# Cyber Security Threat Modeling for Supply Chain Organizational Environments
## 1 Introduction  
A supply chain (SC) is a collection of different organizations that align their business processes, goals, objectives, and some components of their systems to third party organizations, suppliers, consumers and partners [1, 2]. Cyber physical systems (CPS) are the integration of computation and physical process that make a complete system, such as physical components, network systems, embedded computers, software, and the linking together of devices and sensors for information sharing [3]. The emergence of CPS, electronic transactions, third party vendors, and banking services have evolved over time and brought many changes to how the organizations and industries operate. CPS supply chains have also brought many challenges, such as lack of specific organizational threat intelligence gatherings, failure to audit third party vendors, lack of security controls, and lack of (cyber supply chain CSC) risk management. Cyber attacks could impact other supply chain partner systems due to many reasons such as software errors, vulnerabilities in any SC partner [4]. Examples include the Saudi Aramco electric-grid cyber attack in 2017, and the Ukraine power grid attack in 2015 [5]. These indicate that supply chain attacks are on the rise and require an attack model and threat analysis to gather threat intelligence [6]. There are existing attack models, such as MITRE's kill chain model [6] that describe the actions an adversary could take to compromise and operate within an organization's overall communication network. Attack trees [7] provide a formal and methodical way of describingthe security of systems based on varying attacks. They use multilevel children within the attack tree, with a single root node that uses different ways to achieve its goal using leaf nodes and Building Security in Maturity Model (BSIMM) [8]. These works are important and contribute to the cyber threat modeling knowledge domain. However, there is a limited focus on supply chain perspective, and specifically on threats relating to inbound and outbound chain contexts that need adequate analyses to ensure CSC security.  
The main contributions of this paper are threefold. Firstly, we modeled and analyzed the cyber threats of supply chains organizational context. We integrated concepts from threat intelligence, such as threat, attack vector, TTP, and control, with concepts from the goal modeling languages, including actor, goal, and requirement, and from supply chain context including inbound and outbound. Secondly, we considered widely used industry practices such as the internet security control [9] and STIX threat model [10] to analyze the threats in the supply chain context. Finally, we used a running example from a smart grid system to analyze the proposed approach and demonstrate the applicability of the work. The results showed that we had identified probable CSC threats, risks, and attacks, such as penetration and manipulation that could impact the studied organizational goal. We ascertained the CSC attack vector, and modeled attack patterns and gathered threat intelligence that provided an understanding of adversaries' motives, capabilities, actions, and intent. We have recommended security controls to mitigate the CSC threats.  
The rest of the paper is structured as follows: Section 2 presents an overview of related works in the CSC security environment and the existing threat models, while Section 3 considers the need for CSC threat modeling and presents the concepts for a proposed meta-model as well as a threat modeling process and attack algorithms. Section 4 present the analytical and predictive research approach used to implement the threat modeling theorem and evaluates it by following a running example of a case study to model CSC attacks. Section 5 provides a discussion of the several observations identified in the study. Finally, Section 6 presents a conclusion of the study and proposes future works.