# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 4 Case Study & Performance Evaluation
### Stage IV--Analyze the Threats
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**ID** & **Year** & **Entity Breached** & **Tactic** & **Attack Name** \\ \hline \multirow{3}{*}{1} & \multirow{3}{*}{2010} & \multirow{3}{*}{Iranian nuclear plant} & The Stuxnet worm initially infiltrated the plant via a USB stick, which then targeted control software used to program the operation of the uranium centrifuges. \\  & & & \\ \hline \multirow{3}{*}{2} & \multirow{3}{*}{2011} & \multirow{3}{*}{Energy sector operations in the U.S., Switzerland, and Turkey} & The group DragonFly was established in 2011 but became increasingly active in 2017, using remote access tool (RAT) malware by way of spear \\  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & & \\ \cline{1-1}  & & & & \\ \cline{1-1}  & & & & \\ \cline{1-1}  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Real-world ICS breach. Figure 14: ATT&CK Matrix for ICS [39]. Figure 13: ICS Source of Threats. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**ID** & **Year** & **Entity Breached** & **Tactic** & **Attack Name** \\ \hline
3 & 2013 & Multiple ICS targets in energy and pharmaceuticals & The group Energetic Bear used watering holes and phishing attacks for espionage and reconnaissance. & phishing attacks \\ \hline
4 & 2015 & Ukraine’s electrical grid & Industroyer is a type of malware that was used to control electricity substations and circuit breakers. & malware \\ \hline
5 & 2017 & Saudi-Arabian petrochemical plant & Adversaries used TRITON malware to bypass physical safety systems. They moved laterally through the network for over a year, renaming files and mimicking regular processes until they accessed the ICS’ safety instrumented system (SIS). & malware \\ \hline
6 & 2018 & Over 200,000 entities in energy, manufacturing, oil \& gas, petrochemical, and others in over 150 & Attackers used WannaCry in a resnomware \\ \hline
7 & 2021 & Colonial Pipeline Attack & hackers obtained access to Colonial Pipeline Co.’s networks using a virtual private network account. & ransomware \\ \hline \hline \end{tabular} By referring to STRIDE stages I, II, and III and Tables 3 and 6, threat analysis results are summarized in Table 7.  
\end{table} 
Table 6: _Cont._ \begin{table}
\begin{tabular}{c l l} \hline \hline
**ID** & **Term** & **DFD Element** \\ \hline
1 & Spoofing/Impersonation & P-1, P-2, P-3, P-4, P-5, P-6, P-10, P-12, P-16, P-17, P-18, P-19 \\  & EE-1, EE-2 & P-1, P-2, P-3, P-4, P-5, P-7, P-8, P-9, P-10, P-11, P-12, P-13, P-14, P-15, P-16, P-17, P-18 \\
2 & Tampering of Data & P-2, P-3, P-4, P-5, P-7, P-8, P-9, P-10, P-11, P-12, P-13, P-14, P-15, P-16, P-17, P-18 \\  & DF-1, DF-2, DF-3, DF-4, DF-5, DF-6, DF-7, DF-8, DF-9, DF-10, DF-11, DF-12 \\ \hline
3 & Repudiation & P-1, P-2, P-3, P-4, P-5, P-6, P-8, P-12, P-13, P-14, P-16 \\  & EE-1, EE-2 & P-1, P-3, P-6, P-7, P-12, P-14, P-16, P-19, P-18, P-19, \\
4 & Information disclosure & P-1, P-3, P-6, P-7, P-12, P-14, P-16, P-19, P-18, P-19, \\  & DF-1, DF-2, DF-3, DF-4, DF-5, DF-6, DF-7, DF-8, DF-9, DF-10, DF-11, DF-12 \\ \hline
5 & Denial of service & P-1, P-2, P-3, P-4, P-5, P-6, P-9, P-12, P-14, P-15, P-16, P-17, P-18, P-19 \\  & DF-1, DF-2, DF-8, DF-4, DF-11 \\ \hline
6 & Elevation of privilege & P-1, P-2, P-3, P-4, P-5, P-6, P-7, P-12, P-14 \\ \hline \hline \end{tabular} The system diagram analysis is based on the STRIDE-per-Element Model, which provides a prescriptive approach to threat modeling (see Table 8).  
\end{table} 
Table 7: Threat modeling using STRIDE-per-element methodology.