# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 3 Threat Modeling for Supply Chain Contexts
### Conceptual View  
As stated previously, we considered concepts from the supply chain, threat modeling, and goal modeling domains. These concepts and their properties provided us with an in-depth understanding of the threat actor's intent, motives, and methods, which was needed to model attacks, analyze, and derive threat intelligence. **Goal:** A goal represents the strategic aim of an organization. Goals are realized by different factors based on organizational objectives and business processes. [PERSON] (1995) posits that a goal represents a condition in the world that an actor would like to achieve [2]. To achieve a goal, an organization must identify the various actors that will ensure the goal is attained or aborted. We considered both organizational and security goals. An organizational goal is the objectives carried out to meet the overall organizational strategy and vision, while security goals are control systems put in place to prevent threats, risks, attacks, and compromises. Security goals emphasize more of the threat actor's goal, in which the aim is to attack or abort the main organizational goal. The security goal is to ensure confidentiality, integrity, and availability for the overall supply chain systems, and its surrounding context [17]. **Actor:** An actor describes an entity that has goals and intentions within the system or within the organizational setting [2; 23]. The actors are the employees, suppliers, and distributors, as well as those with the potential to cause a threat to the supply chain system (which could be different from the threat actor). Legitimate actors or system users are categorized as organization employees, or users with permission to access or use the supply chain system. Actors can be recognized either by their password, process, identity, or privileges. Suppliers are the various organizations on the supply chain system, including distributors, third party vendors, and suppliers. A threat actor (adversary or attacker) is characterized as a malicious actor representing a cyber attack threat, with presumed intent and historically observed behavior [10]. For this study, we defined a threat actor as an entity that can breach or compromise the supply chain system, such as a person, user account, or process. Threat actors can be categorized as either intentional or unintentional, and internal or external. The threat actor is linked to the attack, vulnerability, and TTP in a many-to-many relationship. We identified threat actors through their capabilities, such as their intent, type of password used, observed patterns, behavior, history, and motives. **Vulnerability:** vulnerabilities are flaws or weakness that can be exploited by a threat actor or a threat agent. In an SC system, a vulnerable can be identified from various sources, including the software, network, website, user, process, application, and configuration, or from a third party vendor. The adversary could insert a hard-coded password as the default administrative setup into the COTS software and that could be a vulnerability when it is not changed after purchase. **Attack:** An attack is any deliberate action or assault on the supply chain system with intent to compromise its processes, procedures, and delivery of electronic products, information flows, and services. A supply chain compromise attack is the manipulation of product delivery mechanisms prior to receipt by a final consumer [15]. Attack properties include type, pattern, perquisites, and vectors. Attack pattern is an abstract mechanism for describing how a type of observed attack is executed [24]. **Tactics, Techniques, and Procedures (TTP)** is a representation of the behavior or modes of operations of the adversary or threat actor [10]. TTP leverages specific adversary capabilities, behaviors, and exploits it can use on victims. TTP could be used to gather cyber threat information about the attack pattern, resources deployed, and exploits exhibited.