# Security Assessment of Agriculture IoT (AIoT) Applications
## 2 Materials and Methods
### Process Step: High Level Cybersecurity Risk Analysis
#### 2.5.6 Security Aspect: AP Factors
This factor states that the faster an attacker finds a vulnerability, the lower the protection is. Question: how much time is required to get access to the system? **Expertise/Skills (ES)** \begin{table}
\begin{tabular}{c c c} \hline \hline
**Range** & **Value** & **Description** \\ \hline Unlimited & 1 & Unlimited access to system, no security measures \\ \hline Easy & 2 & \\ \hline Moderate & 4 & \\ \hline Difficult & 8 & Access to the system is very difficult due to security measures \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Attack potential factor: access. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Range** & **Value** & **Description** \\ \hline Ordinary person & 1 & Attacker has no special attack skills \\ \hline Cybercrime, hacker, & & 2 & Attacker has generic attack skills \\ Competitors, malicious insider & & \\ \hline Terrorist, professional thieves, & & \\ Cybercriminals & & 4 & Attacker has control system specific skills \\ \hline Groups/nation-states, governmental & & \\ organization & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Attack Potential Factor: Expertise/Skills. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Range** & **Value** & **Description** \\ \hline Ordinary person & 1 & Attacker has no special attack skills \\ \hline Cybercrime, hacker, & & \\ Competitors, malicious insider & & \\ \hline Terrorist, professional thieves, & & \\ Cybercriminals & & \\ \hline Groups/nation-states, governmental & & \\ organization & & \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Attack potential factor: expertise/skills. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Range** & **Value** & **Description** \\ \hline Public & 1 & Full public knowledge of specific target is available to perform the attack. Necessary skills are documented publicly. \\ \hline Restricted & 2 & \\ \hline Sensitive & 4 & \\ \hline Critical & 8 & Extensive, nonpublic target knowledge and expertise are necessary to carry out the attack. \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Attack potential factor: access. Knowledge of the underlying principles or methods of a suitable attack. Question: which expertise or skills does the attacker have? **Target Knowledge (TK)**  
Level of target technologies and knowledge needed to carry out the attack. But to perform an attack, the necessary tools are also needed. Question: which target knowledge and tools does the attacker have? **Access (AC)**  
Access level of the target needed to carry out the attack. Question: which access restrictions does the target system offer? **Equipment (EQ)**  
Knowledge and equipment to identify or exploit the vulnerability to prepare an attack. Question: which tools does the attacker have to perform the attack? The sum of all attack potential values (AP value) gives a first cybersecurity assessment value which is used to determine the related SL, according to the IEC 62443 standard. In this assessment, the value ranges from 6-48. Table 12 gives the definition of the necessary protection and espionage requirements. **Attack Potential value overview**  
In a next step, the resulting AP value will be combined with the probability or likelihood that the attack will occur, which determines the severity of the attack risk.