An Achilles heel of today's armed forces: Managing software supply chain risk in the military sector

Today's armed forces are highly dependent on software. Software products are built by complex networks of software components, software vendors, service providers, and other companies that, together, form the software supply chain. In "conventional" cybersecurity incidents, threat actors usually gain direct access to their target. But in the case of the software supply chain, the risks originate upstream in the supply chain itself and have an impact on entities downstream - often the end users. The armed forces are particularly vulnerable to these risks. Software supply chain incidents in the military sector have caused disruption and allowed malicious actors to engage in industrial espionage, political espionage, and sabotage. Policymakers and the Bundeswehr can manage software supply chain risk in the military sector through a set of measures. First, decision-makers should determine the requisite level of protection for the various areas of software use to strike a balance between risk management, on the one hand, and the functionality, cost, and speed of deployment, on the other. Thereafter, the Bundeswehr should establish effective risk management. Further, the federal government and the Bundeswehr should ensure that software suppliers reduce the software supply chain risk posed by their products. By doing so, the armed forces can be given adequate protection.