# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 2 Related Work
### Threat Modeling  
MITRE's Adversary Attack, Techniques & Common Knowledge (ATT&CK) is an adversary model and framework for describing the actions an adversary could take to compromise and operate within an organizations network. MITRE's Cyber Attack Lifecycle consists of seven phases, namely: recon, weaponize, deliver, exploit, control, execute, and maintain. MITRE's 11 tactic categories within ATT&CK for organizations were derived from the latter stages of exploit, control, execute, and maintain [6]. Common Attack Pattern Enumeration and Classification (CAPEC) is a comprehensive dictionary and classification taxonomy of known attacks that could be used by analysts, developers, testers, and educators to advance community understanding and enhance defense. CAPEC ID438, ID439, and ID3000 [15] list three key vulnerable spots through which adversaries can exploit CSC, and these include modification during manufacturing, manipulations during distributions, and various domain attacks. Within these are various compromises that could be initiated using malware or SQL injection attacks. Common Weakness Enumeration (CWE) (2014) provides a mechanism for prioritizing software weaknesses in a consistent, flexible, and open manner. CWE identifies weaknesses that are exploitable in software, which the attacker can make function in a way that was never intended. The approach allows an organization to prioritize the CWEs most relevant to the organization's business mission, goals, and objectives [12]. Structured Threat Information eXpression (STIX) uses adversary Tactics, Techniques, and Procedures (TTP), cyber attack campaign, incidents, courses of action, exploitation targets, threat actors, and other methods to provide a common mechanism for adding structured cyber threat intelligence information across a range of use cases for improving consistency, efficiency, interoperability, and overall situational awareness [10]. The OWASP Top 10 Most Critical Web Application Security Risks identifies the various web application security weakness, attacks, threat agent, attack vectors, and impacts on organizations [16]. An integrated cyber security risk management approach considering all aspects of critical infrastructure including vulnerabilities and attack scenarios is proposed by [17]. The Diamond model is an intrusion analyses model that describes how an adversary attacks a victim based on two key motivations. The model consists of four components, namely: adversary, infrastructure, capability, and victim. It has associated features, such as timestamp, phases, results, directions, methodology, and resources. In the event of an attack, the model uses the timestamp to identify the phases [18]. [PERSON] et al. (2017) proposed a maximum attack strategy method of spoofing and jamming on the cognitive radio network, using optimal power distribution in wireless smart grid networks. The method was effective for causing the DoS attack on radio frequencies [19]. The authors further proposed a novel homomorphism encryption approach to tackle both insider and outsider threats that can fully support blended arithmetic operations over cipher texts [20]. A dynamic privacy protection model was proposed by [21] to address threats relating to wireless communication. The aim of the model was to ensure data privacy within a scale of communication without using conventional encryption methods. The Attack graph--or graph tree--are conceptual diagrams used to analyze how a target can be attacked. The tree-like structure has multilevel children with a single root used to detect vulnerabilities in the network for analyzing an effective defense [22].