# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 4 Case Study & Performance Evaluation
### Stage IV--Analyze the Threats
* The threat affects the CVSS, which uses updated information from the analysis of threats, vulnerabilities, and attacks to determine the severity of each security control's vulnerabilities. The risk associated with threat can be quantified using the following equation:  
\[Risk_{t}=Threat_{Pt}\times Vulnerability\times Impact_{It} \tag{2}\]  
\[Total\ Risk=\sum_{i=1}^{n}Risk_{it} \tag{3}\]  
where  
* \(Risk_{t}\): is the value of threat \(t\). * \(Threat_{Pt}\): is the probability of threat \(t\) to exploit the vulnerability. * \(Impact_{It}\): is the impact of threat \(t\) if it is successfully exploiting the vulnerability
* \(n\) is the number of identified threats  
1. The first step is to assess the likelihood that threat events will be initiated (likelihood or probability of occurrence) see Table 9.
2. The second step is to assess the vulnerability once it is initiated or occurs (Threat capabilities); see Table 10.
3. Finally, organizations assess the overall likelihood as a combination of the likelihood of initiation/occurrence and the likelihood of resulting in adverse impact see Figure 15.0
4. Threat capability rating is the likelihood that an attack will be successfully realized based on the capability of the attacker to target a specific vulnerability. 5. Finally, the threat Score is calculated as shown in Equation (4). Figure 15.1  
Figure 15.2 \begin{table}
\begin{tabular}{l l l} \hline \hline
**Likelihood** & **Description** & **Threat Level** \\ \hline \multirow{3}{*}{Highly Likely} & Occurrence several times per year & \\  & Every one to 3 years in this facility & High 4 \\  & Target attractiveness: primary and desirable target & \\ \hline \multirow{2}{*}{Possible} & Occurs every 5 to ten years in this facility & \\  & Target Attractiveness: May be a desirable target or potential target of attack & Medium 3 \\ \hline \multirow{3}{*}{Unlikely} & Heard of in specific sectors but not in the operation facility & \\  & Target Attractiveness: may be a desirable target or potential target for Attack. & Low 2 \\ \cline{1-1}  & May not be worth the effort to achieve due to fully managed control implementation. & \\ \hline \multirow{2}{*}{Very Unlikely} & Never heard of this in this industry & \\ \cline{1-1}  & Target attractiveness: Not a potential target, Limited scope & Very Low 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Likelihood or probability of occurrence of threat. For example, the severity of one of the vulnerabilities will be calculated by assigning values to each of the base metrics and creating the base vector as follows:  
Hardware (Network) vulnerability severity or impact score is  
_Vector String = AV: [N]/AC: [L]/PR: [H]/UI: [N]/S: [C]/C: [H]/I: [H]/A: [H] Base Score = 9.1 (Critical)_  
The Base Score breakdown includes:  
Less than 0.1 = No threat to the system  
0.1-3.9 = Low  
4.0-6.8 = Medium  
7.0-8.9 = High  
9.0-10.0 = Critical  
Reviewing the threat score shows that the history of using hardware or network compromise is highly likely and capability is medium, i.e., the threat score is High (=8). By using Equation (4). It means the total risk of hardware (network) vulnerability is equal:  
\[Risk=\textit{Threat Score}\ (High=8)\times\textit{Impact}\ (Critical=10) \tag{6}\]  
\[\therefore\ \textit{Risk}=80\ (Very\ \textit{High})\]  
Accordingly, risk reduction is required by recommended and implemented mitigation for this vulnerability. After mitigation, the risk will be re-calculated in an iterative cycle until it reaches the acceptance risk factor. The re-calculation of the hardware or network compromise after implementing the system countermeasure (recommended mitigation), the vector string will be  
_Vector String = AV: [N]/AC: [H]/PR: [H]/UI: [R]/S: [U]/C: [L]/I: [L]/A: [L] Base Score = 3.9 (LOW)_  
Consequently, by reviewing the threat score after implementing the countermeasure, it shows that the history of using hardware or network compromise is highly likely and