# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 3 The Proposed Hybrid Threat Model  
Almost every industry that uses automation to control processes has legacy systems, which are insecure by design. Applying cybersecurity to industrial control systems (ICS) with aging hardware and software, which are particularly vulnerable to cyberattacks due to their outdated technology and lack of support from original equipment manufacturers (OEMs), presents a significant challenge. The first method to modernize the legacy system involves replacing it, a process that incurs significant costs due to the replacement project fund and potential production loss. The second method involves the organization implementing a comprehensive security strategy specifically designed for the legacy system. This paper proposes a framework to assist the organization in developing a security strategy for its legacy system, thereby mitigating cost-related challenges. We will combine three threat modeling methods (PASTA, STRIDE, and attack trees) as discussed in Section 2 and shown in Figure 4. This framework uses PASTA modeling as its foundation. The 7-stage PASTA threat model can be applied to existing projects or during the definition phase of a new project. The framework organizes the simultaneous application of multiple threat modeling approaches, resulting in a single set of outputs. Furthermore, the MITRE ATT&CK framework provides a comprehensive dataset of known adversary tactics, techniques, and common mitigations, facilitating the creation of a threat library that serves as a comprehensive input for vulnerability analysis, attack analysis, and mitigation planning. Moreover, we employ CVSS to ascertain the system's risk score, both prior to and following the mitigation phase, thereby quantifying the system's vulnerability score and evaluating the efficacy of the mitigations. Thus, the proposed model helps discover a wider range of threats. _PASTA/STRIDE Stages (I to VII)_  
**Stage I: Defining Security Objectives. ** Determining the objectives, whether internal, external, or driven by your user base, is the first step in the PASTA methodology. You should clearly understand the purpose of the application. How does it generate revenue for your company? What regulations should the application incorporate? Unlike traditional, static threat modeling methods, PASTA stage one gives you the opportunity to incorporate governance into these discussions and bake it in from the very beginning. Furthermore, the first STRIDE step is to identify and document the assets, data, functions, user interfaces, and infrastructure. Record these elements to gain a comprehensive understanding of the areas that require protection. At this stage, the following inputs are required to attain the desired output: (1) The business requirement document is used to define the business goals and objectives for the system. This helps identify what needs to be protected and the prospective impact of a security breach on the system's business goals. (2) The functional requirement document describes the system's features and, for each feature, who uses it, how it operates, its workflow, data used or generated by the feature, and the external entities it deals with. This helps understand the system's attack surface. (3) The Information Security Policy summarizes how the organization manages its data, handles data distribution, and its disposal. That is to ensure that the threat model aligns with existing security policies and identifies areas where the system might need additional security measures. (4) The Security Standards and Guidelines establish best practices for the development of secure systems. (5) The Data Classification Documents: classifies data based on its sensitivity. This is done to prioritize threats based on the potential impact on data and identify areas where additional security controls might be needed for more sensitive data. Inputs, activities, and outputs of stage I are summarized in Figure 5.  
**Stage II: Define the Technical Scope of App Components.