# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 3 Threat Modeling for Supply Chain Contexts
### Threat Modeling Process
Threat modeling using STIX**  
In this phase, we used the STIX visualization (STIXviz) tool to model the attack process. The STIX tool uses eight constructs such as adversary attack, cyber attack campaign, incidents, exploit targets, threat actors and TTP to generate a structured cyber threat model [14]. However, for our model, we adopted some of the constructs to model the activities, such as observable, indicators, campaign, threat actor, and TTP, to describe the interrelations and actions an attack may take to penetrate and manipulate the CSC system. **Activity 1. Observable:** These are the base constructs that are used to determine the measurable events pertinent to the operations of computers and the network. [7] These includes technical and non-technical. We identified all the CSC infrastructures as listed in Phase 1: Activity 1. These included the network systems, Supervisory Control and Data Acquisition (SCADA), Remote Terminal Unit (RTU), Communication devices, and many more. **Activity 2. Indicators:** Indicators are parameters that express the nature of the attack and whether it is imminent, in progress, or has already occurred [24]. We used CSC threat activities, adversary behaviors, risky events, or state of the incident to determine what could serve as an indicator. **Activity 3. Campaign:** The campaign explains the instances of the threat actor pursuing intent, as observed through sets of incidents and TTP. The intended effect of the threat actor penetrating a supply chain and manipulating the distribution and delivery channels could be a malware attack that is being delivered through spear phishing, or rootkit installation attack, as explained in Phase 3. **Activity 4. Threat Actor:** The threat actor construct identifies the attacker based on the campaign activities. Threat Actors are characterized as malicious actors representing a threat including presumed intent and historically observed behaviors [31]. **Activity 5. TTP:** TTPs consist of the specific threat actor behaviors exhibited in an attack. The campaign, indicators, and threat actor activities determine the TTP that are deployed on the supply chain system as explained in activity 2, 3 and 4. TTP leverages on resources such as tools, capabilities, and personnel to penetrate and manipulate system. **Activity 6. Exploit target:** Exploit targets are the vulnerable spots on the supply chain infrastructures such as software, network system, or configurations that are targets for exploitation by the TTP of a threat actor. **Phase 5. Controls:** To incorporate controls into a supply chain system, we used knowledge of actual attacks that have occurred in the past. To ensure proper security controls, the organization must form a strategic team to identify, investigate, review, and evaluate the supply chain system processes and applications. We identified the following controls:* **Directive controls** are more strategic, where risks are identified and assigned to specific inbound and outbound supply chain requirements. * **Preventive controls** are policies implemented on associated risk probabilities that are intended to preclude actions violating policy or increasing third party risk. This includes supply chain risk assessments and audits. * **Detective controls** use attack indicators to identify practices, processes, and tools that identify and possibly react to security violations. These include firewalls, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) configurations. * **Corrective controls** involve measures such as courses of actions and CSC risk management designed to react to detections of an incident in order to reduce or eliminate the opportunity for the unwanted event to recur. * **Recovery controls** are mechanisms put in place to restore a system to its original state once an incident has occurred and resulted in compromising integrity or availability. These include countermeasures, backups, segmentation, and incidence response strategy.