## 2 Background and Related Work
### Step 4: Quantifying Cyberattack Scenarios
The attack vector describes the type of access required to carry out an attack, and a high score is given when the attacker belongs to a highly accessible network. Attack complexity refers to the complexity of exploiting a vulnerability. The complexity can be higher if certain conditions are satisfied to conduct an attack, implying that the vulnerability is difficult to exploit. The privileges required indicate the level of privilege required to exploit the vulnerability. The user interaction means whether user interaction is required for the attack to succeed. Table 9 can be used to evaluate these factors. We adopt the average of the scores of all factors as the exploitability score of DREAD. **Affected users**. DREAD's affected users indicate how many users the vulnerability could affect. This category assesses the range or proportion of users that could be affected within a system, network, or application if a vulnerability were exploited. CVSS evaluates how a vulnerability can affect one system to another through a metric called scope. However, instead of using the rates for the scope provided by CVSS, we slightly modified the scoring system to fit the concept of affected users in DREAD. We divided the targets affected by vulnerabilities into internal components and external components. If the vulnerability affects only the internal components of the ICS, a score of 5 is given. Otherwise, if the vulnerability also affects external components along with internal components, a score of 10 is given. The scenario developer can utilize Table 10 to evaluate affected users. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**DREAD** & **CVSS** & **Scoring** \\ \hline Affected users & Scope & Internal factor (5) & External factor (10) \\ \hline \hline \end{tabular}
\end{table} 
Table 10: A scoring format for the affected user of the CVE vulnerability. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**DREAD** & **CVSS** & **Scoring** \\ \hline Reproducibility & Attack complexity & Low(10) & High(5) \\ \hline \hline \end{tabular}
\end{table} 
Table 8: A scoring format for evaluating the reproducibility of the CVE vulnerability. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**DREAD** & **CVSS** & \multicolumn{2}{c}{**Scoring**} \\ \hline \multirow{3}{*}{Exploitability} & Attack vector & Network (10) & Adjacent network (6) & Local (4) & Physical (2) \\  & Attack complexity & Low (10) & High (5) \\  & Privileges required & None (10) & Low (6) & High (2) \\  & User interaction & None (10) & Required (5) \\ \hline \hline \end{tabular}
\end{table} 
Table 9: A scoring format for evaluating the exploitability of the CVE vulnerability. **Discoverability**. DREAD's discoverability measures how easy it is to find vulnerabilities. This category considers the time, effort, and skill required for an attacker to discover and understand a particular vulnerability. In this context, we define the surface through which an asset is exposed as the discoverability of a vulnerability. Accordingly, we evaluate the discoverability of vulnerabilities by utilizing the attack vector of CVSS. If exploitation requires physical access to an asset, discoverability is rated low. On the other hand, if an attacker can access an asset through a public network such as the Internet, the vulnerability is easily discovered. The scenario developer can evaluate the discoverability of vulnerabilities with Table 11.  
Once each category of DREAD is scored for the vulnerability assigned to each node of the attack tree, we calculate the average of these scores and assign it to the corresponding node. Table 12 shows an example of score calculation by applying DREAD to attack techniques and vulnerabilities of MITRE ATT&CK that can be assigned to ICS assets. Nevertheless, the methodology of evaluating scenarios in such a manner presents a notable issue. Specifically, scenarios with a fewer number of child nodes inherently receive higher scores.