# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## Evaluation
### Introduction to the Integrated Risk Management Process
#### 5.4.4 Activity 4: Risk Assessment  
Step 1: Generate cyber-security attack scenario  
After the identification of vulnerabilities and threats, we noticed some weaknesses in the system, including the lack of firewalls and improper/irregular systems updates. We focused on the most critical vulnerabilities to demonstrate some cyber-attack scenarios. Seen in Figures 4-6. * **Scenario 1:** A highly skilled external attacker gained access to the master terminal unit (MTU) of the power grid system through a remote access point exploiting the weak password and firewall. The attacker was able to disrupt communications, access critical data such as passwords and operating plans, and thereby, monitor the status of the system and inject malicious control commands as well as forge data into the control center. This action led the system operators into taking inappropriate actions that interrupted the availability of electricity. * **Scenario 2:** Due to a heavy rainfall, a fallen tree branch damaged the overhead power lines feeding the substation. This interrupted the supply causing the socket breaker for this line to trip at the primary substation, leading to a total power outage to some parts of the area including the local ports and few hospitals. However, the operator did not get any notification of the socket \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Assets Affected** & **Potential Vulnerability** & **Vulnerability** & **Threats** \\  & & **Ranking (VR)** & **Threats** \\ \hline \multirow{6}{*}{1. SCADA operators and users} & V1.1 Absence of IT personnel & V83 & Beech of availability \\  & V1.2 Insufficient security training & V83 & Error in use \\  & V1.3 Lack of monitoring mechanisms & VR4 & Illegal processing of data \\  & V1.4 Lack of operator awareness & V83 & Asset compromise \\  & V1.4 Absence of maintenance crew & V83 & Beech of availability \\ \hline \multirow{6}{*}{2. Communication and networks} & V2.1 unprotected communication lines & VR5 & Eavesdropping \\  & V2.2 lack of authorization and authentication & V85 & Authorization violation \\  & V2.2 Failure to segment network & VR4 & Network compromise \\  & V2.4 Lack barrier and control mechanism & VR4 & Bypassing controls \\ \hline \multirow{6}{*}{3. SCADA system} & V3.1 No layouts given leaving the workstation & V83 & Abaque of right \\  & V3.2 Metering challenges & V83 & Cheeting meter reading \\  & V3.3 Porty designed API, website or mobile app & VR3 & Compromise \\  & V3.3 Lack of documentation & V83 & Error in use \\  & V3.4 widely distributed software & VR2 & Compromise of data \\  & V3.5 weak firewall & VR3 & Access control/forging or right \\  & V3.6 weak user password & VR3 & Access control \\  & V3.6 Denial of service & VR4 & Authorization violation \\ \hline \multirow{6}{*}{4. Hardware} & V4.1 Unprotected storage & VR2 & Theft of media or document \\  & V4.2 No system management & VR3 & Beech of availability \\  & V4.3 Equipment failure & VR4 & Beech of availability \\ \hline \hline
5. Database & V5.1 Data leakage & VR3 & Abuse of right \\ \hline
6. physical & V6.1 Unstable power grid & VR5 & Loss of power supply \\ \hline \multirow{6}{*}{7. Organization} & V7.1 Lack of disaster recovery plan & VR5 & Equipment failure \\ \cline{1-1}  & V7.2 lack of power allocation of information & \multirow{2}{*}{VR2} & Denial of actions \\ \cline{1-1}  & security responsibilities & & \\ \cline{1-1}  & V7.3 Lack of change control procedure & VR3 & Beech of information system \\ \cline{1-1}  & V7.4 Indequate service maintenance response & VR2 & Beech of information system \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Vulnerability identification checklist.