## 4 Verification and Validation
### Validation of the Applicability of the Proposed Model Using Real Project Data
#### 4.3.5 Implementation of the Model  
The experts were asked to provide the relevant characteristics of both file types in two different projects for the implementation of the game-theoretic model. When the file accessibility levels were assessed, the experts mentioned that structural design files were much less accessible in both projects than resource management files. Moreover, they indicated that the second project's client had a higher priority for confidentiality. Therefore, the accessibility of both files was lower in project 1 compared to project 2. For resource management files, the experts indicated that even though they were accessible to most project employees, the files' cost-related columns were only accessible to a small group. For this reason, they did not assign \"very high\" accessibility for this file type, even for project 1. All file accessibility levels are summarized in Table 10.  
The experts were asked to provide their opinion about the value of the provided file types to a potential malicious insider with a financial motivation--the same malicious insider as the hypothetical scenario. They argued that the structural design files would be \"critical\" to potential malicious insiders since they are considered intellectual property with high financial value. They mentioned that the resource management file would have a \"medium\" value in project 1 and a \"high\" value in project 2 since they included cost information. Since this file type included labor cost and project 2 had higher commercial \begin{table}
\begin{tabular}{l l l} \hline \hline
**File Type** & **File Accessibility Level (Project** & **File Accessibility Level (Project** \\  & **1)** & **2)** \\ \hline Structural design file & Low & Very low \\ Resource management file & High & Medium \\ \hline \hline \end{tabular}
\end{table} 
Table 10: File accessibility levels for projects 1 and 2. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Project Phase** & **Construction Phase** & \\ \hline
**Scenarios** & **Characteristic** & **Value** \\ \hline Project 1 & & \\ (High-rise building) & The overall security level of the project & Medium (0.5) (See Table 3) \\ \hline  & The probability that the malicious & \\  & insider who launches a cyberattack is & 0.49 \\  & detected (\(\mathrm{P}_{2}\)) & \\ \hline  & The probability that the malicious & \\  & insider who uses authentication is & 0.55 \\  & detected (\(\mathrm{P}_{1}\)) & \\ \hline Project 2 & & \\ (Theme park) & The overall security level of the project & Medium (0.5) (See Table 3) \\ \hline  & The probability that the malicious & \\  & insider who launches a cyberattack is & 0.49 \\  & detected (\(\mathrm{P}_{2}\)) & \\ \hline  & The probability that the malicious & \\  & insider who uses authentication is & 0.55 \\  & detected (\(\mathrm{P}_{1}\)) & \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Characteristics of projects 1 and 2.  
value, its value to a potential malicious insider in project 2 was considered higher by the experts. These values are shown in Table 11.  
Finally, the experts were asked about the criticality of the given file types in both projects considering different cybersecurity attributes (i.e., confidentiality, integrity, availability). They mentioned that in both projects, the confidentiality and integrity of the structural design files were \"critical\". They emphasized the financial value of the structural design files, which increased the importance of confidentiality. From the integrity perspective, they agreed that a potential unauthorized change in structural design files could lead to a catastrophic outcome if not discovered quickly. They considered the availability of the design files to have a \"medium\" level of importance in both projects since their unavailability would cause a minor delay in the project and require additional resources to recover. However, they did not think that it would have a significant impact on both projects.