# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 4 Evaluation
### The Process
The threat actor uses various attack vectors to gather knowledge about the smart grid system topology, configurations, protocols, and operational parameters. Table 3 represents a breakdown of how the threat actors penetrate the systems. We use:  
* Penetration (P) to represent how the adversary attacks the system (P1-P6);
* Attack (AT) to represent the devices that were under attack (AT1-AT10);
* Steps (ST) to represent the steps the threat actor followed to attack (ST1-ST4). **Activity 2: Determine attack vectors**  
Here we discuss the attack vectors from Table 3, and follow the attack step in Section 4, to explain the attack vectors using the case study. * P1. Threat actor penetrates the system from a remote source through the firewall refer Step 1. * P2. Threat actor gains remote access through Vendor Systems refer Step 2. * P3. Threat actor exploits the IED that supports the communication systems refer Step 3. * P4. Threat actor manipulates the workstations, server, and handheld devices refer Step 4. * P5. Threat actor penetrates the command center firewall refer Step 4. * P6. Threat actor gains access into the command center and takes controls of the SCADA servers, manipulating, exfiltrating, and obfuscating. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{2}{c}{**Attack Vector Type**} & \multicolumn{1}{c}{**CSC System Target**} & \multicolumn{1}{c}{**Position**} & \multicolumn{1}{c}{**Steps**} \\ \hline \multirow{8}{*}{Penetrating} & \multirow{8}{*}{External} & CSC WAN/firewall & P1 & ST1 \\  & & CSC vendor remote access & P2 & ST2 \\  & & IED-supported & & \\ \cline{3-5}  & & communication & P3 & ST3 \\ \cline{3-5}  & & Workstation, CMS, HEMS & P4 & ST4 \\ \cline{3-5}  & & Command center firewall & P5 & ST4 \\ \cline{3-5}  & & Organizational LAN firewall & & AT4 \\ \cline{3-5}  & & Command center SCADA & P6 & ST4 \\ \cline{3-5}  & & Firewall & AT1–AT4 & \\ \cline{3-5}  & & CSC vendors & AT5 & \\ \cline{3-5}  & & IEDs & AT6 & \\ \cline{3-5}  & & CMS & AT7 & \\ \cline{3-5}  & & HEMS & AT8 & \\ \cline{3-5}  & & Handheld devices & AT9 & \\ \cline{3-5}  & & Vendor devices & AT 10 & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Smart grid SCS and potential security threats. AT1. The internal threat actor uses social engineering, ID theft, and administrative privileges to gain access through the LAN firewall to manipulate the system refer Step 4. **Activity 3: Detect devices under cyber attack**  
* AT1-AT4. Indicates that the firewall devices affected are under cyber attack. * AT5. CSC vendor systems are under attack. * AT6. IEDs are under attacks. * AT7. CMS server is under attack. AT8. No funding body have any role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results\". * (HEMS) server is under attack. * AT9. Handheld devices are under attack. * A10. Vendor devices are under attack. **Phase 2: Attack scenarios**  
An attack scenario is used to determine the vulnerable spots and where penetrations occurred between the variables, as listed in Table 4.