## 4 Case Study
### Analysis
#### 4.2.2 Matrices Constructed during _Step 7_  
Matrix RR captures the potential conflicts between requirements. Ensuring confidentiality/availability/integrip is a common high-level security requirement, thereby giving rise to R1, R2, and R3. Another reason behind R3 is that the Wi-Fi of C5 is intentionally enabled to allow on-site maintenance engineers to remotely connect/access any device (including C2) within C5's network. Note that C2 is connected to C5 via Ethernet cable. Initially, no conflict was identified among them until C5's WPA2 (Wi-Fi Protected Access II) protocol is found hackable, and this thus implies potential violation of R2. Once successfully hacking C5, the adversary can perform various attacks on C5's network such as hacking SSH (Secure Shell) login of C2, and intercepting/forging/tampering with S8 and S9. Such attacks would lead to violating several requirements including R1. Simply put, satisfying R3 may violate R1 and R2, if no measure has been introduced to prevent/mitigate them; so, we can say that R3 conflicts with R1 and R2, as reflected by Matrix RR in Figure 8. Matrix MC captures which components are involved in implementing the measures. A measure could be realized by a single component alone or a combination of individual components. For example, M4 is a particular mechanism that leverages on a combination of C2, C3.1, and C4.1 to detect anomalous S3 or S7; this would help C2 to produce accurate S9, thereby contributing to satisfying R4. Matrix MR captures which measures would violate or help satisfying the requirements. For instance, as aforementioned that R3 conflicts with R1 and R2, applying M1 would of course help satisfying R1 and R2 while violating R3. Suppose now we want to fulfil both R2 and R3. From Matrix MR, we can see that M1 would violate R3, and may thus consider it undesirable. As compared to M1, M2 seemsmore attractive because it satisfies R2 while not violating R3. However, before jumping to conclusions that M1 should not be applied, we check: firstly, Matrix RR, to identify which requirements would potentially be violated; it shows that R1 and R2 are conflicted by R3; the number/criticality of requirements should be taken into consideration; secondly, Matrix RC, to identify which components could be affected due to the conflicted requirements; for instance, R1 violated would render C2's integrity questionable; to foresee the impact of compromised C2, we could refer to Matrix MC, Matrix SC or Matrix CC; thirdly, Matrix MC, to identify which measures might be compromised due to component malfunction/compromised; for instance, C2 malfunction/compromised would render M4 ineffective as M4 requires a functional combination of C2, C3.1 and C4.1; to foresee the consequence of ineffective measure (e.g., M4), we could refer to Matrix MR for its associated requirements; fourthly, Matrix SC, to identify which signals could be affected due to component malfunction/compromised; for instance, C2 malfunction/compromised would cause inappropriate S1 and S9 that subsequently affect their intended receivers, i.e., C1 and C3.1; fifthly, Matrix CC, to identify which components would be immediately affected due to component malfunction/compromised; for instance, C2 malfunction/compromised would directly affect C1, C3.1, C4.1, and C5. Nevertheless, we could check on these matrices in different order, depending on which aspects of the _system_ we take into consideration. After much consideration, our decision regarding M1 and R3 is described as follows. The decision criteria, typically including implementation cost and time, may vary on a case-by-case basis. In this case study, we consider that the advantages of applying M1 far outweigh its disadvantages. Securing C5 with M2 alone is not promising. M2, which imposes a longer complex password on C5, would only increase the time needed to crack C5's Wi-Fi. In other words, given enough time and additionally through social engineering, C5's Wi-Fi can still be hacked; as a result, the entire network of C5 may be compromised.