## 4 Verification and Validation
### Implementation of the Proposed Model in a Construction Example
In general, cyber attackers can be classified into different categories based on their motivations, such as the ones listed below [44]:  
* Pranksters are the attackers who perform attacks without serious intentions, mostly for fun. * Hacksters are the ones hacking to improve their skills and out of curiosity. * Malicious hackers are cyber actors who desire destruction and cause damage for self-pleasure. * Personal problem solvers commit their activities to gain personal benefit. They cannot solve their issues through legal ways and use cyberattacks for that purpose. * Career criminals have pure financial motivations. * Extreme advocates perform their activities due to social movements, religious reasons, or political motivations. They have also been called hacktivists. * Malcontents, addicts, and individuals are attackers mostly with psychological problems, such as antisocial personality disorder. The last parameter to consider for the implementation of the model was the cost of a cyberattack \(\left(C_{cyb}\right)\). This parameter depends on the malicious insider's expertise level and the targeted file's security level. Moreover, the targeted file's security level depends on the project security level and the targeted file's accessibility level. For the malicious insider's expertise level, the Dreyfus model [45] was employed. This model defines five levels of expertise: novice, advanced beginner, competent, proficient, and expert. For the project security level, five qualitative levels (very low, low, medium, high, very high) and corresponding values (0.1, 0.3, 0.5, 0.7, 0.9) were defined. The project security level is characterized by the security measures employed by the project/defender, such as the IDS, a multi-factor authentication system, firewalls, and software patch management. If all the security measures suggested by cybersecurity standards are employed, then the project security level can be considered \"very high\". Finally, for the targeted file's accessibility level, the same five qualitative levels as the project security level were used. However, the corresponding values for different levels were in the opposite order since increasing accessibility decreases the security level of a file. For example, if a file was very sensitive and accessible to a few people in the project, then the file accessibility level could be considered \"very low\", with a value of 0.9. The file security level was calculated by multiplying the project security level and the file accessibility level to incorporate the overall security measures employed in the project and the number of people who can access the file, i.e.,  
\[\text{File security level}=(\text{Project security level})*(\text{File accessibility level}).\]  
The qualitative values for each expertise, project security, and accessibility level are shown in Table 3. The cost of cyberattack \(\left(C_{cyb}\right)\), normalized within the range of (0,1), was calculated by subtracting the average value of malicious insider expertise level from the average value of file security level, i.e.,  
\[\text{Cost of cyberattack}=max\{\text{File security level }-\text{ Malicious insider expertise level, }0\}.\]  
If the expertise level value is higher than or equal to the file security level value, the cost of cyberattack \(\left(C_{cyb}\right)\) is assumed to be zero. This means that if the attacker has the required expertise level to compromise the targeted data, he/she should not need additional resources. If not, the attacker should use extra resources that will make the cyberattack cost more than zero. The following scenario, where an insider requests access to a file, is presented to understand the mentioned parameters and their roles in determining the best strategies by the insider and defender and show the practical implementation of the proposed model.