# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 4 Case Study & Performance Evaluation
### Stage IV--Analyze the Threats
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**STRIDE Element** & **Precondition** & **Possible Attack Vector(s)** & **DFD Element** \\ \hline Spoofing & & Spoofing Attacks & Entity\& Process \\ Tampering & & Integrity Attacks & Data Flow, Data Store \& Process \\ Repudiation & Device & Delete/Corrupt Data & Entity, Data Store \& Process \\ Information Disclosure & Compromise & Data leakage & Data Flow, Data Store \& Process \\  & Denial of Service & Availability Attacks & Data Flow, Data Store \& Process \\ Elevation of Privilege & & Escalation of Privilege & Process \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Mapping STRIDE Threats to the Proposed Attack Taxonomy. Stage V--Vulnerability Analysis  
**Goals of This Stage:** Weaknesses and vulnerabilities will be analyzed, and their correlation with the previously analyzed threats will be established. Any existing vulnerabilities and weaknesses of ICS will be reassessed, including its various components, software, servers, and network, during this stage. Figure 15 elaborates a mapping of threats to vulnerabilities and control weaknesses (design flaws) of the application, software, and systems in scope at the end of this stage. **Output 1--Map of Existing Vulnerability to the Nodes of Threat Tree as per Figure 15.**  
**Output 2 and 3 (Enumeration of vulnerabilities using CVE & Scoring of vulnerabilities using CVSS) will be presented later. **  
Figure 15: List of ICS Vulnerabilities and Weaknesses Affecting the Architectural Components of ICS Mapped to Threats. Stage VI--Attack Analysis  
**Goal of This Stage:** The goal of this stage is to analyze and model the attacks against the application. Attack trees determine the most likely attack paths that lead to exploits and identify potential vulnerabilities and security controls for circumvention. An attack tree models each step of the attack as an opportunity for the attacker to take the next step until they reach the desired goal. We can analyze the realization of an attack by assigning conditions to each node of the attack tree. An attacker can choose either \"OR\" (one attack or another) or \"AND\" (both attack paths) at each node of the attack tree (Figure 16). The expansion of the hardware as one of the attack methods leads to the consideration of the hardware attack as one of the attack methods, alongside the expansion of other methods. **Outputs of Stage VI**  
Figure 16 presents one branch of attack trees with attack scenarios for targeted assets and an attack tree mapping to vulnerabilities for impacted assets. Additional attack scenarios mapping to vulnerabilities, such as software and networks, can be conducted. **Stage VII--Risk & Impact Analysis. **  
**Goal of This Stage:** The goal of this last stage is to analyze the risk of each threat and attack scenario and recommend countermeasures or security measures to detect and protect from the various attack scenarios. **Output 1--Threat, attack, vulnerabilities, and business impact. **  
Figure 16: Attack trees with the determination of the most probable attack paths for ICS. In Figure 17, the hardware attack is expanded to three different attacks and is started with the successful USB attack to demonstrate the impact and countermeasure. Similarly, others can be expanded. **Output 2--Residual risk to business. **  
A generic formulation for calculating risk is based on the definition of risk as \"the likelihood that a threat will exploit a vulnerability to cause an impact to the system\" [16]. \[Risk=Threat\times Vulnerability\times Impact \tag{1}\]  
Multiple coefficient values reflect the likelihood of the following events:  
Figure 17: Attack trees with the determination of the most probable attack paths & countermeasure for ICS. * The probability of successfully exploiting a vulnerability or a group of vulnerabilities increases. * There's a chance that the attacker can access the attack vector and has the time and resources to carry out the exploit.