# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 1 Introduction  
For many years, malicious cyberactors have been targeting the industrial control systems (ICS) that manage our critical infrastructure. An ICS incident may have the following potential consequences: impact on national security--facilitating an act of terrorism; reduction or loss of production at one or multiple sites simultaneously; injury or death of employees; environmental damage; release, diversion, or theft of hazardous materials; violation of regulatory requirements; product contamination; criminal or civil legal liabilities; loss of proprietary or confidential information; and loss of brand image or customer confidence. Security has become a high priority for operational technology (OT) systems in recent years due to targeted cyber-incidents. Previously, the primary focus of these systems was reliability, but today, security also holds significant importance. To improve the security in industrial systems, it is necessary to understand the flaws and provide countermeasures [1]. The ENISA (European Union Agency for Cybersecurity) Threat Landscape (ETL) report, which is in its 11 th edition [2], offers a comprehensive view of the cybersecurity threat. The report emphasized the continued rise in cybersecurity attacks in the latterpart of 2022 and the first half of 2023, not only in terms of their number and vectors but also in terms of their impact. The Russia-Ukraine crisis has ushered in a new era of cyber warfare and hacktivism. Additionally, state-sponsored threat actors will intensify their reconnaissance efforts against OT networks, enhance their capabilities, and progressively target them in the near future, particularly during periods of armed conflict and crisis. Given their adaptability and ability to target a wide range of victims and equipment used in a variety of industries, we can infer that state-backed actors interested in attacking OT networks will continue to allocate resources and develop extensible ICS malware frameworks. In addition, Fortinet's 2022 State of Operational Technology and Cybersecurity Report says that organizations around the world are not doing enough to protect ICS and Supervisory Control and Data Acquisition (SCADA) systems in the relatively new world of connected OT. Cyberattacks on OT systems have increased over the past decade because they are more vulnerable to offsite attacks. While OT systems were traditionally air-gapped from IT systems, these two infrastructures are almost universally integrated today. OT systems, now connected to the internet and theoretically accessible from anywhere, significantly expand the attack surface for industrial organizations, further bolstered by the increasing ubiquity of Industrial Internet of Things (IIoT) devices. At the same time, connected OT systems are vulnerable to an IT threat landscape that is getting more advanced [3]. Kaspersky Lab's ICS-CERT report highlights the threat landscape for industrial automation systems in Q1 2024. The percentage of ICS computers that blocked malicious objects during the quarter varied by region, from 32.4% in Africa to 11.5% in Northern Europe. The two regions with the highest percentage of attacked ICS computers, Africa and Southeast Asia, experienced an increase in their percentages from the previous quarter. Historically, among the surveyed industries, building automation has proven to be the most effective in preventing malicious objects from accessing ICS computers. The percentage of ICS devices that blocked malicious objects decreased across all industries in the first quarter of 2024. According to an additional survey, the energy and gas sector is particularly appealing to attackers on a global scale. Over the past year, ransomware gangs have targeted significant organizations throughout Europe as an opportunistic response to the Russian-Ukraine conflict. This has led to a widespread disruption of energy supplies, which is the focus of this research [4].