# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 3 Threat Modeling for Supply Chain Contexts
### Threat Modeling Process
Attack probability and cascading effects**  
The probability of a cyber attack on a CSC can be initiated in many ways. A threat actor requires full control of a compromised system in order to be able to remotely control malware propagation. **Activity 1. Cyber supply chain attack propagation**  
Cyber attack propagation changes as the supply chain application processes and operational technologies change. Therefore, it could prove difficult to use any purely quantitative method to formulate attack scenarios at this moment. Since the scenarios are specific to an organizational context, we considered subjective judgments to determine the estimated probability of a successful supply chain attack by using different attack scenarios. The variables that influenced the probability of a malware propagation attack were as follows:  
* **Penetration**: We assumed that the threat actor could penetrate the vulnerable spots on the inbound and outbound chain in all the scenarios. * **Manipulation**: This stage is where the threat actor gains access into the supply chain system and can manipulate data. Threat actor motives and intents were determined by the manipulation. * **Severity of attack:** The severity of an attack is determined by the extent to which a threat has propagated to the supply chain system. The severity of the attack and the cascading effect are used to determine the the required controls to mitigate the attacks. We categorized the attacks as low, medium, or high in all the scenarios we considered, as there were penetrations available to the threat actor that corresponded to the level of propagation on the targeted supply chain system. We considered Common Vulnerability Scoring System (CVSS) [32] concepts to determine the severity of attacks as low, medium or high malware propagation. The level of penetration and the severity of the attack determines the probability of a successful random distribution. The propagation was determined using a discrete probability scale of 0-100%. The degree of severity of each manipulation was calculated in percentages as low (\(\leq\)15%), medium (16 to 59%), or high (above 60%). Let,  
P: Penetration  
M: Manipulation  
\(P_{\text{a}}\): Probability of attack  
AT: Number of attacks  
S: Scenario  
\(n\): total numbers of scenarios  
\(S_{i}\): attack frequency  
Pg: level of propagation  
Sa: severity of attack or impact level  
\(\text{Pacc}=(\text{access}/\text{scenario})\)  
P(scenario) = \(1/n\), where \(n\): number of scenarios. \(a_{i}=\text{P(access}/\text{scenario})\), where \(i\): index  
We determined the level of penetration and the extent of manipulation by the percentage score used (Table 5). The formulae for calculating the conditional probabilities were as follows:  
\[P_{acc}=\sum_{i=1}^{n}P\left( \begin{array}{c}a\\ s\end{array} \right)\cdot\text{P}(S_{i}) \tag{1}\]Table 5 provide a list of attacks on the vulnerable spots that attackers can penetrate, the extent of manipulation and the percentage of each attack probability. Thus, we calculated the estimated expected value for the probability of attack success as:  
\[P_{acc}=\frac{1}{n}\sum_{i=1}^{n}a_{i} \tag{2}\]  
The goal of the threat actor is twofold: penetration and manipulation. We assumed there were 8 vulnerable spots and 10 targeted devices (AT1-AT10) on the CSC system (Figure 4). The threat actor's motive is to acquire a higher level return value by penetrating the command center workstation, and to maintain command and control using advanced persistent threat methods. Our objective was to determine the likelihood of an attack, its level of propagation and the cascading effects. Inputs contained a group of scenarios. We simulated attack scenarios using propagation methods. The initialization worked by repeatedly scanning input probabilities to determine the most and least values, then put them together to fill the vulnerability column.