# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 5 Discussion  
The primary objective of this research is to present a comprehensive and detailed novel framework utilizing a combination of threat modeling methodologies such as PASTA, STRIDE, and attack trees. This study focuses on assisting organizations with legacy industrial control systems (ICS) to initiate a re-evolution and assessment of their systems. The study examines a gas production (onshore facilities) industrial control system (ICS). The Common Vulnerability Scoring System (CVSS), a vulnerability scoring system designed to provide a standardized method for system rating vulnerabilities, is used as the basis for metric definition and calculations. The model proposes calculating the CVSS once before applying the threat mitigation and then recomputing the security metric to verify the effectiveness of the applied mitigations.  
Before threat mitigation, the total risk of hardware (network) vulnerability was equal to 80; after mitigation, it dropped to 16. Consequently, the decrease indicates that the mitigations were effective. Furthermore, we experimentally compared the proposed framework with two other approaches: the first, which exclusively applies the PASTA framework, and the second, which incorporates hybrid threat modeling as presented by [PERSON] [36]. Table 16 presents a detailed comparison of the three approaches. All the results show that, in terms of threat and vulnerability identification, risk value, and risk reduction as well as documentation, the suggested hybrid framework identifies more risks.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multirow{2}{*}{**ID**} & \multicolumn{2}{c}{**Criteria**} \\ \cline{2-3}  & **Methods Utilized** & **Advantages** & **Drawbacks** \\ \hline \multirow{6}{*}{**PASTA Alone**} & \multirow{6}{*}{PASTA} & \multirow{6}{*}{(1) Systematic approach to threat modeling (2) Focus on identifying potential threats} & (1) May not capture all potential threats (Shows high risk value comparing with our proposed framework, which shows critical risk value, as threats associated with STRIDE not considered) (2) Limited ability to prioritize threats \\ \cline{1-1} \cline{2-3}  & & & (1) May not capture all potential threats (2) Limited ability to prioritize threats \\ \cline{1-1} \cline{2-3}  & & & (2) Limited ability to prioritize threats \\ \cline{1-1} \cline{2-3}  & & & (1) Comprehensive threat modeling by combining STRIDE and Attack Trees (2) Improved threat identification and prioritization (3) Better visualization of potential attack paths & (3) May not provide quantitative risk assessment (4) The STRIDE technique does not aid in developing countermeasures \\ \cline{1-1} \cline{2-3}  & & & (4) The STRIDE technique does not aid in developing countermeasures \\ \hline \hline \end{tabular}
\end{table}
Table 16: Comparison of PASTA, Hybrid Framework [36] and the Proposed Framework: Advances and Drawbacks.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multirow{2}{*}{**ID**} & **Attack Vector** & **Threat/Vulnerability Detection** \\ \cline{2-3}  & **Focus** & **Attack Vector Analysis** & **Focus** & **Threat Identification** \\ \hline \multirow{6}{*}{Summary} & \multirow{6}{*}{With an emphasis on simulated scenarios and comprehensive risk analysis, PASTA offers a comprehensive and risk-centric perspective of attack vectors and threats.} & \multirow{6}{*}{\(\bullet\) The Hybrid Approach (PASTA + STRIDE + Attack Trees) combines the risk simulation of PASTA with the threat classification of STRIDE and the path analysis of Attack Trees to provide a more thorough and organized study that may uncover additional threats.} & \multirow{6}{*}{\(\bullet\) The hybrid approach generally results in a more detailed understanding of attack vectors and a potentially larger number of identified threats due to its in-depth structured analysis.  
\end{table}
Table 15: _Cont._