# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## 5 Mapping a Case Study to the Taxonomy
### The Maroochy Shire Incident  
The Maroochy Shire case study was selected because it provided an example of a malicious insider, whereas the Stuxnet case study provided an example of a malicious outsider. The insider case is more typical of the type of incident that companies usually can expect [25] to experience. The specific incident took place in early 2000 at the Maroochy water services plant in Queensland, Australia. Because it was one of the first definitively confirmed malicious industrial cyber incidents, the Maroochy Shire incident has since been extensively analyzed. The analyses conducted by [PERSON] et al. [26] and [PERSON] et al. [27] were used for mapping purposes. The incident occurred when a disgruntled contracted ex-employee, [PERSON], accessed the plant control system remotely through an unsecured radio link over several months. He disrupted the plant's operation and caused a discharge of effluent into the local stream. Detection of the incident occurred when personnel noticed a discrepancy between the actual pump state and what was shown on the operator display. An investigation followed, which led to the identification of a wireless connection as the attack vector. Analysis of this incident is provided below by means of using the harmonized taxonomy. The numbering references used were as indicated in Figure 14, with the assessment core element details as indicated in Figure 6.  
The incident occurred during the plant maintenance and operational lifecycle phase (10). The primary cause or threat agent (14) was the disgruntled ex-employee who exploited vulnerabilities in the system configuration and security perimeter (13). Considering the risk assessment as detailed in the harmonized taxonomy (see Figures 6 and 12), there were several internal and external failures (12) and gaps in the supporting technology and digital forensics. These gaps are noted below. When the risk assessment (12) element of the taxonomy was considered, several internal failures (identified gap 1) appeared. These included failures in process design and execution, specifically notifications and alerts, SLA management and, to a lesser extent, process documentation. Furthermore, internal process control failed due to status monitoring and periodic reviews being inadequate. Lastly, regarding internal failures, the staffing supporting process resulted in a dismissed contract employee retaining his access to the system. Moving on to external events revealed the next unaddressed risk (identified gap 2) in that the plant could not adhere to regulatory operating requirements and caused environmental damage through the discharge of effluent, which in turn required extended clean-up. The system and technology failures element highlighted a design (identified gap 3) problem, with the logical plant security perimeter permitting wireless remote access for authorized equipment. The scenario of the equipment being stolen and then used was not envisioned. The final element of the risk assessment identified a knowledge inaction risk (identified gap 4). Even though the discrepancy and intrusion were identified by an employee, it took some time and required tacit knowledge that had not been codified or generally available. Formal knowledge of the system configuration and structure could potentially have allowed for earlier identification. Consideration of the risk mitigation core elements led to the identification of additional gaps. There was a general lack of supporting technology (identified gap 5), with some of the most obvious being inadequate or missing intrusion detection, access control and logging. If any of these had been adequately addressed, it could have made the intrusion much more complex and may have allowed for earlier detection. The digital forensics element was completely dependent on individual knowledge, with no formalized process in place (identified gap 6). Detection and triage took place because a site engineer could identify discrepancies in the assigned station numbers and, from there, locate a wireless intrusion.