# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 3 Threat Modeling for Supply Chain Contexts
### Threat Modeling Process  
The underlying process involves a systematic approach to identify the organization's supply chain system, internal infrastructures, business processes, attack context, and relevant controls. The process consists of four main phases, as shown in Figure 2.  
Figure 1: The meta-model. **Phase 1: Determining organization objectives**  
The aim of this phase is to identify the overall organizational CSC environment including goals and requirements. It includes three activities which are briefly mention below:  
* _Activity 1: Identifying the organizational supply chain environment_ This activity identifies CSC systems and the external organization, suppliers, distributors, and third party vendors on the inbound and outbound supply chains. The purpose is to identify the vendor's software, hardware, and network design process and policies. This informs strategic management whether the organizational goals are achievable, repeatable, and measurable. * _Activity 2. Define the approach to achieving the goal_ This activity identifies necessary actions required to achieve the organizational goals. The organizational goal is to provide safe and reliable service to consumers, while the security goal is to ensure that the supply chain system is secure, reliable, for the overall to achieve business continuity and information assurance. * _Activity 3. Capture the CSC requirements_ This activity involves capturing the overall CSC requirement on the inbound and outbound supply chains to ensure the security goal and constraints. The requirements ensure proper integration and interfacing with vendors. Here, the systems development life cycle (SDLC) concepts are used to capture the requirements. **Phase 2. Attack Process**  
The attack process identifies the activities of a threat actor and the TTP used to deploy the attack. The phase involves complex activities as all the stakeholders may have different system components, requirements, processes, and infrastructures. The attack pattern may be determined based on each stakeholder's business goal, objectives, and the size of the business. The activities include:  
**Activity 1. Attack Steps**  
In this phase the threat actor explores the organizational system, and the supply inbound and outbound chains, as shown in Figure 3. The attack steps are as follows:  
Figure 2: CSC threat modeling process. **Step 1. Reconnaissance:** The adversary carries out research online and uses other social engineering methods to gather information such as:  
* What infrastructure is the organization using: topology, IPs, software, or configurations;
* Profile of the organization, business applications, third party vendors, and other organizations;
* Is the supply chain a corporate and public network system (e.g., virtual private network VPN);
* What type of attack can be initiated (e.g., malware, redirect script, injection, and phishing)? For instance, the adversary could use passive attack tools such as Nmap or Kali Linux. **Step 2. Experiment:** The adversary uses various attack methods (TTP) and tools to penetrate and gain control of the victim's systems to try and explore vulnerable spots. For instance:  
* The adversary creates an executable malware remotely;
* The adversary inserts a remote access Trojan (RAT), and the malware is installed and executed when a user downloads or opens it through a spear phishing email. Figure 3: Adversary attack steps. **Step 3. Exploit**: At this stage, the threat actor gains control of the systems and determines the attack goal. The threat actor penetrates the workstations of the internal users, gains access into the system resources and the supply chain environment, and manipulates the organization's products. **Step 4. Command and control:** The adversary uses remote access and Advance Persistent Threat (APT) techniques to establish control of the CSC system, at which point they are able to monitor business processes and activities, and to manipulate the system, exfiltrate information, and obfuscate. **Phase 3.