## 5 Case Study
### Application of Exploit Risk Assessment in OT/ICS Environments  
To validate the effectiveness of the vulnerability risk assessment method proposed in this study, we recreated a scenario based on a real-world threat case as shown in Figure 6. This scenario simulated a network-separated OT/ICS environment, where an attacker exploited a minimized airgap vulnerability between the business and industrial areas to perform process control and information leakage attacks through an external command and control server. Vulnerabilities affecting assets were identified using CVEs sourced from NVD, whereas vulnerabilities targeted by attack execution procedures were identified through Greynoise and threat reports containing information on real-world exploited vulnerabilities that were not collected in this study. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**CVE ID**} & \multirow{2}{*}{**Exploit Chaining Risk**} & \multicolumn{2}{c}{**Ease of Exploitation**} & \multirow{2}{*}{**Exploitation Risk Score**} & \multirow{2}{*}{**Base Score**} \\ \cline{2-2} \cline{4-6}  & ECP & W (T) & EUP & ECA & \\ \hline \multirow{2}{*}{ CVE-2023-36844} & 0.62 & 18.75 & 0.38 & 2 & \\  & & 11.625 & & 0.76 & 12.385 & 5.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Scoring results for ‘CVE-2023-36844’. In this study, we applied the proposed vulnerability exploitation risk assessment methodology to the control server, which is a crucial component of the attack scenario that directly or indirectly affects the process. We then performed a comparative analysis of our results with those obtained from existing vulnerability assessment systems. The control server is equipped with an ecosystem control expert, which is the control software that monitors and controls the subordinate programmable logic controllers (PLCs). An attacker could gain administrative privileges, and remotely issue carefully crafted logic commands to the PLCs for process control. Detailed information about the vulnerabilities identified in the control server is presented in Table 11. This information encompasses not only basic information about each vulnerability but also details on the techniques that could be used for exploitation and the potential impact on an attacker. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**CVE ID** & **Base Score** & \begin{tabular}{c} **Exploitation** \\ **Technique** \\ \end{tabular} & \
\begin{tabular}{c} **Primary** \\ **Impact** \\ \end{tabular} &
\begin{tabular}{c} **Secondary** \\ **Impact** \\ \end{tabular} & **Tactics** \\ \hline CVE-2015-7855 & 6.5 & 1 & 2 & 1 & 5 \\ CVE-2023-38558 & 5.5 & 1 & 2 & 0 & 3 \\ CVE-2016-9899 & 9.8 & 1 & 1 & 3 & 6 \\ CVE-2019-19281 & 7.5 & 1 & 3 & 1 & 5 \\ CVE-2017-17562 & 8.1 & 1 & 1 & 3 & 6 \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Exploited vulnerability basics and tactical/technical information. Figure 6: Examples of attack scenarios in a control system environment. We used the mapping methodology employed in this study to map the exploitation techniques utilized by attackers against the vulnerability, as well as the cascading techniques that cause subsequent impacts. Subsequently, we implemented the vulnerability exploitation risk assessment as outlined in this study. Table 12 evaluates each of the proposed indices for exploited vulnerabilities to produce a final exploitation risk score. A total of five vulnerabilities were identified in this asset, and among them, only three were exploited. Notably, among these three exploited vulnerabilities, there were vulnerabilities with a score of 7.0 or lower that were not addressed within the existing assessment system. Following the ERS evaluation, the vulnerability CVE-2015-7855 was rated higher than CVE-2019-19281, which had a score of 7.5 in the existing evaluation system. This is primarily due to CVE-2015-7855 having a significantly higher ECR and a significantly higher probability of being exploited and utilized in an attack.