# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 6 Illustrative Example: Water Distribution System
### Introducing Countermeasures into the Dependency Model  
Figures 9 and 10 show the updated parts of the dependency model where a range of changes and countermeasures have been introduced to reduce the risks to the segment of the pipeline and to increase the success of the root paragon. Figure 9 shows the updated dependencies of the paragon \"All field devices are functional and fault-free\", which in its turn is one of the dependencies of the paragon \"All hardware is functional and fault-free\", as shown in Figure 6.  
In order to deal with the risks posed by the failure of the passive and active field devices in the examined segment of the pipeline (in this case, these are the pressure sensors 1 and 2, the shutoff valve, and the pump), we have introduced a field device replacement support service, which guarantees that any damaged field device that goes out of order either due to wear and tear or due to any abnormal conditions will be promptly replaced or repaired. Using an appropriate software interface, an engineer is able to read (upload) parameter  
Figure 8: Three-Point Sensitivity Graph for the Water Distribution SCADA System. values from an old device and write (download) them onto a new device to expedite the replacement process. The replacement process also includes the examination of the stored device values in order to support the analysis of the device behaviour and troubleshooting. The new countermeasure is included in the model as a leaf node \"Field device replacement is fast and efficient\" (Figure 9). It is connected using an OR relationship with the new paragon \"All passive and active components are operational\" which unites under its umbrella the two paragons \"All passive components are operational\" and \"All active components are operational\", which are adopted from the original model shown in Figure 6. In Figure 9, the RTU2 is replaced with a new device, and the probability of its faulty behaviour is reduced from 0.2 to 0.04. The above two measures led to the increase of the success probability of the paragon \"All field devices are functional and fault-free\" from 0.231 to 0.9216 (compare Figures 6 and 9). Figure 10 presents the updated dependencies of the paragon \"The operator looking after the pipeline is Okay\". The three-point sensitivity chart in Figure 8 flagged that the operator's appreciation of the safety and cyber security procedures (or the lack of thereof) affects the core goal the most. In order to mitigate this risk, we introduced a new countermeasure where the SCADA system enforces strict access control and other security policies (e.g., access to information based on the need-to-know approach, disallowance of the use of mobile and USB devices and disabling the AutoRun feature). We introduce this paragon as a countermeasure using an OR logical operator. We declare the observed state of this new paragon as \"YES-1.00\", since we consider the new state of the system where all these measures are fully implemented. The introduction of this countermeasure increases the success probability of the paragon \"The operator looking after the pipeline is Okay\" from 0.65 to 1.00 (compare Figures 7 and 10). Figure 9: Introducing _Field Device Replacement_ as a Countermeasure. Figure 11 shows the state of the top level of the dependency model after introducing all countermeasures discussed above. This figure demonstrates that the introduction of countermeasures resulted in the increase of the success probability of the paragon \"The system architecture is reliable and secure\" from 0.1532 to 0.61 (compare Figures 6 and 11). As a result of all changes, the success of the root paragon has increased from 0.0996 to 0.61 (Figures 5 above and 11 respectively). Risk assessment and the introduction of additional countermeasures, as well as the increase of success of highly sensitive paragons, should continue until the success probability of a core goal reaches an acceptable value. In this example, we assume that 0.61 is an acceptable value and stop the analysis at this point.