# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## 5 Mapping a Case Study to the Taxonomy
### Harmonized Taxonomy Application Methodology  
The application methodology only acts as a guide to the usage of the harmonized taxonomy. It cannot function in isolation. As discussed in the previous section, the taxonomy contains multiple detailed sub-elements below the elements listed in Table 3. It is important when applying the taxonomy to consider not just the high-level elements but also the detailed sub-elements to ensure that a full system analysis is performed. A specific example describing the relationship between the taxonomy elements and the methodology elements is provided at the end of this section. Two application methodologies are presented. The first (see Figure 13) details the generic process that will be followed by a plant owner over the lifecycle of a typical CPS. For the sake of completeness, this methodology is discussed in detail to illustrate the application of the taxonomy over the full lifecycle. The second methodology (see Figure 14) is a subset of the generic methodology and only considers the incident investigation actions. It was this simplified (second) methodology that was used for the case study analysis. This was because the incident occurred during the maintenance and operational phase of the plant lifecycle, and the information for the specification, design, and implementation phases was not available. The original design intent of the system and the operational constraints were not part of the papers used in the analysis. \begin{table}
\begin{tabular}{c c c c} \hline
**Harmonized Taxonomy:** & **Harmonized Taxonomy:** & **Methodology: Element Number(s)** \\
**Element** & **Element Number** & **Methodology: Element Number(s)** \\ \hline System lifecycle & 1 & System lifecycle & 1, 3, 9, 10, 19 \\ Risk assessment & 6 & Risk assessment & 4, 12, 16 \\ Threats & 7 & Threat source or agent & 6, 14 \\ Vulnerability & 8 & Vulnerabilities & 5, 13 \\ Supporting technology & 4 & Supporting tech and forensics & 8, 12, 15, 17 \\ Digital forensics & 5 & Supporting tech and forensics & 8, 12, 15, 17 \\ \hline \end{tabular}
\end{table} 
Table 3: The links between the taxonomy and the application methodology elements. Figure 14: Harmonized taxonomy and case study methodology. Figure 13: Harmonized taxonomy and generic methodology. The application methodology follows the CPS lifecycle as per the harmonized taxonomy. It starts with the specification (1) phase. While this phase is not generally used to address security concerns, several activities influence the security and system design. Specifically, hazardous operation studies and process safety requirements (2) provide information to quantify risk, including monetary loss and environmental and safety impacts, as well as to impose restrictions on safety system integrity. The design phase (3) requires the initial risk assessment (4), where the internal and external risks are evaluated, as discussed in Section 4. The adequacy of existing protection measures, possible threat sources (5) and existing system vulnerabilities (6) is checked and documented. Completing the full risk assessment will allow for the identification of gaps that will be addressed through updating of policies and procedures (7), adding supporting protection technology and a digital forensic analysis (8) process. In some cases, it might be found that the specified CPS cannot meet the security requirements due to inherent constraints, and alternative systems might have to be considered. During the implementation phase (9), the complete CPS (including digital forensics and supporting technology) will be evaluated, typically during factory acceptance testing, to ensure that it meets the security design requirements. This evaluation will also include an evaluation of the failed processes element in Figure 6 to ensure the company processes do not introduce additional business risk. After commissioning, the CPS enters the commercial operation or maintenance phase (10). This phase is the longest in the CPS lifecycle.