# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 3 Threat Modeling for Supply Chain Contexts
### Conceptual View
TTP is relevant for identifying threat actors, campaigns to provide CSC threat intelligence on adversary's motives, intended effects, and impact on an organization. For instance:  
* _Tactics_ describe how threat actors operate during the various attack campaigns. This includes how the adversary carries out reconnaissance for initial intelligence gathering, how the information is gathered, and how the initial compromises were conducted. For instance, tactics may be to send a spear phishing email to a group on the supply chain. * _Techniques_ are the strategies used by the adversary to facilitate the initial compromises such as tools, skills, and capabilities deployed. This includes how the adversary establishes control, maneuvers within the supply chain system infrastructures, and exfiltrates data, as well as how to obfuscate through the system. The adversary conceals the email contents in such a way that is not obvious to detect. * _Procedures_ are the set of tactics and techniques put together to perform an attack. Procedures may vary depending on the threat actor goal, purpose, and nature of the attack. A procedure includes carrying out reconnaissance on the victim's systems to identify vulnerable spots, gather information, access rights, and control mechanisms to determine what could be exploited. **Inbound and outbound supply threats:** The inbound and outbound supply chains are the organizational systems that integrate with third party companies, suppliers, and distributors to achieve the organizational goal [24]. The inbound suppliers include the external organization and third party vendors who have remote access to the CSC system and who provide electric power transmission [25; 26]. The threat actor could penetrate the inbound supplier's system and manipulate data, or alter the organizations that provide the electronic products and payment services. The third party vendors purchase the electric power directly and resell it to the consumer. The outbound supply chain environment is the organization that provides distributed electric power to other organizations, individuals, and third party vendors. The threat actor could initiate malware or SQL injection attacks during distribution, causing a misconfiguration of the supply chain system. **CSC requirement:** Requirements are the constraints and expectations needed to ensure that the system supports the stakeholders and business needs. The requirement concept includes properties such as organizational requirements, business requirements, systems requirements, user requirements, and operational requirements [10; 23]. The organizational requirements contain concepts that specify the overall organizational environment and how the software will integrate with the security constraints to achieve the goal. **Risks:** Risk is the potential negative impact from an attack. The probabilities of attacks being initiated from the vendor systems are high, as they represent a single point of failure. Supply chain risk is the potential for an adversary to sabotage the supply chain, maliciously introduce unwanted functions, or subvert the design, product, or integrity of the system [17; 27]. CSC risk can be categorized as IT, non-IT, management, or government. IT risks are technical and operational, while non-IT risks represent organizations, products and services, environmental factors, and natural disasters. Supply chain risks are cascading risks, as an attack on one party may affect others as the organizations that are involved in the integration and process chains also increase [28]. **Controls:** Controls are security strategies and measures that are formulated and implemented to ensure that the organizational goal and objectives are achieved, and that risks are mitigated with minimal threat or no threat at all. CSC security controls are managerial, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the systems and their information [29].