# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## 5 Mapping a Case Study to the Taxonomy
### Harmonized Taxonomy Application Methodology
Due to the time duration involved, this is typically where security incidents occur or system design changes and modifications are made to allow for changes in the process requirements. Standards like IEC62443 might specify that periodic risk reviews are required to maintain security integrity. Thus, the two different scenarios (11) are the following:  
* Incident analysis;
* Periodic audit and review. The harmonized taxonomy caters to both these different scenarios but with a difference in application methodology. The first and arguably more serious scenario will occur due to a security incident. It was this scenario that was analyzed in the selected case study. The risk assessment (12) is conducted to determine the failures and to evaluate all the elements as shown in Figure 6. The analysis determines failures or gaps in the digital forensic processes or techniques and supporting technologies that allowed the incident to take place. An attempt is made to determine and classify the vulnerability (13) and the threat source (14) associated with the incident. As was performed during the design phase, gaps are identified in the supporting technology and digital forensic processes or techniques (15), and these elements are updated to mitigate the risk. The second scenario is more proactive and will be initiated in response to either a change in the process's operational requirements or as part of periodic auditing to comply with the implemented standard. The documented risk assessment, along with existing mitigation measures, will be evaluated (16) to determine whether the assumptions are still valid and whether the threats and vulnerabilities are still adequately addressed. If gaps are found, the required processes and mitigation measures (17) will be updated to address the risks associated with such gaps. Both scenarios mentioned can occur multiple times during the operational life of a CPS. Their occurrence will depend on whether the system is expected to remain operational or whether it has reached the end of its useful life (18). For the former, the scenarios as presented will be repeated until the latter case is reached. Once the CPS reaches the end of its operational life, it will be decommissioned (19). In this phase, the system must be disposed of in such a way that no confidential information can be leaked from, for example, application software or design configuration. It is crucial for the harmonized taxonomy to be the master reference for each step in the application methodology. This ensures that the taxonomy meets the desired criteria for being a part of a comprehensive and consistent security framework. The simplified methodology in Figure 14 addresses only incident response, as indicated by the highlighted steps (i.e., scenario 1). The entire harmonized taxonomy is, for easy reference, repeated as indicated by the gray steps. The occurrence of an incident implies that there was a failure or multiple failures (12) in either the internal or external processes or the supporting systems, as detailed in Figure 6. The primary aim of an incident investigation is to identify these failures or gaps and address them. In addition, there must either have been a vulnerability (13) in terms of access that allowed the incident to occur or someone or something initiated the incident (14) as a threat actor. Very important (although not applicable in the analyzed case study) is that the threat agent does not have to be malicious or the incident intentional. However, the security measures put in place must protect against the non-malicious, unintentional scenario as well, as that can be just as devastating as an adversary-driven incident [5]. It is important to understand how the elements in the methodology link to the elements in the taxonomy. Table 3 summarizes this link. The numbering references used refer to Figure 12 for the taxonomy and Figure 13 for the methodology.