# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 1 Introduction
Additionally, an outdated or obsolete system for controlling and monitoring industrial processes and critical infrastructure is known as a legacy industrial control system (ICS). Typically, the implementation of these systems preceded modern advancements in technology and cybersecurity practices. Legacy control systems and devices face numerous challenges. [PERSON] et al. [5] noted that legacy systems and devices may have outdated software, firmware, and hardware, limited connectivity, no or inadequate means for updating the software and firmware, no or inadequate communications security, and no or inadequate means to conduct access control. Legacy devices (LDs) are potentially vulnerable to a whole range of security threats. Dealing with the aging hardware or software that forms the foundation of their OT presents a significant challenge for many organizations seeking cybersecurity for their operations. While most organizations continue to utilize legacy ICS due to their critical role in plant operations, their age presents potential vulnerabilities and opportunities for cyberattacks. SANSTM Institute survey 2021 presents that one of the greatest challenges facing OT security relates, as always, to technology (technical integration represents a challenge). Organizations need to ensure that technical implementations more effectively integrate legacy OT environments with modern security technologies. Solution providers can support innovation in this area [6]. During the last decade, legacy system upgrades in the industry were to conform with safety norms and regulations defined by standards. Traditional analysis methods that aim to assess the safety of critical infrastructure fail to encompass the complexity of emerging cyber-physical systems. The Threat Modeling Method (TMM) is increasingly being used in application development and system evaluation. A widely applicable threat modeling definition is a proactive security practice that is essential for pinpointing risks and limiting them. Furthermore, [PERSON] and [PERSON] asserted that threat modeling serves as a process for analyzing potential attacks or threats supported by threat libraries or attack taxonomies [7]. Threat modeling considers both safety and security aspects. For example, [PERSON] et al. [8] applied a STRIDE-based threat modeling method to an automated driving system, analyzing both safety and cybersecurity aspects. [PERSON] et al. [9] presented Root Causes of ICS Cybersecurity Vulnerabilities, in which they identified six primary technical and administrative factors that lead to cybersecurity vulnerabilities in ICS (poorly secured legacy systems). Many industrial control systems typically have a 10- to 30-year life cycle. Lack of trained cybersecurity specialists, delayed application of operating system and application software patches, and a lack of cyber-security situational awareness are among the factors contributing to cybersecurity vulnerabilities in industrial control systems. [PERSON] et al. presented 12 popular threat modeling methodologies discussed from a variety of sources and targeted different parts of the process, as well as summarized some features of each threat modeling method. Additionally, [PERSON] answered the question, What criteria should a good TMM satisfy for a specific domain cyber-physical system (CPS)? [PERSON]'s response to the question was: \"After evaluating existing TMMs, it became clear that no single method could adequately address all aspects\". We can conclude that a significant goal of this research [10] is to devise a framework that integrates various methods and techniques. Furthermore, though MITRE [11] has released the ATT&CK framework that covers generic attacks on ICS, ENISA [12] has numerous OT systems publications, and NIST [13] has a specific OT security publication Special Publication 800-82r2. Still, there has been no systematic approach to catalog, map, and classify cybersecurity attacks on the oil and gas sector.