# Enhancing Cybersecurity Through Comprehensive Investigation of Data Flow-Based Attack Scenarios
## 1 Introduction
A very efficient function can suffer from security holes that might not have been imagined or considered during the security development life cycle. There are several ways to misalign the designed internal functionality. One approach is to exploit the data flow between different actors, as even a foolproof system design can still leak information about the system. Depending on the transmission channels, data encapsulation method, data protection technique, and data communication protocol, it is possible for data in transition to be more exposed to security challenges compared to the data at rest. An important domain of cybersecurity research is attack scenario analysis, particularly in IoT systems and industrial environments [6, 7]. This approach is represented by the mapping of potential attacker action sequences to provide a comprehensive view of system vulnerabilities. Recent studies have suggested that especially complex and highly interconnected environments can be secured with security measures designed upon a basic understanding of these attack paths [8]. While improvements are seen in threat modeling and the analysis of attack scenarios, a considerable gap exists with respect to the integration of these approaches with data flow analysis in IoT and industrial systems. To the best of our understanding, existing methodologies fail to capture the dynamic nature of data flows in these environment domains, leading to incomplete threat assessments. Our research aims to address this gap by developing a comprehensive methodology that combines STRIDE-based threat modeling with detailed data flow analysis and attack scenario mapping. Therefore, we present a solution that aims to confront adversarial behavior against the flow of data, i.e., to identify the impact of threats and the depth of attacks that exist in a system design based on the information flow. The proposed solution is augmented with a verified actor-based system design and a threat list to discover attack scenarios automatically. At first, we systematically analyze the threat landscape using our customized threat enumeration technique for each entity in the data flow diagram, explained in more detail in Section 3.2.2. In general, instead of naive reasoning, we aim to quantify the probability of actions, i.e., from threat list to attack scenarios. We describe these contributions in further detail with our threat intelligence process. This study is motivated by the fact that interoperability increases the attack surface, while early attack impact analysis reduces attack probability and impact. In view of the identified limitations of current cybersecurity practices for IoT and industrial systems, the key problems to be addressed by this research are: (i) lack of full-fledged mapping of multistep attack scenarios in complex interlinked systems; (ii) inadequate integration of data flow analysis with threat modeling techniques; and (iii) lack of systematic methods for quantifying and prioritizing the impacts of identified threats. Within this context, the specific research goals are as follows: (a) to enhance the STRIDE framework by detailing attack scenarios in IoT and industrial systems; (b) to develop a methodology describing how data flow analysis can be introduced into the threat modeling process to provide an extended security assessment; (c) to develop a systematic approach for identifying and prioritizing threats according to their impact; and (d) to prove the applicability of the proposed procedure by implementing a case study in the automotive sector. It is important to note that the contributions made in this study relate to security by design, seeking to aid system designers and integrators when designing or updating system components. Because we focus on data leakage when data are in flow, the design time data flow diagram is the main focus of simulating security posture.