## 3 Results
### Agriculture Case Study
Based on the outcomes of THREATGET, we investigated which threats had a high impact on system components and related security attributes that were considered a set of existing security vulnerabilities. Table 3 represents a set of some selected threats identified by THREATGET and shows the affected system components and which of the related security attributes are defined as security vulnerabilities in the system, which pave multiple paths for an attacker to perform a set of malicious activities. Figure 5: Modeling an agriculture example using ThreatGet. Figure 6: Classification of all identified threats according to the STRIDE model. The table shows a sample of the identified threats by THREATGET and gives details on the existing security vulnerabilities for each affected component. For example, the threat \"Network protection from malicious code\", according to IEC 62443 part 4-2 [13], network devices should be protected against incoming malicious data that could have a harmful impact on the network device and the other system components connected to it. As a result, THREATGET verifies the integrity of incoming data to the Field Gateway system component in order to ensure that the incoming data are legitimate. Consequently, the tool detects that the input validation security attribute is not activated for this component (in this case, Field Gateway) in order to mitigate a similar threat. It is defined in the table that the input validation security attribute is considered to be a violated security attribute in this case and should be addressed. The full investigation of identified threats is described in Appendix A. Based on our investigation into the outcomes of THREATGET, we define all needed security attributes for protecting the system model. Table 4, summarizes all affected elements and related security attributes. It is shown in the table which security attributes are required for each system component in order to mitigate cyber threats. We assume that a surface attack on the system model will be conducted through the previously discussed attack paths (i.e., **Path 1** and **Path 2**). This is illustrated in our case study in Figure 5. For this reason, based on Table A1 and the most prevalent security attributes for each component listed in Table 4, two attack path scenarios in which a surface attack will be propagated are anticipated to present. We \begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Affected Component**} & \multicolumn{1}{c}{**Security Attributes**} \\ \hline \multirow{2}{*}{Sensor} & Authentication, Secure Boot, Input Validation, \\  & Anomaly Detection \\ \hline \multirow{2}{*}{Interface1} & Authorization, Encrypted, Authentication \\  & Authentication, Tamper Protection, Input Validation, \\  & Authorization, Updates, Secure boot, Encrypted, \\  & Anomaly Detection \\ \hline \multirow{2}{*}{Interface2} & Authentication, Authorization \\ \hline \multirow{2}{*}{Actuator ECU} & Authentication, Authorization, Secure Boot, \\  & Input Validation, Anomaly Detection \\ \hline \multirow{2}{*}{Actuator} & Authentication \\ \hline \multirow{2}{*}{Interface3} & Authorization, Authentication, Anomaly Detection \\ \hline \multirow{2}{*}{Field Gateway} & Activity Logging, Anomaly Detection, Tamper Protection, \\  & Input Validation, Secure boot, Input Sanitization \\ \hline \multirow{4}{*}{IoT Gateway} & Input Validation, Encrypted, Authentication, \\  & Activity Logging, Anomaly Detection, Input Sanitization \\ \cline{1-1}  & Tamper Protection, Input Validation, Authorization, \\ \cline{1-1}  & Secure Boot, Encrypted, Anomaly Detection, \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of all affected system components and related violated security attributes.