## 6 Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**AP No.**} & \multirow{2}{*}{**Attack Paths**} & \multirow{2}{*}{**Evidence Chains**} & \multirow{2}{*}{**Exploitation Level**} & \multirow{2}{*}{**Exploitation**} & \multirow{2}{*}{**APEL**} \\  & & & & & **Chain (ELC)** & \\ \hline
1 & A5,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V1 & V1 \(\rightarrow\) IoC1 \(\rightarrow\) IoC2 & H\(\rightarrow\) IoC1 \(\rightarrow\) IoC2 & \(0.75\times 1\times 1=0.75\) & H \\
2 & A9,V2 \(\rightarrow\) Al,V2 & IoC4 \(\rightarrow\) IoC3 & IoC4 \(\rightarrow\) IoC3 & \(1\times 1=1\) & VH \\
3 & A8,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) Al,V2 & V1 \(\rightarrow\) IoC1 \(\rightarrow\) IoC2 & M \(\rightarrow\) IoC1 \(\rightarrow\) IoC2 & \(0.5\times 1\times 1=0.5\) & M \\
4 & A4,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) Al,V1 & A4,V1 \(\rightarrow\) A9, IoC1 \(\rightarrow\) Al, IoC2 & M \(\rightarrow\) IoC1 \(\rightarrow\) IoC2 & \(0.5\times 1\times 1=0.5\) & M \\
5 & A5,V3 \(\rightarrow\) A6,V1 \(\rightarrow\) A8,V1 & A5,V3 \(\rightarrow\) IoC5 \(\rightarrow\) IoC6 & H \(\rightarrow\) IoC5 \(\rightarrow\) IoC6 & \(0.75\times 1\times 1=0.75\) & H \\
6 & A5,V3 \(\rightarrow\) A6,V2 \(\rightarrow\) A8,V1 & A5,V3 \(\rightarrow\) A6, IoC7 \(\rightarrow\) A8, IoC6 & H \(\rightarrow\) IoC7 \(\rightarrow\) IoC6 & \(0.75\times 1\times 1=0.75\) & H \\
7 & A7,V1 \(\rightarrow\) A6,V3 \(\rightarrow\) A8,V1 & A7,V1 \(\rightarrow\) A6,V3 \(\rightarrow\) A8, IoC6 & H \(\rightarrow\) H \(\rightarrow\) IoC6 & \(0.75\times 0.75\times 1=0.56\) & M \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Prioritised attack path. Hence, the combination of threat actor capability, i.e., skill, motivation, and location, with the availability of exploitability features justifies the prioritised attack paths. Healthcare information infrastructure is an attractive target for the threat actor due to the potential benefits of obtaining sensitive patient data. In recent years, the value of personal medical data has increased on the black market. Credit card information sells for USD 1-2 on the black market, but personal health information (PHI) can sell for as much as USD 363. Therefore, the proposed attack path discovery and prioritisation provides an effective way to identify the potential attacks and undertake suitable control to tackle the attacks. Cybersecurity issues should be considered from the design stage of the medical devices, otherwise risks will continue to grow. Medical devices are no longer a standalone component, but they are rather connected with other devices for overall healthcare service delivery. Vulnerilities in connected devices used in hospital networks would allow attackers to disrupt healthcare service delivery and medical equipment. There is a need for sound and proven cybersecurity approaches for ensuring overall security. Threat actors tend to exploit vulnerabilities within a network and form attack paths from one asset to another until they have reached the asset they wish to harm. The proposed approach assists in identifying the common vulnerabilities that can be exploited within the healthcare context so that the necessary course of action can be taken into consideration.