Cybersecurity presents a monumental challenge for interconnected supply chains, as an attack on one node can compromise an entire business. In this paper, we propose a game theory model to investigate cybersecurity investments with third-party risk propagation in a two-echelon supply chain consisting of one retailer and n suppliers. The optimal investments and their responses to relevant security characteristics, such as intrinsic vulnerability, propagation probability, number of suppliers, and attack probability, are analysed and discussed both theoretically and numerically considering one-stage risk propagation. It is found that there are serious prisoners' dilemma and free-riding phenomena in such a scenario. To mitigate third-party risks and improve the investment efficiency, three coordination mechanisms, joint decision, security risk compensation, and security information sharing, are presented and compared numerically. The results indicate that joint decision-making and security risk compensation perform better on stimulating firms' investments and reducing expected costs both individually and collectively relative to security information sharing. Furthermore, the case of two-stage risk propagation is also supplemented and compared with one-stage case. Based on these findings, some management insights are recommended to cybersecurity managers in supply chains for designing more efficient cybersecurity mechanisms and investment strategies.

Cybersecurity presents non-negligible challenges for firm collaboration and supply chain viability, as information exchange among nodes introduces potential interdependent risks. How to make appropriate decisions on security investments and information exchange modes is a significant issue for supply chain members. Considering two information exchange modes: system interconnection and system independence, this study develops two game models to investigate the cybersecurity investments in a vertical supply chain composed of a retailer and n suppliers. Initial analysis shows that although firms learn investment decisions mutually in the face of a changing cybersecurity environment, suppliers always take a free ride on the efforts of retailer in two cases and the increased interdependent risks will damp nodes enthusiasm for security investments. Next, to compare the two cases, we introduce information exchange efficiency as the mediate parameter to link degree of system interconnection and proportion of information shared. We found that under the system independence mode, firms with high information-exchanging demand in the large-scale supply chain are more motivated to invest in cybersecurity. Furthermore, we extend our models to a centralised decision-making scenario. We find that security investment efficiency is greatly improved, and the free-riding behaviour of supplier is significantly reduced when systems are interconnected.

Network interconnection and information sharing among firms and their departments expose them to cybersecurity breaches. Traditional cybersecurity studies have paid little attention to the reallocation of security investment within firms. This paper proposes a mathematical model for optimal allocation of cybersecurity investment among headquarters and branches with budget constraints. The differences in size of information sets and system interconnection have been taken into account. The responses of optimal allocation to internal and external factors, such as the portion of branch information set, the propagation probability, the budget constraints, and the intrinsic vulnerability, have been studied in deep both theoretically and numerically. Analysis results indicate that the group will give priority to protecting headquarters when the total budget is small and intrinsic vulnerability is high. The security investment allocated to each branch increases with budget, propagation probability and portion of information set, but never exceeds $1/(n+1)$ of total budget. Numerical simulations also verify that security information sharing among headquarters and branches can help improve the efficiency of security investment in the whole system. Furthermore, the findings of this paper will draw attention to the reallocation of cybersecurity investment within a business group and help cybersecurity managers to develop investment allocation strategies and policies.

This paper studies a container slot allocation problem with dynamic pricing for time-sensitive cargo considering port congestion. Time-sensitive cargo calls for express delivery as soon as possible, and hence a new pricing pattern is proposed considering port congestion. To solve the slot allocation with dynamic pricing issue, a one-phase allocation model which is from different points of view on slot allocation strategy is proposed to formulate this problem. Finally, numerical examples are carried out to test the applicability of the proposed model and solution algorithm.