# Security Assessment of Agriculture IoT (AIoT) Applications
## 2 Materials and Methods
### Process Step: High Level Cybersecurity Risk Analysis
#### 2.5.9 Security Risk Matrix  
Finally, the security risk matrix compares the risk severity with the attack probability/likelihood of an attack (as illustrated in Table 15). Questions: how serious is a successful attack on the system function? The table value is the product of the severity and the probability value. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Range** & **Value** & **Description** \\ \hline \multirow{2}{*}{Very high} & 11...12 & Most likely to occur \\  & e.g., event occurred or is expected to occur within one to four months \\ \hline \multirow{2}{*}{High} & 9...10 & Likely to occur \\  & & e.g., event occurred or is expected to occur within 1 year \\ \hline \multirow{2}{*}{Moderate} & 6...8 & Quite possible/not unusual \\  & & e.g., event occurred or is expected to occur within 1 to 5 years \\ \hline \multirow{2}{*}{Low} & 3...5 & Unusual/possible \\  & & e.g., event occurred or is expected to occur within 5 to 10 years \\ \hline \multirow{2}{*}{Very Low} & 0...2 & Conceivably possible but very unlikely to occur, \\  & & e.g., event could occur at some time greater than 10 years \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Probability/likelihood of attack. \begin{table}
\begin{tabular}{c c} \hline \hline
**Severity Level** & **Explanation** \\ \hline \(0/\)None & The attack has no impact \\ \hline \multirow{2}{*}{\(1/\)Low} & A minor incident with low impact \\  & \(\bullet\)  System operation interrupted but continues operation \\  & \(\bullet\)  Incorrect operation by user \\ \hline \multirow{2}{*}{\(2/\)Medium} & A minor incident with medium impact \\  & \(\bullet\)  System operation interrupted and needs a manual restart and a system scan \\ \hline \multirow{2}{*}{\(3/\)High} & A major incident with significant impact \\  & \(\bullet\)  System operation failed \\  & \(\bullet\)  Production data loss \\ \hline \multirow{2}{*}{\(4/\)Critical} & A critical incident with very high impact \\  & \(\bullet\)  Confidentiality or privacy is breached \\  & \(\bullet\)  System operation failed, complete system recovery necessary \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Severity levels. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Risk**} & \multicolumn{5}{c}{**Probability/Likelihood of Attack (PL)**} \\ \cline{2-6}  & **Very Low** & **Low** & **Moderate** & **High** & **Very High** \\  & 0...2 & 3...5 & 6...8 & 9...10 & 11...12 \\ \hline \multicolumn{6}{c}{**Severity**} \\ \hline
**0** & 0 & 0 & 0 & 0 & 0 \\ \hline
**1** & \(\leq\)2 & \(\leq\)5 & \(\leq\)8 & \(\leq\)10 & \(\leq\)12 \\ \hline
**2** & \(\leq\)4 & \(\leq\)10 & \(\leq\)16 & \(\leq\)20 & \(\leq\)24 \\ \hline
**3** & \(\leq\)6 & \(\leq\)15 & \(\leq\)24 & \(\geq\)24 & \(\geq\)24 \\ \hline
**4** & \(\leq\)8 & \(\leq\)20 & \(\geq\)4 & \(\geq\)24 & \(\geq\)24 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Cybersecurity: risk matrix. The risk value is the product of the severity multiplied with the probability/likelihood. \[Risk\ Value=Severity*PL \tag{1}\]  
The AP value range 1-6 defines the tolerable risk, the risk where theoretically no protection is necessary. In this case, it is defined as the SL-0. As already mentioned in Table 2, IEC 62443 defines five SLs, from SL-0 to SL-4, for different attack strengths and different protection requirements definitions. In the high-level cybersecurity risk assessment phase, the resulting SL-T is defined. SL-T states the necessary SL to protect the underlaying SuC in a proper way. To distribute the five SLs, SL-0 to SL-4, over the given attack potential range (AP values 0...48 from Table 12), the IEC 62443 standard defines the Cyber Risk Reduction Factor (CRRF) to support the mapping of the AP values to the SL values. \[CRRF\ =\ \frac{\text{Risk}}{6} \tag{2}\]  
The factor 6 denotes the value of the maximal tolerable risk (see the appointed green areas in Table 16). In this cybersecurity assessment example, 15 threats (as illustrated in Figures 5 and 6) are selected for the high-level risk analysis.