# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 4 Evaluation
### The Process  
We used the processes and conceptual approaches in Table 2 to support our study. **Phase 1. Attacks on ECG smart grid infrastructure**  
We consider a smart grid communication path and security application using concepts from the IEC 61850 Smart Grid Interoperability Guide [35] and NIST Smart Grid Interoperability Standards [36] with its three-tiered hierarchical structure interconnected with intelligent electronic devices (IED). Tier 1 covers the transmission and distributions domains, using high-bandwidth communication media such as WiMAX and Fiber on a wireless area network (WAN). The IED monitors and control the electric power transmission to the distribution system using the pharos monitoring unit (PMU) for measuring instantaneous bus voltage, line current, and frequency. The command center integrates with the SCADA system servers and uses a switchboard to establish communication with the IED units [13]. Tier 2 provides a gateway for the Wireless Area Network (WAN) technologies and communication \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Concepts** & **Properties** & **Descriptions** \\ \hline Goal & Organizational goal & Distribute electric power to customers \\  & & Generate utility bills, \\  & & Receive payments \\  & & Provide vendors remote access to CSC Secure systems \\ Actors & Security goal & Employees: internal and external \\  & Suppliers & Suppliers \\  & & Distributors \\  & & A person, user account, or processes that can be identified by the intent, motives, and capabilities of an attacker \\ Requirements & Organizational requirement, user categories, ID, stakeholders, description, acceptance criteria & Specify high level organizational environment overall and integrate with the security constraints to achieve the organizational goal \\ Supply Chain System & Inbound & Organizations \\  & & Financial institutions \\  & & Third party vendors \\  & & Individual consumers \\  & Outbound & Services providers \\  & & Organizations \\  & & Stakeholders \\  & & Power transmission company \\  & & Sub-stations \\ Vulnerability & Router, firewall, wifi Remote services: remote login, remote command execution & CSC Source and destination, Timestamp, \\  & Dynamic, host configuration protocol, (DHCP) server logs & Domain name, TCP/UDP port number, media, MAC address IP Address \\ Attack & Attack goal & Compromise system of: \\  & Attack pattern & Malware, spyware, injection \\  & Attack prerequisites & Information on vulnerabilities \\  & Attack vectors & Mechanisms to deploy attack \\  & TTPs & Tactic, Technique, \& Procedure \\ Threat & Indicators & Determines vulnerabilities, flaws, and loopholes that can be exploited by a threat actor or a threat agent \\  & & Specific observable patterns \\  & & SCS threat activities \\  & & Adversary behaviors \\  & & Risky events \\  & & State of an incident \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Mapping the case study with the meta-model concept. utilities to have access to the customers' premises for the advanced meter infrastructure (AMI) and demand response applications. It uses a collection of Intelligence Electronic Devices (IED) units to collect the various Phasor Measuring Units (PMUs). Tier 3 integrates the local area network with the customer management systems (CMS) and uses the IED to communicate with the smart meter, which aggregates sensor information from various home appliance devices. We present the attack modeling concepts and steps in Figure 4.  
**Activity 1. Determine attacks on the CSC**  
A Threat Actor may be an internal employer or may come from an external source. Several attacks can be initiated on the CSC by the threat actor. As indicated in Figure 4, (P) represents Penetration and (AT) represents Attack. Tier 1: smart grid integrates with SCADA system servers and uses a switchboard to establish WAN communication with the IED units. Tier 2: uses IEDs to connect with AMI and demand response applications. Tier 3: uses LAN to integrate with the CMS and uses the IED to communicate.