## 3 The Proposed Attack Path Discovery
### Cyberattack Path Generation and Analysis Process  
This section presents the attack path generation and analysis process, which consists of seven distinct steps. Each step performs specific functionalities and contributes towards the attack path discovery. It initiates source and target asset identification, followed by the vulnerability chain for a successful attack campaign. An overview of the steps is given below. **Step 1**--Identify possible entry points: This initial step identifies the healthcare ecosystem's potential assets that the attacker may consider as an entry point to execute an attack. This can be a medical device and software that runs the device, hardware, or other assets within an ICT infrastructure. A medical device defined by the FDA as software, electronic and electrical hardware, including wireless, is a critical asset for healthcare systems. The entry point is a point of failure where the attack exploits the vulnerability to propagate the target point. Generally, the attacker spends a lot of time trying to understand the existing system, and specifically, the healthcare system consists of several interconnected healthcare and IT devices. Vulnerabilities within these assets can be exploited by an attacker to achieve their intention. Almost every aspect of the network and application has a potential entry point, and securing the weakest link principle should be followed by the healthcare entity in order to make it difficult for an attacker to identify the entry point. **Step 2**--Determine asset dependencies: Once the entry point is identified, it is necessary to determine the dependencies of these assets within the healthcare ecosystem. The goal is to focus on the potential cyber interaction of the entry point asset. A cyber dependency of assets is assumed to be a cyber-asset pair (node) interrelation and/or interconnection (edge) aiming to fulfil a healthcare service delivery or specific operation over communication networks. For instance, it is necessary to exchange patient treatment data from various sources for clinical decision making. Such dependency is critical for an attacker to propagate an attack from the entry point to the target point. **Step 3**--Identify possible target points: This step aims to identify the possible target points that an attacker strives to reach by following the entry point asset and associated dependencies. An attacker needs to exploit single or multiple vulnerabilities to reach target points to achieve its objective. This includes assets that are compromised at interim stages of an attack campaign. Therefore, the accessibility of a target point depends on the entry point asset, cyber dependencies, and capability of the actor for possible exploitation. This step develops assets' dependency graph that shows assets and their dependencies. **Step 4--**Determine entry and target point vulnerabilities: Once the entry and target points are identified, it is necessary to determine the vulnerabilities related to the assets. These vulnerabilities are preconditions based on the attacker's profile for a successful attack path campaign. The goal of this step is to accurately reflect the exploitability level of the identified vulnerabilities and link the vulnerabilities to formulate the vulnerability chain. These vulnerabilities are identified by following the CVE and NVD published vulnerabilities entries. The proposed method follows a rule-based reasoning approach (filters) to produce the chain of sequential vulnerabilities on different assets that arise from consequential multi-step attacks, initiated from the entry points in order to exploit the vulnerabilities. Individual vulnerability is measured by following the CVSS base metrics and possible further exploitation for the vulnerability chain. CVSS allows us to determine the criteria relating to discoverability, exploitability, and reproducibility to materialize a threat relating to the vulnerability.