# Enhancing Cybersecurity Through Comprehensive Investigation of Data Flow-Based Attack Scenarios
## 3 Proposed Approach
### Methodology
#### 3.2.3 Impact Enumeration
We start with the DFD, consisting of a set \(E\) of generic entities only of size \(l\), where \(e\in E\). Our proposed approach retrieves the working dataset \(tList\) of size \(n\times m\) such that each \(t\in tList\). Each \(t\) contains \(m\) attributes such that \(t=\{tId,tDes,tTitle,tCat,tIntr\}\). A threat \(t\) originates from an entity \(e_{i}\) during information exchange and endangers the destined entity \(e_{j}\) and/or itself, also shown in Figure 3. It is clear from the case in Figure 3 that the entity named 'ControllerProcess' has an information flow through 'driveController()' to itself and another data flow to entity 'DoorProcess' through 'openDoor()', closeDoor()' and 'lockDoor()'. This creates at least three points of information leakage. Depending on the contents of the in-flow information, corresponding threats will be present; among others, these are our point of interest. This process is used to calculate how and where each point of interest leads, helping to identify security holes. Let \(aList\) be the attack list derived from \(tList\), where \(a\in aList\), as presented in Algorithm 1 line 1. To create the attack profile, in addition to \(\{tId,tDes,tTitle,tCat,tIntr\}\), further information is determined such that \(a=\{ald,tId,tDes,tTitle,tCat,tIntr,aEft,aSrc,aDst\}\), where \(ald\) is the attack ID, \(tId\) is the corresponding threat ID, \(tDes\) is the threat description, \(tTitle\) is the threat title, \(tCat\) is the threat category, \(tIntr\) is the interaction which caused the associated threat, \(aEft\) is the resulting effect, \(aSrc\) is the source of the attack, and \(aDst\) is the destination of the attack. We initialize \(aList\) with \(tList\); \(aList\) then continues to traverse \(tList\) to further compute \(a[aEft]\), \(a[Src]\), and \(a[aDst]\). Here, \(a[Eft]\) is the result of the threat originated by \(aSrc\) to \(aDst\). This can be understood using the DFD diagram, example 1, which shows that 'FleetController' can cause a 'Crash' to 'RemoteController'. To determine these attributes, each threat \(t\) is evaluated based on the corresponding \(t[tCat]\) to compute the impact \(a[aEft]\) and identify the origin \(a[aSrc]\) and destination \(a[aDst]\). ```
1:load \(dfd\)
2:generate \(tList\)
3:Initialize \(aList\gets tList\)\(\triangleright\) populate attack list
4:repeat
5:for each\(a\in aList\)do
6:\(c\gets a[tCat]\)\(\triangleright\) get threat category
7:if c == 'Spoofing' then
8:if a[tDes]endswith 'destination process' then
9:\(Effect\gets False\)\(\triangleright\) data flow is outside the trust boundary
10: Impact goes to Information Disclosure
11:else
12:\(Effect\gets extractfrom(a[tDes])\)
13:endif
14:elseif c == 'Tampering' then
15:if a[tDes]endswith 'data store' then
16:\(Effect\gets^{\prime}Corruption^{\prime}\)
17:else
18:if a[tDes]contains (denial of service) | (elevation of privilege) | (information disclosure) then
19:insertRow(aList,3) \(\triangleright\) threat path for each category
20:\(Effect\gets False\)
21: Impact goes to [Denial Of Service | Elevation Of Privilege | Information Disclosure]
22:endif
23:endif
24:elseif c == ['Denial Of Service' | 'Elevation Of Privilege' | 'Information Disclosure'] then
25:\(Effect\gets extractfrom(a[tDes])\)
26:elseif c == 'Repudiation' then
27:\(Effect\gets extractfrom(a[tTitle])\)
28:endif
29:\(a[aEft]\gets Effect\)





First, we evaluate those threats which can impact other categories, such as spoofing and tampering. For spoofing, threats may originate due to interactions across the trust boundaries, as shown in Algorithm 1, line 5, which implies the fact of threat propagation to other threat categories at line 8. The concept of the trust boundary is explained in the DFD diagram, Section 4, where 'SiteOperator' and SiteServer' are within the trust boundaries but 'SiteServer' and 'FleetController' are outside of it. In the case of tampering, threats related to data stores can cause data corruption, as shown in line 14, but do not lead to additional attacks.