## 2 Proposed Use Case Overview
### Use Case Validation Scenarios  
In this work three scenarios are defined as in [12] for the presented use case (and also accounting for misuse cases): \"network configuration\" where the use case scenario is not threatened by cybersecurity nor privacy risks, in order to perform an assessment in a normal operation of the use case; \"outpatient appointment check\" where the misuse case scenario is threatened by a denial-of-service attack, that prevents legitimate users from accessing internet services, including patient access to outpatient information; and \"visualization of clinical information\" where the misuse case scenario proposes and inside URL attack to retrieve clinical information, causing also a privacy risk. These three scenarios presented, focused on POC systems and dealing with cybersecurity and privacy risks in a healthcare, are depicted in Figure 2, and described below. * Scenario 1: network configuration (POC)  
In this scenario, no cybersecurity attack nor information privacy leakage is simulated, but still new configurations to the IT infrastructure are simulated. In particular, it is simulated that the IT department has been requested to re-arrange IT infrastructure of the hospital, including medical devices, due to a health crisis situation, as occurred in 2020 due to the COVID-19 pandemic. For such a request, the IP/MAC address links of the medical devices pointing the servers are modified. In this situation, CUREX platform detects that the IP/MAC address links have been modified but no cybersecurity nor privacy risk has occurred. Therefore, the overall combined cybersecurity and privacy risk score obtained through the CUREX platform should be low. * Scenario 2: outpatient appointment check (smartphone app)  
In this scenario, a distributed denial-of-service (DDOS) attack is simulated which is considered as high risk for cybersecurity and low risk for privacy. A participant is registered as a new simulated patient to access the simulated patient's information through the test smartphone app, but a DDOS attack happens resulting with the smartphone app functionality breaking down. Therefore, the participant is not able to access to the information due to an out-of-service notice. In this situation, the CUREX platform hasto provide a high score for cybersecurity risk, while a low privacy risk score, which both values combined results with the overall value of medium risk score reported by CUREX. * Scenario 3: visualization of clinical information (HIS)  
In this scenario, a URL hacking cybersecurity attack with leakage of privacy information is simulated. The simulated scenario is that a participant, simulating to be a medical doctor, wants to have access to a medical image and to a report of a simulated patient, but intentionally accesses another patient's data instead of the originally planned patient's data. Therefore, the simulated cybersecurity attack causes also a privacy leakage of information, implying that both the cybersecurity and privacy information risks scores of CUREX platform should be high. In particular, it is of high interest to at least pilot with Scenario 1 and either Scenario 2 or Scenario 3. Scenario 1 does not involve a cybersecurity attack but allows CUREX toolkit to compute the cybersecurity and privacy risk when no attacks are detected. For Scenario 1, results should provide low risks to the organization and therefore, they can continue sharing the data being requested. While the rationale behind Scenarios 2 and 3 involves simulating a cybersecurity attack and/or privacy leakage. The latter allows to assess the CUREX platform in terms of how scores change and analyze the quality of the suggested mitigation measures. Figure 2: Diagram of the proposed use case described as in [12]. (**top**) Use case scenario diagram of the steps of the scenario for the communication of simulated clinical data with medical devices. (**middle**) Misuse case scenario diagram of steps of the scenario to access services through the smartphone app.