Threat Analysis: Scenarios and Their Likelihoods

Abstract

To carry out a complete security risk assessment, three fields must be taken into consideration, namely threat, vulnerability and consequence. This paper is dedicated to threat analysis as a process to think ahead scenarios of possible future attacks. An approach for the description of potential threats and the quantification of their likelihoods is presented. The method is based on a common scenario developing process and extended by specifics of security risk assessment considering uncertainties regarding the occurring scenario. The approach is presented in the course of a generic assessment of physical security of a high voltage transmission substation. It is split into three steps. First, an asset is defined for which a space of possible scenarios is construed by structuring feasible threats according to morphological analysis. Therefore, threat descriptors and characteristics are determined for the example of the transmission substation. Second, the likelihoods of scenarios are assessed by judging the cross-impact between characteristics using a Bayesian network. Dependencies between descriptors are assumed. Marginal and conditional probabilities of the characteristics are estimated, respectively. In a final step, a comprehensive list of scenarios is generated by forming the Cartesian product of characteristics grouped by the descriptors. Scenario likelihoods are computed by the chain rule for Bayesian networks. The scenario list can then serve as a starting point for vulnerability and consequence analysis.