# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 6 Illustrative Example: Water Distribution System
### Configuring SCADA DM for the Scenario
A paragon should have at least two distinct named states, which typically represent degrees of achieving of the key goal (from failure to success). While it is possible setting the probabilities for each leaf paragon, in a dependency model, it is also possible to declare an observed state as we did for the above discussed paragons. This is possible because it is known that the required checks and  
Figure 6: Dependencies of the Paragon _System Architecture._  
actions were completed by and for the employee and are not subject to change during the reporting period. Figure 5 indicates that the success probability of the root paragon is low. Since this is an unacceptable level of the success probability, we need to conduct risk assessment to identify the dependencies that affect the key goal the most and then introduce countermeasures to mitigate the key risks and to increase the success probability. A three-point sensitivity chart was produced for the discussed scenario in order to identify the dependencies that affect the key goal. The chart is presented in Figure 8 and shows the sensitivity of the root paragon to the uncontrollable dependencies. The left side of the red portion of each bar shows the decrease in success probability for the root paragon if the success probability of the corresponding leaf paragon reduces to 0. The right side of the green portion of each bar shows the increase of the success probability for the root paragon if the success probability of the corresponding paragon increases to 1. The difference between these two values is called the sensitivity of the root paragon to a particular uncontrollable dependency. The border between the red and green parts of each bar indicates the current success probability (equal to 0.0996 as shown in Figure 5) that the root paragon has on all its leaf paragons together. Figure 8 indicates that the uncontrollable dependencies which influence the success of the root goal the most are \"The operator understands safety and security procedures\" (0.1532), \"Pressure sensor 1 is operational\" (0.1443), \"Pressure sensor 2 is operational\" (0.1443), \"The shutoff valve is operational\" (0.1277), etc. In the brackets in Figure 8, we show the sensitivity of the success probability of the root paragon to an uncontrollable dependency. For example, the sensitivity of the core goal to the paragon \"The operator understands safety and security procedures\" is 0.1532, and the red part of the bar starts at the 0 point on the x-axis (Figure 8). This means that if the success probability of this paragon reduces to 0, then the success probability of the core goal also reduces to 0. If the success probability of this paragon increases to 1, then the success probability of the core goal increases to  
Figure 7: Dependencies of the Paragon _Employes_. 0.1532. Figure 8 shows that while the key paragon is highly sensitive to the uncontrollable dependency \"The operator understands safety and security procedures\", its sensitivity to the paragon such as for example \"The emergency backup power source is reliable\" is lower and equal to 0.002. This implies that changing the success probability value from 1 to 0 for the latter paragon makes a less significant difference to the success of the root paragon. Thus, a three-point sensitivity chart allows determining the paragons that present high risks to the core goal. It means that focusing on reducing risks for high sensitivity paragons will lead to more significant improvements in the success probability of the core goal.