## 5 Evaluation: A Healthcare Scenario
### Results: Attack Path Generation  
Once the asset dependencies and vulnerabilities are identified, this final step aims to generate the attack path. There are a number of attack paths generated from the source asset to the target asset through the combination of vulnerabilities and dependencies. Note that there can be additional attack paths generated from the scenario, but this section presents only the relevant ones. Additionally, we only considered the three critical target point assets, i.e., infusion pump, insulin pump, and healthcare system, for the attack path generation.  
Attack Path--Target Point Infusion Pump: It is assumed that the threat actor (TA) is acting as an outsider without any prerequisite credential (PR:N) and user interaction (UI:N) can gain user level access to the SpaceCom system (A9,V1) through the network (AV:N) and escalate the privileges to gain root access. This allows the TA to communicate with the pump (A1,V1) with no privilege (AV:A) and user interaction (UI:N). The TA can finally manipulate the drug library or pump configuration. The TA can also execute malicious code in the pump's RTOS by accessing the SpaceCom (A9,V2) and executing the code and overwrite the pump (A1,V2) RTOS. Additionally, a TA who is able to access the hospital management system can obtain the patient drug information and further exploit the infusion pump. The TA can also exploit the hue light bulb (A4,V1) to access the home network and then further propagate into the infusion pump. This can happen mainly when the pump is idle or in standby mode. There are four potential attack paths through which the target point infusion pump can be exploited:  
A5,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V1 A9,V2 A8,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V2 A4,V1 \(\rightarrow\) A9,V1 \(\rightarrow\) A1,V1  
Attack Path--Target Point Insulin Pump: It is assumed that an internal threat actor (i.e., may be an employee) who has access to the insulin management system (A3,V1) using (AV:A/L), unrestricted (user) access (PR:N), basic computer skills (AC:L) and without user interaction (UI:N) exploits the insulin pump (A2,V1). The TA can also exploit the router (A5,V3) through an adjacent network and access the insulin management system (A3,V1) to access the pump (A2,V1). A TA from an adjacent network can take control of the hue lightbulb (A4,V1), become unreachable to the user and send malicious code to other devices and networks. It is assumed that a patient as the user may have a lack of knowledge about the smart bulb operation, which can be exploited by the TA. When the user interacts with the bulb, the TA can take over the control and propagate to the other part of the network. There are three potential attack paths which can exploit the target point insulin pump.  
A5,V3 \(\rightarrow\) A3,V1 \(\rightarrow\) A2,V1 A3,V1 A2,V1 A4,V1 \(\rightarrow\) A3,V1 \(\rightarrow\) A2,V1 Attack Path--Target Point Hospital Management System: It is assumed that a TA with network access through the router (A5,V2) can exploit the healthcare system (A8,V1) that is installed on a Windows-based system (A6,V1). User interaction is necessary to exploit this attack path; therefore, a healthcare practitioner needs to interact with the system for the exploitation. Additionally, such an attack path needs a TA with high skills who needs root level privilege to exploit the router and amend the user rights within the windows system. It allows them to access the hospital management system and add new users and gather sensitive data from the system. Another possibility could be that an internal TA with local access from tablet (A7,V1) may also attempt to exploit the (A9,V1) through the windows system (A6,V3). This path needs a local access vector and user interaction. There are three potential attacks through which the target point infusion pump can be exploited.  
A5,V3 \(\rightarrow\) A6,V1 \(\rightarrow\) A8,V1  
A5,V3 \(\rightarrow\) A6,V2 \(\rightarrow\) A8,V1  
A7,V1 \(\rightarrow\) A6,V3 \(\rightarrow\) A8,V1