ravichandran, T., Lertwongsatien, C., & Lertwongsatien, C. (2005). Effect of information systems resources and capabilities on firm performance: A resource-based perspective. Journal of management information systems, 21(4), 237-276.
30. Rieback, M. R., Crispo, B., & Tanenbaum, A. S. (2006). The evolution of RFID security. IEEE Pervasive Computing, 1, 62-69.
31. Saffu, K., Walker, J. H., & Hinson, R. (2008). Strategic value and electronic commerce adoption among small and medium-sized enterprises in a transitional economy. Journal of Business & Industrial Marketing, 23(6), 395-404.
32. Santhanam, R., & Hartono, E. (2003). Issues in linking information technology capability to firm performance. MIS quarterly, 125-153.
33. Simpson, W. G., & Kohers, T. (2010). Journal of Business Ethics: JBE; Dordrecht. 35(2), (Jan 2002), 97-109.
34. Siponen, M. T. (2005). An analysis of the traditional IS security approaches: implications for research and
35. practice. European Journal of Information Systems, 14(3), 303-315.
36. Turban, E., King, D., Lee, J., Warkentin, M., & Chung, M. (2006). E-commerce: A managerial perspective. Low Price Edition, 180-183.
37. Wilding, N. (2016). Cyber resilience: How important is your reputation? How effective are your people. Business Information Review, 33(2), 94-99.
38. Williams, L. J., & Anderson, S. E. (1991). Job satisfaction and organizational commitment as predictors of organizational citizenship and in-role behaviors. Journal of management, 17(3), 601-617.
39. Zikmund, W. G. (2003). The research process: an overview. Business Research Methods, South Western: Cengage Learning.