# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 6 Illustrative Example: Water Distribution System
### Configuring SCADA DM for the Scenario  
The generic SCADA DM presented in Section 5 is used as the baseline template. In order to produce a dependency model for this specific water distribution system, controlling water distribution, we first create a new model based on the generic template and then refine it for the specific context. In order to keep this example at a manageable scope, we focus on two out of the six key areas: _System Architecture_, where we predominantly concentrate on the hardware components, and _Employes_, since a human operator plays a crucial role in this process. The top level of the resultant dependency model is shown in Figure 5. In this model and other dependency models in this paper, the green part of a paragon reflects the probability of success and the red part--the probability of failure. Figures 6 and 7 expand the two key areas _System Architecture_ and _Employes_, respectively. In this model, the names of the paragons are made specific to the system. Since we only assess the risks related to one SCADA system operator controlling this segment of the pipeline, we keep the paragon focused on this particular employee. Figure 5 shows that the success probability of the root paragon is low: 0.0996. The success probabilities of the paragons \"The system architecture is reliable and secure\" and \"The operator looking after the pipeline is Okay\" are 0.1532 and 0.65, respectively. The leaf node success-failure probabilities for all hardware components are assigned based on the expert knowledge about the segment of the pipeline and available data and statistics regarding (1) the failure of the field devices of a similar make in the previous reporting period, (2) the duration of the field devices being in operation, and (3) the physical state of each device as reported during the recent routine check. These probabilities are shown in Figures 6 above the leaf paragons. There are two RTUs which are included in the dependency model (Figure 6); while RTU1 was recently replaced, RTU2 was in operation for several years, and the probability of its failure is 0.2, which is significantly higher in comparison with RTU1, where the probability of failure is 0.04. (Note that in all dependency model graphs in this paper, we show the probability of its success above each paragon). The success probability of the paragon \"Power supply is uninterruptible\" is high and equal to 0.994. It depends on the reliability of the Energy CNI. At the same time, emergency backup power supply is available to support the operation of this segment of the pipeline. The emergency power supply (the paragon \"The emergency backup power source is reliable\") is introduced into the model using an OR relationship as a countermeasure against the failure of the paragon \"Power supply is uninterruptible\". In Figure 6, we imply that the paragons \"Software functions as designed and is free from vulnerabilities\" and \"Network communication is reliable and is free from vulnerabilities\" also have underlying dependencies. However, we do not detail them in this example. The assumption is that the probabilities for the above named paragons are calculated  
Figure 5: Top-Level DM Configured for the Water Distribution System. beforehand, and they are approved and supplied by the respective domain experts as the final probability figures and are included into the model as provided, with the underlying dependencies not being considered. The operator's trustworthiness and ability to accurately evaluate SCADA system data during normal and abnormal operating conditions is imperative. Therefore, a number of requirements must be satisfied for the success of the paragon \"The operator looking after the pipeline is Okay\". In Figure 7, the observed states of the paragons \"The background check has been completed and is valid\", \"Health and safety check is performed regularly\" and \"The operator has required qualification\" indicated that the requirements are fully met (the value of the success probability is set to 1).