Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios
Integration of the Internet of Things (IoT) in industrial settings necessitates robust cybersecurity measures to mitigate risks such as data leakage, vulnerability exploitation, and compromised information flows. Recent cyberattacks on critical industrial systems have highlighted the lack of threat...
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-10-01
|
| Series: | Journal of Cybersecurity and Privacy |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2624-800X/4/4/39 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1850049986802221056 |
|---|---|
| author | Sara Abbaspour Asadollah Shamoona Imtiaz Alireza Dehlaghi-Ghadim Mikael Sjödin Marjan Sirjani |
| author_facet | Sara Abbaspour Asadollah Shamoona Imtiaz Alireza Dehlaghi-Ghadim Mikael Sjödin Marjan Sirjani |
| author_sort | Sara Abbaspour Asadollah |
| collection | DOAJ |
| description | Integration of the Internet of Things (IoT) in industrial settings necessitates robust cybersecurity measures to mitigate risks such as data leakage, vulnerability exploitation, and compromised information flows. Recent cyberattacks on critical industrial systems have highlighted the lack of threat analysis in software development processes. While existing threat modeling frameworks such as STRIDE enumerate potential security threats, they often lack detailed mapping of the sequences of threats that adversaries might exploit to apply cyberattacks. Our study proposes an enhanced approach to systematic threat modeling and data flow-based attack scenario analysis for integrating cybersecurity measures early in the development lifecycle. We enhance the STRIDE framework by extending it to include attack scenarios as sequences of threats exploited by adversaries. This extension allows us to illustrate various attack scenarios and demonstrate how these insights can aid system designers in strengthening their defenses. Our methodology prioritizes vulnerabilities based on their recurrence across various attack scenarios, offering actionable insights for enhancing system security. A case study in the automotive industry illustrates the practical application of our proposed methodology, demonstrating significant improvements in system security through proactive threat modeling and analysis of attack impacts. The results of our study provide actionable insights to improve system design and mitigate vulnerabilities. |
| format | Article |
| id | doaj-art-c247166236c140fa863bbbb550899fd8 |
| institution | DOAJ |
| issn | 2624-800X |
| language | English |
| publishDate | 2024-10-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Journal of Cybersecurity and Privacy |
| spelling | doaj-art-c247166236c140fa863bbbb550899fd82025-08-20T02:53:34ZengMDPI AGJournal of Cybersecurity and Privacy2624-800X2024-10-014482385210.3390/jcp4040039Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack ScenariosSara Abbaspour Asadollah0Shamoona Imtiaz1Alireza Dehlaghi-Ghadim2Mikael Sjödin3Marjan Sirjani4School of Innovation, Design and Engineering, Mälardalen University, 721 23 Västerås, SwedenSchool of Innovation, Design and Engineering, Mälardalen University, 721 23 Västerås, SwedenRISE Research Institute of Sweden, 722 12 Västerås, SwedenSchool of Innovation, Design and Engineering, Mälardalen University, 721 23 Västerås, SwedenSchool of Innovation, Design and Engineering, Mälardalen University, 721 23 Västerås, SwedenIntegration of the Internet of Things (IoT) in industrial settings necessitates robust cybersecurity measures to mitigate risks such as data leakage, vulnerability exploitation, and compromised information flows. Recent cyberattacks on critical industrial systems have highlighted the lack of threat analysis in software development processes. While existing threat modeling frameworks such as STRIDE enumerate potential security threats, they often lack detailed mapping of the sequences of threats that adversaries might exploit to apply cyberattacks. Our study proposes an enhanced approach to systematic threat modeling and data flow-based attack scenario analysis for integrating cybersecurity measures early in the development lifecycle. We enhance the STRIDE framework by extending it to include attack scenarios as sequences of threats exploited by adversaries. This extension allows us to illustrate various attack scenarios and demonstrate how these insights can aid system designers in strengthening their defenses. Our methodology prioritizes vulnerabilities based on their recurrence across various attack scenarios, offering actionable insights for enhancing system security. A case study in the automotive industry illustrates the practical application of our proposed methodology, demonstrating significant improvements in system security through proactive threat modeling and analysis of attack impacts. The results of our study provide actionable insights to improve system design and mitigate vulnerabilities.https://www.mdpi.com/2624-800X/4/4/39cybersecuritycyberattackattack scenariothreat modelingSTRIDEattack impact analysis |
| spellingShingle | Sara Abbaspour Asadollah Shamoona Imtiaz Alireza Dehlaghi-Ghadim Mikael Sjödin Marjan Sirjani Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios Journal of Cybersecurity and Privacy cybersecurity cyberattack attack scenario threat modeling STRIDE attack impact analysis |
| title | Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios |
| title_full | Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios |
| title_fullStr | Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios |
| title_full_unstemmed | Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios |
| title_short | Enhancing Cybersecurity through Comprehensive Investigation of Data Flow-Based Attack Scenarios |
| title_sort | enhancing cybersecurity through comprehensive investigation of data flow based attack scenarios |
| topic | cybersecurity cyberattack attack scenario threat modeling STRIDE attack impact analysis |
| url | https://www.mdpi.com/2624-800X/4/4/39 |
| work_keys_str_mv | AT saraabbaspourasadollah enhancingcybersecuritythroughcomprehensiveinvestigationofdataflowbasedattackscenarios AT shamoonaimtiaz enhancingcybersecuritythroughcomprehensiveinvestigationofdataflowbasedattackscenarios AT alirezadehlaghighadim enhancingcybersecuritythroughcomprehensiveinvestigationofdataflowbasedattackscenarios AT mikaelsjodin enhancingcybersecuritythroughcomprehensiveinvestigationofdataflowbasedattackscenarios AT marjansirjani enhancingcybersecuritythroughcomprehensiveinvestigationofdataflowbasedattackscenarios |