## 5 Evaluation: A Healthcare Scenario
### Implementation of the Attack Path Generation  
We follow the living lab healthcare scenario to implement the attack path generation (see Figure 4). This section presents the implementation of the attack path generation. Vulnerabilities of healthcare services and systems are the main components for the path generation. In particular, the vulnerabilities in the healthcare sector are unique compared to the other sectors. This is due to the connectivity of different medical devices with the other parts of the network, and these medical devices, in general, have a lack of security measures. Healthcare information infrastructure contains a large number of legacy systems that are hard to replace and threat actors are always looking into this system for potential exploitation. Healthcare practitioners need to collect sensitive patient data, such as personal and financial information, and therefore potential breaches of this data could provide additional benefits to the criminals or inside attackers.  
We made several assumptions for the purpose of implementation. In particular, the home patients use an infusion pump and insulin pump for their treatment and the pump is managed and configured by the healthcare practitioner. Additionally, there are IT devices, such as computers, routers, servers and applications software and operating systems, that are required for the overall system infrastructure. Finally, the low cost of IoT devices, such as smart lamps and IP surveillance cameras, in both home and service provider environments are considered. The security of medical devices is critical to protect patient information and to ensure healthcare service delivery since the devices are connected to the internet. These devices are dependent on the other IT devices and network infrastructure to exchange and collate data from various sources for making clinical decisions. There are vulnerabilities due to the interdependencies among the assets from the hardware, software, human, and overall healthcare system context. Compromised healthcare devices can be used to propagate the attack path on the other part of the healthcare information infrastructure. Software is embedded in the devices to assist their functions and operation of the medical devices. Therefore, an attack path can also be initiated and propagated from this embedded software. Additionally, web services are commonly used for interfacing the connected medical devices with the other parts of the system.  
A list of assets is identified based on the scenario which consists of medical devices, IT devices, IT infrastructure and applications. These assets are critical for the overall healthcare service delivery and research activities for the living lab. The potential threat actors and user profiles are also considered to demonstrate the attack path. We have extracted a number of vulnerabilities from the CVE database and categorised them based on the assets of the studied scenario. Additionally, CVSS is also considered for the base metrics properties which are necessary for the ruleset. The identified vulnerabilities and base metrics are used to generate the attack paths. The process allows the generation of a possible attack path and the CVSS metrics impact value is considered to select the appropriate ones. The attack path generation is iterative to generate the possible attack paths.  
Figure 4: Living lab healthcare scenario.