# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 2 Background: Dependency Modelling  
Dependency modelling is a goal-oriented risk assessment method, which is based on the assumption that all risks come through interdependencies, and that in order to be resilient, a system needs to recognise and manage all dependencies (both external and internal). It is a positivist, top-down approach of elaborating dependencies from the core system goal. The major distinctive feature of this method is that it focuses on the desired outcome of a system (the core goal) and on the supporting sub-goals that should be achieved for the overall success of the core goal. This feature distinguishes dependency modelling from failure-oriented risk assessment methods [4], which attempt to enumerate threats to a system and list \"_all the things that could go wrong_\" with a system [5] (p. 10). The Open Group's Dependency Modelling standard [5] provides guidance on how to construct a Dependency Model (DM)--a graph model of a system that consists of a collection of nodes (systems dependencies) arranged in a tree-like hierarchy [5]. These entities in a DM are referred to as _paragons_ or _goals_, and they are depicted as rectangles. A paragon represents a desired state of a system or of an element of a system. A DM has only one root node, which represents the core goal of a system, and multiple leaf nodes representing sub-goals upon which the core goal depends. Each leaf node has only one parent node, but it can have zero-to-many child nodes. The leaf nodes that do not have child nodes do not have dependencies within the scope of the model and are called _uncontrollables_, highlighting the fact that the system itself has no control over the state of these paragons. A DM is composed of smaller building blocks that are meaningful low-level DMs. One of the key concepts in dependency modelling is the _probability_ of success/failure of each node. This is because dependency modelling builds on the notion of conditional probability, which is the probability of an event occurring given that another event has taken place. In a DM, every childless leaf node is assigned a probability of being in a desired state or being successful. The probability is assigned based either on expert opinion (subjective) or based on historical data, when available (objective) [4]. The conditional probability of a parent node being successful is calculated based on the success probabilities of child nodes. Dependency modelling is a quantitative risk assessment method that facilitates risk sensitivity analysis that shows which system dependencies present the highest risk to the success of the core goal. In a DM, there are two types of relationships between child nodes of one parent node: and and or. An and relationship means that all child nodes should be successful for the success of a parent node. An or relationship indicates that at least one child node should be successful for the success of a parent node. An or relationship reduces overall risk, while an and relationship increases it. An OR relationship may be used to introduce a cyber security countermeasure which mitigates a risk posed to a system by a certain dependency. The probability of a parent paragon with an AND relationship between independent child paragons is calculated as follows:  
\[P(A)=\prod_{i=1}^{N}P(B_{i})\]  
where \(A\) is the parent paragon, \(B\) is a child paragon, \(P(X)\) is the probability of the paragon \(X\), and \(N\) is the number of child paragons. The equation for the probability of a parent paragon with an OR relationship between independent child paragons is shown below:  
\[P(A)=1-\prod_{i=1}^{N}(1-P(B_{i}))\]  
A DM facilitates the communication between system stakeholders by providing a common ground for the discussion about system's core goal, sub-goals, risks and dependencies. It helps to avoid misunderstandings and omissions in risk assessment by providing a clear visual representation of dependencies within a complex system.