Title: A comparative framework for cyber threat modelling: case of healthcare and industrial control systems

Authors: Taofeek Mobolarinwa Balogun; Hayretdin Bahsi; Omer F. Keskin; Unal Tatar

Addresses: Centre for Digital Forensics and Cyber Security, Tallinn University of Technology, Akadeemia tee 15a 12618 Tallinn, Estonia ' Centre for Digital Forensics and Cyber Security, Tallinn University of Technology, Akadeemia tee 15a 12618 Tallinn, Estonia ' College of Emergency Preparedness, Homeland Security and Cybersecurity, University at Albany, State University of New York 1400 Washington Ave. Albany, NY 12222, USA ' College of Emergency Preparedness, Homeland Security and Cybersecurity, University at Albany, State University of New York 1400 Washington Ave. Albany, NY 12222, USA

Abstract: Cyberattacks target organisations and cause property loss, disruption of operation, and for healthcare facilities, even loss of life. With the advent of the internet of things (IoT) devices, the attack surface has extended significantly. Organisations need a cyber threat modelling approach to assess their network from the attackers' perspective to safeguard their assets better. In this study, a framework was developed to compare cyber threat modelling of various IoT networks by focusing on the capabilities of the threat actors in the light of various factors, such as accessibility, stealth, technical ability, and time. The developed framework is applied to two different networks: SCADA and healthcare IoT infrastructure for demonstration. The results suggest that it is possible to cause a physical impact in IoT-based healthcare systems by using less sophisticated cyberattacks.

Keywords: cyberattack; SCADA; internet of things; IoT; threat modelling; attack trees; attack sophistication; healthcare.

DOI: 10.1504/IJCIS.2023.133282

International Journal of Critical Infrastructures, 2023 Vol.19 No.5, pp.405 - 431

Received: 19 Jan 2021
Accepted: 13 Aug 2021
Published online: 11 Sep 2023 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article