# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 2 Background and Related Work
### Industrial Control System (ICS)  
The oil and gas sector largely depends on Industrial Control Systems (ICS). Unfortunately, legacy ICS typically leaves systems exposed to attacks. Outdated protocols, limited documentation, and proprietary components make the security assessment of legacy ICS more difficult [5]. The ICS System as an abstract architecture consists of a minimum component, as shown in Figure 1:  
There could be thousands of transmitters in a factory sending signals to ICS (4 to 20 mA, 1 to 5 volts direct volt (DC), or resistance), and for digital, they would be 0 or logic 1. The Fieldbus Control System (FCS) receives analog signals from various transmitters. It will convert it to digital via the input module and then pass it to the Central Processing Unit (CPU) for processing. The CPU will compare the process-measured value (PV) with the value set by the operator (SV). If the two values don't match, ICS will send an output known as Manipulated Value (MV) to the field through output modules, allowing for the adjustment of the physical quantity, such as by operating a valve. Figure 2 shows an example of a simple control mechanism. The water in the tank is required to be controlled; the level transmitter will measure the water level and send a PV signal (4-20 mA) to the ICS. The FCS input module will receive this signal and pass it to the CPU after converting it to a digital signal. The operator station screen displays the PV data in a small window known as a faceplate. Figure 1: Basic configuration of DCS system. Figure 2: Example of simple control mechanism. On the faceplate, the operator can see the three parameters reading SV, PV, and MV. At the top, the faceplate shows the status of this control process (normal or alarm). If the faceplate mode is auto, the ICS system will operate the pump by sending an MV signal via the output module to fill the tank, continuing as long as the PV signal from the transmitter is less than SV. However, in manual mode, the operator can directly control the MV, disabling the SV pointer. Additionally, the faceplate displays the control process's status as either normal or alarm; if there is a problem that prevents PV from equalizing with SV, the alarm will sound. Next, Figure 3 shows a real ICS system for the oil & gas refinery, which will be used as a case study in Section 4. Unauthorized users or other malicious attacks could hack ICS, exposing important data and triggering a series of other major security issues. ICS should treat security issues with the same importance as safety issues. Nowadays, safety and security are analyzed separately when they should not be. This is because a security threat can lead to the same dangerous phenomenon as a safety incident. The differences and similarities between safety and security are studied. In general, safety is associated with accidental risks caused by component failures, human errors or any non-deliberate source of hazard, while security is related to deliberate risks originating from malicious attacks which can be accomplished physically or by cyber means. In addition, causes of accidents related to safety are internal and considered to be rare events with low frequency. Causes of security accidents can be internal or external (attacks via insider agents or outsiders) and are classified as common events [19]. The National Institute of Standards and Technology (NIST) is in the process of creating a cyber-security testbed for industrial control systems (ICS). This testbed aims to assess an ICS's performance with cybersecurity protections in line with current standards and  
Figure 3: Real ICS system Architecture. guidelines [20]. The standard ASTM F3286-17 (2017) also applies the NIST Cybersecurity Framework to maritime assets and critical infrastructure. The International Electrotechnical Commission (IEC) and the International Organization for Standardization (ISO) have globally developed and issued a number of cybersecurity-related standards.