# Mapping Automated Cyber Attack Intelligence to Context-Based Impact on System-Level Goals
## 2 Related Work
### Risk Assessment Methods for Traditional IT  
[PERSON], [PERSON], and [PERSON] [6] designed attack graphs (which represent all the possible attacker actions on a specific system) based on attacker behaviour and used Bayesian methodology to identify vulnerabilities and estimate the risk level of a critical resource in a given network. Similarly, [PERSON] and [PERSON] [7] proposed a risk assessment framework that employs attack graphs and monitors the timeline of events in order to measure the risk of a cyber attack in real-time. [PERSON] et al. [8] designed a tool that monitors various network vulnerability metrics and measures the impact of faults and attacks. [PERSON] and [PERSON] [9] propose a quantitative approach for risk management, which suggests calculating expected losses and other failure-related metrics. [PERSON] et al. [10, 11] developed probabilistic methodologies based on attack resistance metrics to measure the security risk in networks. [PERSON] et al. [12] implemented a quantitative approach based on the popular Microsoft and Callio Secura methodologies in an attempt to measure the the security risk in a business environment. Factor Analysis of Information Risk (FAIR) [13] is a model that promotes a quantitative, risk-based, acceptable level of loss exposure. RiskLens [14] is another quantitative assessment method based on FAIR and provides a model for understanding, analysing, and quantifying cyber risk in financial terms. [PERSON] et al. [15] presented a decision support system that qualitatively evaluates the severity of cyber security threats regarding frequency of appearances/references and number of incidents. [PERSON] et al. [16] developed a Threat Assessment and Remediation Analysis (TARA) methodology, which identifies and assesses cyber vulnerabilities and further suggests appropriate countermeasures. Common Vulnerability Scoring System (CVSS) [17] is a framework that captures the principal characteristics of software vulnerabilities and produces a numerical score that reflects their severity.  
Although extensive work in this area exists, it is largely based on pre-defined or known attack paths and failure modes, which means new attacks require the updating of large and often complex models. Also, existing work often treats risk on an asset-by-asset basis, not capturing the interdependencies between them, and is thus not able to model cascading failure. The methodology proposed in this paper aims to capture system goals (as opposed to possible failure modes or attack paths) and measure the impact of attacks in the context of inter-dependencies between goals. Thus, as intelligence emerges of new attacks we need only map these to operational goals, where interdependencies are already captured, enabling risk managers to be able to determine the impact of unknown or unexpected attacks as they occur. This overcomes existing limitations of needing to update risk models when new attacks occur and providing impact metrics based on the context in which the attack is occurring.  
In an industrial control systems context, various approaches of qualitative and quantitative risk management have been proposed from an attack-oriented security and safety perspective that exhibit the same limitations (detail omitted for brevity) [18; 19; 20; 21; 22; 23; 24; 25].