# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 4 Evaluation
### Scenario 1. Remote attack on the CSC system  
The organization security team found that an adversary had intruded in the CSC system. The threat actor had compromised the workstation of the CMS that interfaced with suppliers, distributors, and third party vendors. The organization's electronic products had been altered for some time. The CMS generated inaccurate customer electricity consumptions, which compromised the amount the customers were paying for their utility bills, their online payments, and third party vendor systems. The organization used two types of payment systems, the prepaid system and postpaid system, that were all integrated into the CMS and HEMS. Using the formula for calculating conditional probabilities and Activity 1 and Table 4, we determined the vulnerable spots, the severities of manipulation in percentages, and threat indicators. **Scenario 2: Spear phishing email attack**  
A spear phishing email was sent to the organizational web server and it was noticed that the malware had infected 200 staff email addresses, with 160 that had their data corrupted, 27 that were detected by the spam filter, and 205 that were not detected. The number of users that clicked on the attachment was 220. The number of clicks on the malware attached message divided by the total number of viewers of that message represents the probability of opening the infected email. Following the formula in Phase 3 Activity 3, we used discrete probability to calculate the probability of emails that were infected on the supply chain as follows:  
\[\mathrm{P}=\frac{P_{\mathrm{S}}\mathrm{C}(1-r^{-})}{v}\] \begin{table}
\begin{tabular}{c c c c c} \hline
**Scenario** & **Vulnerable Spots** & **Penetration** & **Manipulation\%** & **Probability** & **Threat Indicators** \\ \hline
1 & Firewall & Y & 70 & High & Wrong Firewall \\
2 & IDS/IPS & Y & 60 & High & Configuration \\
3 & Vendor & Y & 80 & High & Audit \\
4 & Network & Y & 40 & Medium & Sub-netting \\
5 & IP & Y & 55 & Medium & Segmentation \\
6 & Database & Y & 75 & High & Sanitizations \\
7 & Software & Y & 75 & High & Reprogram \\
8 & Website & Y & 90 & High & SSL/TLS \\ \hline \end{tabular}
\end{table} 
Table 4: Probability and threat indicators. Results:  
P = Ps*C(1-r\({}^{-}\))/v  
Pa = 200*(220-27)/205  
Therefore, P = 188.29 (the probability of an opened and infected email)  
**Activity 4. Probability theorem**  
Probability (P) is the likelihood that an attack or event will happen. For the study, we identified 10 types of attacks that could be initiated on the supply chain system. These attacks were spyware, ransomware, RAT, spear phishing, SQL injection, XSS, DoS, redirect script, cross site request forgery, session hijacking, and hard-coded passwords. To pick an attack such as malware or SQL injection from a scenario of 10 attacks where spyware, ransomware, RAT, and spear phishing attacks were all classified as malware was 1/10. For a scenario where the second attack is conditional on the first (e.g., manipulation is dependent on penetration), we used the formula:  
P(A or B) = P(A) + P(B) - P(A and B)  
P(A + B) = P(A) * P(B/A) Where {B/A is 'B given A'}  
Bayesian Probability Theorem  
We used Bayes' theorem to explain the dependent probability. [PERSON] theorem could be used calculate the probability that manipulation would occur and cause a cascading effect on the supply chain based on some pieces of evidence that were present. For a scenario where the second attack is conditional on the first, (manipulation is dependent on penetration) we determined that if, for instance, an organization had 370 manipulations out of 796 penetrations within a given period in a supply chain environment, then in simple terms the probability is 370/796 = 0.046 (<50%).