# Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling--An Oil and Gas Sector Case Study
## 3 The Proposed Hybrid Threat Model
It is important to study the logical sequence of signals travelling from one module to another to locate weaknesses in certain activities plus uncover probable malicious alterations that can take place when the information is being manipulated. (4) The Security Standards and Guidelines establish best practices for the development of secure systems. During the decomposition stage, it can be used to compare the application's analysis and design against these standards to identify the areas where the data flow does not comply with secure design best practices. This helps pinpoint potential vulnerabilities that could be exploited by attackers. (5) Data Classification Documents: classify data based on its sensitivity. This is done to prioritize threats based on the potential impact on data and identify areas where additional security controls might be needed for more sensitive data. This helps you focus your efforts on the most critical data flows within the application. Inputs, activities, and outputs of stage III are summarized in Figure 7.  
**Stage IV: Analyze the Threats. ** In PASTA, the main output of its fourth stage is to understand what types of threats are affecting your defined attack surface. Simultaneously, the fourth STRIDE step is analyzing the threats in the DFD of each system component based on each system component and its functionality. The following inputs are required to achieve the required outputs at this stage. (1) Security Incidents Report: This report indicates an organization's or similar system's past security incidents. Analysis of these incidents helps reveal attack patterns as well as weaknesses that may be used for attacking your application. Anticipation and prevention of similar threats and acting against them in advance are possible through learning from previous occurrences. (2) Secure Incident Event Monitoring Reports (SIEM): reports from SIEM aggregate security event data from many different sources. An analyst could use this information to see some rogue behaviors within an application that may be pointers to actual or possible intrusion attempts. This will help catch and take care of malevolent actions quickly enough. (3) Application and Server Logs: application and server logs record system errors and access attempts. Suspicious user behavior or unauthorized access  
Figure 7: Inputs, Process, and Outputs of Stage III. attempts may be discovered from application logs analysis. Server logs might provide insights into system vulnerabilities that attackers could exploit. (4) Threat Intelligence Reports: Reports on threat intelligence give details on vulnerabilities, attack paths, and current threats. This kind of external information will enable you to identify prospective attack scenarios relevant to your application as well as help you grasp current attacks aimed at similar systems. This way, security is approached proactively. Inputs, activities, and outputs of stage IV are summarized in Figure 8.  
**Stage V: Vulnerability Analysis. ** This stage's aim is to identify the root cause of the issue. What are the application's issues, not only in terms of potential vulnerabilities found in the code base through static analysis but also in terms of the design itself? What issues with the trust model did the third stage identify? Several factors contribute to vulnerability, such as flaws or weaknesses found during manual security testing, architecture flaws or weaknesses derived from the data flow diagram, and various types of vulnerability scanners, among others. The following inputs are required to achieve the required outputs at this stage: (1) Library of Threat Trees: A pre-built library of threat trees helps with identifying various potential threats by using structured methods according to diverse attack categories. They help to guide the analysis work and ensure that there is a wide range of threats to think about for the cutting-edge nature of applications' functionality as well as how they handle information.