## 5 Evaluation: A Healthcare Scenario
### Generate and Priorities Evidence-Based Vulnerability Chain  
We assume that there are two confirmed events that occurred in the studied living lab scenario. The first event occurred in the patient homecare unit, where cyber threats are detected on the home care and the IoCs are analysed. In the current scenario, unauthorized access to the SpaceCom software (PoC = A9) allows the threat actor to access the infusion pump (PoC = A1). The IoCs in this case are the log (IoC1), amendment of drug library (IoC2), pump configuration (IoC3), and obtained pump data (IoC4). This case enfolds a confirmed event of a cyberattack. To discover and produce the potential cyberattack paths for the compromised asset A1, cyber dependency with the infusion pump (A1) is considered, and possible attack paths for A1 are listed. The second event is data leak, where high-profile TAs access the hospital management system (PoC = A8) and collect the data (IoC6) through Windows system (PoC = A6) using IoC5 and IoC7 (user right and install program). Cyber threats are detected in the healthcare service provider infrastructure. Table 6 shows the evidence chain for the identified security incidents.  
To estimate the exploitability for each reconstructed attack path, different attackers' profiles are considered and displayed in Table 7. To estimate the EL per vulnerability, with respect to the analysed IoC, only vulnerabilities of the assets interconnected with the IoCs are considered.  
Once the individual vulnerability and TA exploitability level are identified, then it is necessary to determine the probability of an attack path exploitation level. This needs to consider IoCs related to the attack path. Note that the probability of exploitation for a disclosed IoC is the maximum value; therefore, exploitation level for the attack path depends on the vulnerabilities that are not exploited. These values are converted to qualitative values to estimate the attack path exploitability level (APEL) defined in the previous section. This is depicted in Table 8 for APEL. We made a number of assumptions for a given vulnerability based on the CVSS metrics. For instance, attack path 1 in the initial node, A5,V1, and threat actor capability is considered as a medium to exploit the  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Incident** & **Attack Path** & **Evidence Chain** \\ \hline \multirow{4}{*}{Amendment of drug level and pump configuration} & A5,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V1 & A5,V1 \(\rightarrow\) A9, IoC1 \(\rightarrow\) A1, IoC2 \\  & A9,V2 \(\rightarrow\) A1,V2 & A9, IoC4 \(\rightarrow\) A1, IoC3 \\  & A8,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V2 & A8,V1 \(\rightarrow\) A9, IoC1 \(\rightarrow\) A1, IoC2 \\  & A4,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V1 & A4,V1 \(\rightarrow\) A9, IoC1 \(\rightarrow\) A1, IoC2 \\ \hline \multirow{4}{*}{Patient data leak} & A5,V3 \(\rightarrow\) A6,V1 \(\rightarrow\) A8,V1 & A5,V3 \(\rightarrow\) A6, IoC5 \(\rightarrow\) A8, IoC6 \\  & A5,V3 \(\rightarrow\) A6,V2 \(\rightarrow\) A8,V1 & A5,V3 \(\rightarrow\) A6, IoC7 \(\rightarrow\) A8, IoC6 \\ \cline{1-1}  & A7,V1 \(\rightarrow\) A6,V3 \(\rightarrow\) A8,V1 & A7,V1 \(\rightarrow\) A6,V3 \(\rightarrow\) A8, IoC6 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Attack path based on confirmed security events and potential evidence chains.  
vulnerability. Therefore, the exploitation level for the A5,V1 is H by following Table 8 and APEL for the overall attack path is H. Another example could be attack path 2, where both nodes are exploited; therefore, the APEL should be the maximum value. The TA capability for the A4,V1 is low, A5,V3 is medium A7,V1 is high, and A6,V3 is medium.