A risk-level assessment system based on the STRIDE/DREAD model for digital data marketplaces

Zhang, Lu; Taal, A.; Cushing, Reginald; Laat, Cees de; Grosso, Paola

doi:10.1007/s10207-021-00566-3

Cited by 15 publications

(8 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The discoverability indicates the probability that a vulnerability can be discovered; the higher it is, the faster it can be discovered. DREAD has been used to evaluate attacks in various threat modeling or risk assessment studies [24,25].…”

Section: Common Vulnerability Scoring Systemmentioning

confidence: 99%

GENICS: A Framework for Generating Attack Scenarios for Cybersecurity Exercises on Industrial Control Systems

Song,

Jeon,

Kim

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

Due to the nature of the industrial control systems (ICS) environment, where process continuity is essential, intentionally initiating a cyberattack to check security controls can cause severe financial and human damage to the organization. Therefore, most organizations operating ICS environments check their level of security through simulated cybersecurity exercises. For these exercises to be effective, high-quality cyberattack scenarios that are likely to occur in the ICS environment must be assumed. Unfortunately, many organizations use limited attack scenarios targeting essential digital assets, leading to ineffective response preparedness. To derive high-quality scenarios, there is a need for relevant attack and vulnerability information, and standardized methods for creating and evaluating attack scenarios in the ICS context. To meet these challenges, we propose GENICS, an attack scenario generation framework for cybersecurity training in ICS. GENICS consists of five phases: threat analysis, attack information identification, modeling cyberattack scenarios, quantifying cyberattacks, and generating scenarios. The validity of GENICS was verified through a qualitative study and case studies on current attack scenario-generating methods. GENICS ensures a systematic approach to generate quantified, realistic attack scenarios, thereby significantly enhancing cybersecurity training in ICS environments.

show abstract

Section: Common Vulnerability Scoring Systemmentioning

confidence: 99%

GENICS: A Framework for Generating Attack Scenarios for Cybersecurity Exercises on Industrial Control Systems

Song,

Jeon,

Kim

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…While Open Threat Taxonomy employs a four-level hierarchy: threat categories, threat subcategories, threat types, and threat variants, NIST employs a three-level hierarchy: threat sources, threat events, and threat actors [15]. NIST categories relevant to healthcare include natural, human, and environmental threats [16]. Open Threat Taxonomy also has some healthcare-related categories, such as physical, environmental, and human threats.…”

Section: Ottmentioning

confidence: 99%

A Comparative Analysis of Cybersecurity Threat Taxonomies for Healthcare Organizations

Jaikanth,

Madisetti

2024

JSEA

View full text Add to dashboard Cite

Information technology is critical in coordinating patient records, smart devices, operations, and critical infrastructure in healthcare organizations, and their constantly changing digital environment, including suppliers, doctors, insurance providers, and regulatory agencies. This dependence on interdependent systems makes this sector vulnerable to various information technology risks. Such threats include common cybersecurity risks such as data breaches and malware attacks, unique problems occurring in healthcare settings such as unauthorized access to patient records, disruptions in services provided at medical facilities, and potential harm caused to patients due to the compromise of medical devices. The threat taxonomies, such as the Open Threat Taxonomy, NIST, or ENISA, are foundational frameworks for grasping and categorizing IT threats. However, these taxonomies were not specifically designed to deal with the complexities of the healthcare industry. The problem arises from the gap between these taxonomies' general nature and the industry-specific threats and vulnerabilities that affect healthcare organizations. As a result, many healthcare institutions fail to holistically address and eliminate the unique risks related to confidentiality, integrity, and availability of patients' data as well as critical systems used in healthcare. This paper aims to narrow this gap by carefully assessing these taxonomies to determine the framework best suited for addressing the threat environment in the healthcare sector.

show abstract

“…The STRIDE threat model can be used to classify threats into six categories -Spoofing, tampering, repudiation, information disclosure, denial of service or elevation of privilege (Abomhara, Gerdes & Køien, 2015). The DREAD threat model assigns numerical scores to identified threats and then translates theses scores to a qualitative risk level (Zhang et al, 2021). DREAD is short for:…”

Section: Threat Modellingmentioning

confidence: 99%

Towards a Critical Review of Cybersecurity Risks in Anti-Poaching Systems

Steyn

Blaauw

2023

iccws

View full text Add to dashboard Cite

Anti-poaching operations increasingly make use of a wide variety of technology for intelligence and communications. These technologies introduce cybersecurity risk, and they need to be secured to provide greater protection to the information and people involved in anti-poaching operations, ultimately protecting vulnerable animals better. A hypothetical network of anti-poaching technologies was simulated in Graphical Network Simulator 3 (GNS3), consisting of various field devices identified in the literature, and a main control room with relevant hardware devices. A virtual Kali Linux machine was connected to the network and played the role of a digital attacker or intruder. Several cyber-attacks were carried out, to show the risks inherent to such an interoperable and socio-technical network. These attacks included Man in the Middle (MitM) and Denial of Service (DoS) attacks. These attacks were then mitigated via system configurations. Further risks and threat considerations were identified in the literature. Using the STRIDE, DREAD and Attack Tree threat models, the risks to an anti-poaching network were classified and calculated. The most prevalent threats and the attacks performed in the simulation were all calculated to have a high risk level, posing a great threat to an unsecured network. The STRIDE classes of Denial of Service and Elevation of Privilege posed the most risk to the system, both having a calculated average risk score of 9 out of 10. Mitigations to general network threats and those identified in the simulation are mentioned. Additionally, authentication for such a system was investigated, as improper authentication practices were deemed a risk and provides a foothold for further risks in the network. Recommendations made, include the proper configuration of network devices, especially the router and switch, and the use of anti-virus, firewalls, and intrusion detection systems, as well as having an external audit performed annually. Multi-factor authentication, with a password/fingerprint combination, is recommended.

show abstract

A risk-level assessment system based on the STRIDE/DREAD model for digital data marketplaces

Cited by 15 publications

References 18 publications

GENICS: A Framework for Generating Attack Scenarios for Cybersecurity Exercises on Industrial Control Systems

GENICS: A Framework for Generating Attack Scenarios for Cybersecurity Exercises on Industrial Control Systems

A Comparative Analysis of Cybersecurity Threat Taxonomies for Healthcare Organizations

Towards a Critical Review of Cybersecurity Risks in Anti-Poaching Systems

Contact Info

Product

Resources

About