# Threat Modelling and Beyond-Novel Approaches to Cyber Secure the Smart Energy System
## 5 Threat Modeling  
In general, threat modeling aims to identify threats and vulnerabilities within IT-related system architectures [57]. Furthermore, it helps to put security and privacy by design into practice. In this paper, a threat modelling approach is meant to secure a project setup with a systematic security analysis. In [42], a feasible list of requirements obtained by risk assessment for different components. In our paper, however, risk assessment is performed for each individual component, without analyzing their interaction within the overall system. Figure 3 depicts the threat model based, which is based on the demonstration use case from Section 4. The model was created by using the Microsoft Threat Modeling Tool [58], which works on data flow diagrams that describes data stores, processes and communication lines and provides threats based on the STRIDE model [59]. STRIDE divides threats into the following six categories:  
* Spoofing: refers to the illegally access and usage of foreign authentication information to obtain illegitimate access. * Tampering: is associated with the malicious modification of data. * Repudiation: denies an action that was performed by an entity without having a possibility to uncover this malicious action. * Information disclosure: denotes the exposure of information to users who are not authorized to have access to this information. * Denial of service: affects the availability of services so that they are not accessible for authorized users. * Elevation of privilege: denotes obtaining privileged access by an unprivileged user and thus ultimately the possibility of compromising the entire system. The Microsoft Threat Modeling Tool is not limited to a set of threats but offers the possibility to create individual templates for a given domain. Furthermore, we rely on the Azure cloud and IoT templates from Microsoft for the smart home area. We combine these templates with our own, which are based on our research in the smart energy domain. In the model itself, different trust zones were identified according to our use case. First,the trust zone of components is identified within the smart home, then in the outsourced cloud area and the immediate personal area. In the SG environment, the trust zones at the control center include DMS, SCADA and a monitoring system. At the substation level, two zones exist, namely, one that covers the PED and SwG, and a second dealing with metering components. Finally, measurement components that cover additional metering points in the network constitute a separate trust zone. In total, the modelling approach resulted in the identification of 1137 threats. These are classified according to STRIDE, with additional one that describes threats in smart home components. The latter also cover physical threats, which contribute to the overall number of threats. A list of all categories is given in Table 1.  
However, for the conducted assessment we rely just on the threats from Table 2. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Category** & **Amount** \\ \hline S & Spoofing identity & 51 \\ T & Tampering with data & 15 \\ R & Repudiation & 38 \\ I & Information disclosure & 33 \\ D & Denial of Service & 85 \\ E & Elevation of privilege & 116 \\ - & Smart energy components related & 798 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Threat assignment to category. Figure 3: Threat Model.