Patent Document ID: 9992219
Application ID: 14940005

Base Claim:
1. A method, comprising: generating a supply chain graph, the supply chain graph comprising a directed graph representation of a supply chain, wherein the supply chain graph comprises nodes that represent physical or logical locations in the supply chain and edges that represent objects and/or information that are stored and/or transmitted between locations in the supply chain; generating a first attack graph for the supply chain graph, the first attack graph representative of a sequence of attacks potentially performed at nodes of the supply chain graph, the first attack graph comprising data indicative of a first node of the supply chain graph at which the sequence of attacks can be initiated, the first node representative of a first physical or logical location in the supply chain; assigning a difficulty-consequence pair to the first node of the supply chain graph based upon the first attack graph, a difficulty value in the difficulty-consequence pair being based upon a determination of a degree of difficulty to perform an attack at the first node, and a consequence value in the difficulty-consequence pair being based upon a determination of an outcome of the attack occurring at the first node; generating a mitigation to the attack; determining an ability of the mitigation to at least one of increase a level of difficulty for the attack to occur at the first node or reduce the consequence of the attack occurring at the first node; in the event of determining that the mitigation increases the level of difficulty or reduces the consequence of the attack, outputting an indication that the mitigation is applicable at the first node; responsive to determining the ability of the mitigation to at least one of increase a level of difficulty for the attack to occur or reduce the consequence of the attack occurring, updating the supply chain graph based on the mitigation; and generating a second attack graph for the updated supply chain graph, the second attack graph representative of a sequence of attacks potentially performed at nodes of the supply chain graph subsequent to the mitigation being applied to the supply chain.

---

Claim 3:
3. The method of claim 1 , wherein a quantified risk of attack is determined based upon a susceptibility to attack at the node and the attack.