# Enhancing Cybersecurity Through Comprehensive Investigation of Data Flow-Based Attack Scenarios
## 1 Introduction  
Digital solutions are designed to ensure that desired information flows between different components of the system, as in the case of construction equipment management systems. These systems use various technologies, such as GPS, IoT, and wireless communication, to achieve the required functionality. However, due to continuous integration and essential information exchange, the risk of data leakage, vulnerability exploitation, and compromised information flows is continuously growing. Any weaknesses, when data either sit at rest or travel between different nodes, can provide passage to malicious actors. Interception and manipulation of data during transmission are not just theoretical concerns but are actively exploited by cybercriminals [1]. One way to counter these issues is the use of the STRIDE framework and the Microsoft Threat Modeling tool. This approach is widely used to enumerate potential security threats in systems by categorizing threats into six types, namely, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Nevertheless, it does not provide a detailed mapping of attack paths, which are sequences of actions an adversary may take to exploit the threats reported by the Microsoft Threat Modeling tool. One of the most important challenges today arises from the growing threat landscape of cybersecurity, primarily due to growing system complexity induced by integrating IoTtechnologies into industry [2]. These new vulnerabilities and attack paths make it increasingly necessary to develop comprehensive approaches for threat modeling. Although STRIDE serves as a valuable foundation for enumerating threats, it often lacks detailed mapping of the sequences of threats that could be exploited by attackers to execute cyberattacks. This limitation can leave critical systems vulnerable to sophisticated multi-step attacks that exploit overlooked pathways [3]. On the other hand, the fact that STRIDE is based on individual components rather than looking at the holistic system interactions may cause incomplete threat assessments, particularly in complex IoT systems [4]. In addition, existing methods often do not take a systematic approach to quantifying potential impacts of identified threats, which may imply that security practitioners are often left with prioritization challenges related to potential impacts of identified threats [5]. This being the case, there is huge responsibility on system integrators to ensure the reliability and security of their IT infrastructure with respect to functionality, performance, vulnerabilities, threats, and possible attack surfaces. Lately, this challenge has been handled by physically securing digital assets; however this is no longer sufficient, as the triplet of humans, technology, and organizations has become too complex to restrict various unwanted activities. For instance, people who write programs do not consider a global view of the environment in which the application will be integrated. The interactions an application will make can introduce potential security gaps. In this scenario, extending STRIDE to map threats into attack paths and scenarios will allow designers, developers, system integrators, and security professionals to interrogate whether or not the things around them are eminent solutions. An attack scenario refers to a sequence of attack paths that an attacker might follow to exploit vulnerabilities and compromise a system. Even perfect functionality may still lead to catastrophic events if proper threat modeling and risk analysis are not performed before deployment. In such situations, understanding various attack paths draws immediate attention to the most critical areas at the system architecture level, along with vulnerable entry points and weaknesses of existing defense lines. Sometimes weakness is a result of a very unlikely placement, while sometimes it is obvious from its origin and location, exposure to and from the world, and accessibility options.