# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 4 Research Methodology
### Data Collection--The Mind Mapping Workshops  
In order to capture expert knowledge, a mind mapping exercise was conducted with a group of ICS/SCADA experts during the 3 rd UK Workshop on Cyber Security of ICS and SCADA systems. The SCADA mind mapping workshops were also run in Sweden with selected industrial collaborators of the Swedish Centre for Resilient Information and Control Systems (RICS) www.rics.se (accessed on 27 March 2022). We also employed SCADA experts online via professional networking sites. Overall, 36 domain experts participated in the mind mapping exercise. Twenty-one responses were captured during the workshop with the UK-based experts in cyber security of ICS and SCADA. Twelve mind maps were collected at the RICS centre. Three SCADA experts were employed via LinkedIn. All participants irrespective of the mode of participation followed the same procedure. The exercise took approximately one hour.  
During the mind mapping workshops, the participants were invited to produce mind maps of a SCADA system. We aimed to establish how domain experts conceptualise and mentally represent the dependencies within a SCADA system. Prior to the exercise, the rules of mind mapping were explained to the participants, and they were presented with several mind map examples.  
The following instructions were given to all participants for the mind mapping exercise:  
* Place in the centre the name of the main topic--\"SCADA\" (use blue/black ink);
* Identify the major elements/components of a SCADA system, place them around the main topic and link them to the main topic with lines indicating dependencies within the system;
* For each new element of your mind map, identify sub-elements and connect them using lines to the element;
* Continue identifying sub-elements for each new element of your mind map until you reach the point where no more sub-elements may be specified;
* The most critical elements of a node--circle with red;
- The elements of medium criticality--circle with green; and
- The least critical elements of the node--do not circle.  
These instructions simplify the mind mapping guidelines provided in [21]. In our experiment, we did not ask the participant to draw any images or symbols to accompany the nodes of a mind map because the aim of the experiment was to elicit the hierarchy of dependencies rather than to produce a cognitively effective mind map. Typically, in mind maps, the links between nodes indicate unspecified connections among the element of the map. To avoid misinterpretations, the participants were instructed to use links only to indicate dependencies within a SCADA system. While working on their individual mind maps, the participants were instructed to answer the questions outlined below:* What is required for successful operation of a SCADA system?
* What does each element of a system depend upon?
* How critical is each element (colour-coded answer)?  
The participants were requested to work individually, and no discussions were allowed during the mind mapping exercise. This was done deliberately in order to prevent cross influences between the participants and to enable the independence of responses. However, after the mind maps were finished, the participants were invited to observe mind maps of their colleagues and exchange opinions, and to add additional elements to their mind maps if they felt any were missing.