STRIDE-based Methodologies for Threat Modeling

of Industrial Control Systems: A Review

Olaf Saßnick, Thomas Rosenstatter, Christian Schäfer, Stefan Huber
Josef Ressel Centre for Intelligent and Secure Industrial Automation
2024 IEEE 7th International Conference on Industrial Cyber-Physical Systems (ICPS) | 979-8-3503-6301-2/24/$31.00 ©2024 IEEE | DOI: 10.1109/ICPS59941.2024.10639949

Salzburg University of Applied Sciences

Salzburg, Austria
{olaf.sassnick, thomas.rosenstatter, christian.schaefer, stefan.huber}@ fh-salzburg.ac.at

Abstract—Industrial Control Systems (ICS) and Operational developed by Microsoft as part of their Secure Software De-
Technology (OT) in general are facing significantly increasing velopment Lifecycle [5]. The STRIDE threat model comprises
numbers of cyber attacks. Hence, threat identification is of utmost six threat types: spoofing, tampering, repudiation, information
importance for their security architecture. The STRIDE method-
ology is well known for threat identification in the software exposure, denial of service, and elevation of privilege. Over
domain, yet in recent years it has also been applied in other the years STRIDE got extended and adapted but its usage
domains, such as Internet of Things, automotive or ICS. But OT always starts with the analysis of a certain model representing
domains are fundamentally different to IT by exhibiting unique the system, for instance Data Flow Diagrams (DFDs). Once
characteristics such as high reliability, strict safety requirements the threats for the assets in the system model are identified by
or unique physical attack risks. Threat assessment thus needs to
be adapted. This paper reviews STRIDE-based threat modeling means of STRIDE they may be further rated for prioritization
approaches in that respect and provides a first step towards and then mitigated by a variety of countermeasures.
the overarching goal of establishing a common STRIDE-based Although STRIDE was developed for software, it was later
methodology for threat modeling for ICS. also found to be applicable in other domains. In particular,
Index Terms—Stride, ICS, IIoT, Threat Modeling
STRIDE was also applied to Operational Technology (OT)
systems, including automotive, IoT and ICS. This happened
I. I NTRODUCTION
partly also due to extended connectivity and the increased
Historically, Industrial Control Systems (ICSs) used to form use of software in these systems. At the same time, however,
isolated networks that were often limited by a slow but reliable the physical aspect of the systems adds a new dimension to
bus system. The paradigm shift towards more intelligent threat modeling including functional safety. Hence, existing
sensors and actuators, however, allows new possibilities to approaches are being modified. For precisely these reasons,
control, monitor, manage and optimize an ICS. But these the extended use of STRIDE in OT and the significantly
opportunities also require the previously isolated networks different attack surface, we investigate the use of STRIDE.
to become open, to foster the so-called IT-OT convergence, This work summarizes in which domains STRIDE was used
and possibly be connected to the internet, becoming the and discusses various published extensions of STRIDE.
Industrial Internet of Things (IIoT). This is the turning point Our research focus is how STRIDE can be used in threat
in which cyber security has become essential to protect the modeling in ICSs, however we include also other OT areas
ICS and ultimately ensure its intended purpose, such as the with similar challenges in our initial search. We identify the
manufacturing of products or critical infrastructure operation. following as the main challenges for ICS in threat modeling:
Not only have standardization bodies like NIST identified
the need for security in ICS [1], but attack statistics from • Modeling of the physical attack surface is required (e.g.,
recent years also demonstrate this necessity. Among the prime the interaction with human operators)
threats that occurred between July 2021 and July 2022 were • Threat consequences can be physical and non-physical
ransomware attacks, malware, threats against data, and supply (e.g., functional safety)
chain attacks [2]. The industrial sector was even the prevalent • The lifecycle of devices need to be considered (e.g.,
target of ransomware attacks between May 2021 to June 2022 during maintenance or reconfiguration additional connec-
according to the ENISA Threat Landscape for ransomware tivity is present)
attacks report [3] with 27.8% out of all 623 incidents. These Contribution. In this paper we show how the threat model
numbers also indicate that the ICS may actually not even be STRIDE is being used in OT. STRIDE is of interest for its
the prime target, but only the means to attack their customers wide use in many industries. It has been used and adapted
or society. in several ways to accommodate the needs of a particular
Threat modeling is typically performed in the design phase domain. The aim is to (i) provide an overview how STRIDE
to identify the threats against the system under consideration, was modified to fit certain domains and how it was used in
rate them, and determine countermeasures. STRIDE [4], a those domains and (ii) to identify relevant challenges and their
widely-used methodology for threat analysis, was originally potential solutions when applying STRIDE in ICSs.

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
 II. BACKGROUND downtimes are avoided or reduced to a minimum. Moreover,
production lines will be reconfigured more often to provide
The RAMI 4.0 model [6] is the de facto model used to custom-made products resulting in an accelerated lifecycle.
describe Industry 4.0. This reference architecture describes in- Physical Threats in ICS are extending the attack surface
dustrial machinery in three dimensions. One axis represents the significantly. The large, complex and unique setup of each
hierarchy levels according to its functions, e.g., from product, production line enables malicious actors to attack the system
field device to connected world. The other axis describes the on various physical points, e.g., pretending to come from a
products lifecycle and value stream. The horizontal axis, the contracted company to perform service updates or infecting
layers dimension, decomposes the machine into its properties the computers of the maintenance company. Next to the ex-
ranging from asset, integration to functional and business. tended attack surface for entering the system, OT systems are
This reference model allows users to have a common way to also tightly connected to physical processes, like production.
discuss and design complex automation system also involving Attacks on such systems could cause a full production stop
many different actors and vendors. The model also highlights leading to an immense loss in revenue.
the far reaching potential of OT by not only considering the
automation systems isolated from the entire process. NIST A. Threat Modeling using STRIDE
also started to investigate cyber securtiy for OT systems and
published the NIST 800-82r3 [1], A Guide to Operational DFDs are most commonly used for threat analysis, they
Technology (OT), Security. This document emphasizes the describe the system comprising four types: process, data flow,
importance of OT security by highlighting that many OT-based data store, and external entity. DFDs also allow to easily model
systems are also belonging to critical infrastructure, e.g., food trust boundaries used to separate untrusted/less trusted envi-
and agriculture, healthcare, transport systems, and energy. The ronments from the trusted. Shostack [4] also highlights that
NIST guidelines also support users in establishing OT security DFDs are mostly ideal for threat modeling as problems/threats
in an organization through guidance in the various processes, typically follow the data flow. Once the model sufficiently
from setting up a cyber security program to defining a cyber describes the system, the practitioners can start the analysis
security architecture. using STRIDE.
OT security is different to IT security for many reasons, There are two ways to perform a STRIDE analysis; follow-
crucial ones in regard to threat modeling are detailed below: ing STRIDE-per-element or STRIDE-per-interaction. By using
Availability is of utmost importance as OT systems need to STRIDE-per-element experts analyze each component sepa-
be operating 24/7. A halt in production or of the system’s rately for security threats, whereas STRIDE-per-interaction,
function, e.g., waste water treatment, needs to be meticu- focuses on functions, processes and analyzes these interactions
lously planned. Sudden stops could lead to significant loss as whole. Initially, STRIDE-per-element was thought to be
in revenue for production systems or even have a serious simpler as it is easier understood by beginners. Yet, it is more
impact on society when considering critical infrastructure. OT difficult to understand the system by considering the elements
consists of real-time systems which require time guarantees one by one. STRIDE-per-interaction addresses this shortcom-
to operate, and interact with the physical world and with each ing by considering the interaction between two elements in
other. STRIDE already includes the requirement of availability the form of tuples <origin, destination, interaction> [4].
through the denial of service threat. We believe that availability In contrast to this, an empirical study by Tuma et al. [8]
and real-time requirements are also crucial to include in threat has shown that STRIDE-per-element still yielded in a higher
prioritization and risk assessment. completeness of identified threats.
Functional Safety needs to be guaranteed in ICS due to The next step, identifying mitigation techniques for each of
the close operation of heavy machinery to operators. In the identified threats, is more open and may require additional
other words, the risk of such hazardous situations has to support for finding suitable mitigation techniques. First, a sys-
be minimized. Therefore, functional safety standards, such tematic risk assessment can help in focusing on the threats that
as ISO 13849 [7], need to be followed and certified. This matter most. Second, a taxonomy or structure of mitigation
introduces additional challenges, security mechanisms may techniques may help to select the best suitable technique. For
interfere with safety or may even require a re-certification. instance, NIST SP 800-82r3 [1] provides further guidance for
Other domains have similar challenges, like the automotive risk assessment and mitigation techniques.
domain.
III. M ETHODOLOGY
The Lifecycle of an ICS starts with the development,
continues with maintenance and operation and ends with We conducted our research by following the reviewing
decommissioning. The setup comprising Programmable Logic process proposed by Snyder [9]. The review is motivated by
Controllers (PLCs), actuators and sensors from various ven- the need to strengthen the awareness of security practices using
dors, however, increases the complexity for modeling and STRIDE in ICS, desired by industry and academia. In our
planning the security lifecycle. Security updates are examples search conducted in October 2023, no other comparable work
for maintenance, they require planning and understanding was found in the IEEE, ACM, Elsevier and Google Scholar
of each component and how they interact, such that costly databases.

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
 In this review, we first define the research questions our Distribution of publications per year
review should cover and then we perform a semi-exhaustive
search to find relevant publications and manually screen
them based on defined inclusion/exclusion criteria (see Sec- 8

Number of Publications
tion III-B). The analysis of the identified relevant publications
is shown in Section IV. 6

A. Research Questions 4
We have identified two main research questions to which
this review should contribute. Overall, we are interested how 2
STRIDE is used in the OT domain such that we can identify
approaches that are also suitable specifically for ICS.
0
• RQ.1 How is STRIDE used in the overall threat modeling 2016 2017 2018 2019 2020 2021 2022 2023
process in the OT domain? Year
• RQ.2 How is STRIDE modified to address ICS specific Figure 1. Number of publications per year (n = 39.)
aspects?
RQ.1 explores the overall threat modeling process incor- Specific domain distribution
porating the STRIDE methodology, and domain. In RQ.2
the focus is shifted to the specific requirements in ICS envi- Generic CPS
ronments, such as functional safety, lifecycle considerations, Railway
and physical threats. We examine whether these ICS-specific Agriculture
aspects were taken into account and if such considerations led Healthcare

Domain
to modifications of the STRIDE approach. IoT
Smart Grid
B. Search Strategy
ICS
The results are collected from a selection of publication IIoT
databases, namely, ACM Digital Library, IEEE Xplore, and Automotive
Elsevier’s ScienceDirect. For each database a search string
was formulated to find any publication that has Threat 0 2 4 6 8 10
Model or Threat Analysis in their title, abstract or Number of publications
as keywords. Additionally the term STRIDE had to appear Figure 2. Number of publications per domain (n = 39).
at least once in the full-text. To narrow down our results
to the relevant domains, the search was further refined by
additionally demanding one of the following terms to be ScienceDirect. Figure 1 provides an overview of the year when
present in the title, abstract or as keywords (singular or plu- the research publications were published. The publication year
ral): cyber physical system, CPS, Industrial also shows how this field evolved over the past years. For
IoT, IIoT, Industrial Control System, ICS, instance, 24 of the papers were published from 2021 onwards
OT, IoT or automotive. The queries in all three databases and only 4 were published before 2018. It also has to be taken
resulted in an initial total of 140 publications1 . into account that the year 2023 has not ended as the databases
A two-stage manual screening was performed to identify were queried on 21. September 2023.
relevant literature. In the first stage, publications were ex- IV. R ESULTS
cluded based on title and abstract. The second step included
a full-text screening of the remaining papers. The inclusion In this section we first present in Table I an overview of
criteria were that the publication must use the STRIDE model the identified publications relevant to OT (see Section III).
or an extension, moreover, the domain had to be within OT It shows the year of publication, the venue (7 journals, 28
or generic such that it could potentially be applied in ICS. conference and 4 workshop publications), the domain, and
The full process was performed by two of the authors in information about whether a STRIDE extension was proposed.
order to circumvent a potential bias in the selection process. Further, we include whether a DFD was used and whether
Furthermore, research centering around smart home was ex- a use case was included. Figure 2 presents a comprehensive
cluded, as well as publications focusing solely on network overview of the different domains. Research in IIoT looked
communication and software systems. at industrial systems in a broader sense, e.g., smart manufac-
Ultimately, this resulted in a total of 39 publications from turing, and industry to cloud solutions. In contrast, literature
journals and conferences of which 29 were found in IEEE identified as ICS focused on specific industrial systems, for
Xplore, 7 in the ACM Digital Library, and 3 in Elsevier’s instance waste water treatment or production lines.
Section IV-A addresses RQ.1 by analyzing the threat mod-
1 Search conducted on 21st September 2023 eling processes. RQ.2 is examined in Section IV-B and IV-C.

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
 Table I
OVERVIEW OF REVIEWED PUBLICATIONS USING STRIDE WITHIN THE OT DOMAIN .

used
DFD Use case
Publisher Year Authors Ref. Venue STRIDE Domain
used included
extension
√ √
ACM 2016 Islam et al. [10] Work. √ Automotive
2018 Monteuuis et al. [11] Work. Automotive
2019 Ankele et al. [12] Conf. √ IIoT
2020 Rak et al. [13] Conf. √ √ Smart Grid
2021 Li et al. [14] Conf. √ ICS
2022 Srikumar et al. [15] Conf. √ √ IoT
2023 Da Silva et al. [16] Conf. √ ICS
Elsevier 2022 Sukiasyan et al. [17] Jour. √ IIoT
2023 Akkad et al. [18] Jour. √ √ Smart Grid
Khalil et al. [19] Jour. √ √ Smart Grid
IEEE 2017 Khan et al. [20] Conf. Smart Grid
Ramis Ferrer et al. [21] Conf. √ ICS
Sandor and Sebestyn-Pal [22] Conf. √ √ IoT
2018 Cagnazzo et al. [23] Work. √ √ Healthcare
Furtado et al. [24] Conf. Automotive
Hagan et al. [25] Conf. √ √ ICS
Park et al. [26] Conf. √ IoT
2019 Leander et al. [27] Conf. √ √ IIoT
Tseng et al. [28] Jour. √ Healthcare
2020 Aigner and Khelil [29] Conf. √ √ Automotive
Danielis et al. [30] Conf. √ √ IoT
2021 Asif et al. [31] Conf. √ √ Agriculture
Cilleruelo et al. [32] Work. √ √ Healthcare
Flå et al. [33] Conf. √ √ Smart Grid
Girdhar et al. [34] Conf. √ Automotive
Hollerer et al. [30] Conf. √ OT/IIoT
Ruf et al. [35] Conf. √ IIoT
Strandberg et al. [36] Conf. √ Automotive
Zhang et al. [37] Jour. √ √ Automotive
2022 AbuEmera et al. [38] Conf. √ √ IIoT
Girdhar et al. [39] Jour. √ √ √ Automotive
Hollerer et al. [40] Conf. √ √ ICS
Kumar Kuri et al. [41] Conf. √ Automotive
Schmittner et al. [42] Conf. √ IIoT
Sheikh and Singh [43] Conf. CPS
Sindhwad and Kazi [44] Conf. ICS
2023 Castiglione and Lupu [45] Jour. √ √ Railway
Font et al. [46] Conf. √ √ IoT
Siddiqui et al. [47] Conf. Automotive

In Section IV-B an overview is given on modifications of identification at most times. In cases the authors did not further
STRIDE, noting that only four out of 39 publications utilized specify taking the step of creating a DFD nor mention DFDs,
or suggested modifications of STRIDE. Section IV-C details we also assumed that they performed STRIDE-per-element
studies addressing OT- and more specifically ICS-relevant directly on the system model. It may not be representative,
aspects. but overall, STRIDE-per-element was more often used, likely
also because it is easier to understand for beginners and has
A. Threat Modeling using STRIDE shown a higher level of completeness [8].
DFDs were the most common model used for threat Concerning the further modeling process, how the threats
modeling. More than half (23 of 39) of the reviewed publi- are addressed or mitigated, we have not found a common
cations were using DFDs. This observation also covers with methodology. Some followed the DREAD risk assessment
Shostack [4] saying that they are in most cases ideal for threat model proposed by Microsoft. However, the Microsoft SDL
modeling. The other models were often system models of the team stopped recommending it since 2010, as they found that
architecture in various abstractions, like describing the network DREAD is fairly subjective leading to unusual results [4].
components and how they are connected. Notably, a few pub- Other solutions, like Hagan et al. [25] propose using a set
lications used the STRIDE threat model to identify common of access control policies instead of following guidelines
threats, for example, by analyzing published attacks [36] or to achieve the security requirements. Monteuuis et al. [11]
by using a threat analysis tool such as ThreatGet [42]. suggest in their risk analysis method SARA the use of attack
Comparing the specific STRIDE approaches utilized, we trees to compute the risk ot the identified threats.
also observed that STRIDE-per-element was used for threat Most publications focused on their methodology and how

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
to integrate it with other methods like previously explained. This results in an attack difficulty score, which is mapped
Exceptions are Da Silva et al. [16] and Flå et al. [33] who to four security levels and is used to define system zones
also developed an integration to existing software tool, i.e., a and conduits. The safety modeling results are used to reveal
template for the Microsoft Threat Modeling Tool (MTMT) for conflicts between safety and security, and in the final modeling
ICS respectively smart grid systems. step, the goal is to find solutions that satisfy both safety and
security requirements.
B. Adaptations of STRIDE Later, Hollerer et al. [40] compare STRIDE-LM and
Each of the six letters of the acronym STRIDE represents a Failure-Attack-CounTermeasure (FACT) graphs [51] to high-
threat category. By systematically and exhaustively consider- light their differences. In an initial step the DFD of the
ing each of the six categories for each element or interaction system is created. In second step threats are identified with
in the system model, we reduce the chance of overlooking STRIDE by using MTMT. To include the safety modeling,
threats. Hence, an obvious way to adapt STRIDE is to include for each object additional safety attributes are defined. The
further threat categories. FACT graph represents a combination of a fault tree analysis
Monteuuis et al. [11] introduce STRIDELC. The motivation and attack trees from the security domain. First a fault tree
is to consider privacy issues and risks arising by processing is built, leading to possible causes for a fault. Consequently,
incorrect data from trusted data sources. The added letters rep- the possible causes are connected to attack trees. The authors
resent the additional threat categories confusion and linkability. note a high complexity for the resulting graphs and chose to
Confusion describes the processing of authentic information, split it into smaller layers.
yet with incorrect content not reflecting ground truth. Incorrect Physical Threats. Many publications, like [16], [20], [23],
data from a valid data source is being generated. Linkability [27], do not consider physical threats, reasoning that the
is used describes public accessible data that can be used to physical part of their system is not susceptible to cyber attacks
de-anonymize the owner of the system. or clearly state that it is beyond the carried out work.
Hollerer et al. [40] use STRIDE-LM, which was introduced Others, like Khalil et al. [19], partially model physical
by Muckin and Fitch at the Lockheed Martin Corporation [48]. attacks. Whenever a component is in an unsafe surrounding
LM stand for Lateral Movement, describing the expanding without protection, they consider accessible hardware inter-
control over the target network beyond the initial point of faces, however disregard any kind of manipulation of the
compromise. However, this seems to form rather a threat device sensing capabilities. They further note, that for the
consequence. DFD creation process, no rules regarding physical system
Srikumar et al. [15] propose STRIPED, where the letter P is components were found, and therefore opted to include them,
added specifically to address physical attacks. The category is whenever it aided the overall system understanding. To make
further divided into four sub-groups, namely device identity, them distinguishable, they chose visually different connection
device integrity, device lifecycle and device communication types (analog/digital) and introduced the notion for physical
attacks. The main motivation is to raise the awareness for processes.
present physical access threats. In a similar fashion Schmittner et al. [42] add rules to a
threat modeling tool, requiring access control for all kind of
C. ICS Aspects physical system management interfaces (e.g. HMI), otherwise
In the following, we highlight selected publications that listing an unauthorized physical access threat.
specifically addressed ICS-specific aspects we described in Casola et al. [52] add to the picture, that physical depen-
Section II in order to contribute to RQ.2. dencies or characteristics might have an impact on relevant
Safety. While more studies include safety considerations in cyber threats, like a battery-powered device can be drained by
the automotive domain, like [10], [11], [36], [39], a few also increasing its power consumption, resulting in a DoS, which
have done so in different domains and are therefor discussed is not possible for an AC-powered device. Next to a dedicated
more in the following. ICS template for the Microsoft Threat Modeling Tool, they
Castiglione and Lupu [45] propose a methodology that integrate Common Vulnerabilities and Exposures (CVEs) to
combines a System Theoretic Process Analysis (STPA) with MTMT and map them to STRIDE.
STRIDE to identify threats that can lead to accidents and In the automotive domain, Kuri et al. [41] consider all kinds
hazards for a communication based train control system. of physical threats regarding the sensing devices of modern
By merging the results of the safety analysis with STRIDE connected vehicles and map them to the STRIDE categories.
threat modeling, they identify a set of vulnerabilities which For example by clipping onto the sensor wires, arbitrary
ultimately can result in a safety critical attack. input data can be created. The threat categories elevation of
Hollerer et al. [30] introduce a parallel approach, perform- privilege, spoofing and denial of service are assigned to the
ing a HAZOP [49] analysis for safety threats and STRIDE- physical threats in their use case.
LM for security threats. Safety threats are evaluated based on Finally, as previously mentioned in Section IV-B, Srikumar
the safety integrity levels introduced in IEC 61508. Security et al. [15] proposed STRIPED. In the included use case, an
threats are assessed using the Common Vulnerability Scoring aircraft inspection system is studied and 27 different physical
System (CVSS) and attacker modeling via Mitre Att&ck [50]. threats are identified. While causing additional awareness, the

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
category added to STRIDE for physical threats may be not usability of security mitigations. Their motivation has two
required, as demonstrated by [41]. For instance, the sub- aspects. Firstly, security measures should be efficiently im-
category of device identity attacks (e.g., sensor spoofing, plementable within a production environment, minimizing
hardware spoofing) can also be considered as spoofing in resource wastage. Secondly, security measures are naturally
general and device communication channel attacks fall into more likely to be followed, when they are designed to be user-
the information disclosure category. friendly. A relatable example, mandating long auto-generated
In summary, when including physical threats, a sensible passwords results in handwritten sticky-notes, because they are
approach seems to involve performing the STRIDE method hard to remember.
twice, considering both roles of the system separately, from a Future. The vision of highly-flexible smart manufacturing in
cyber perspective and a physical perspective. contrast to the fast changing threat landscape and the efforts
Lifecycle. Most of the studied publications omit the modeling towards security-by-design indicate that threat modeling needs
of a lifecycle. It is mainly included in the automotive domain. to result in a continuous process in the long run. It needs to
For instance Islam et al. [10] map the different ISO 26262 become an integral part of a security-by-design architecture. In
lifecycle phases concept, product development and operational most of the reviewed publications, the threat modeling process
to adequate security measures. When modeling threats for was manually performed, which requires expert knowledge,
ICSs with brownfield installations, the product concept and involves manual decisions and substantial effort. Moreover,
development phases may not be of greatat regrelevance. In the lifecycle was mostly omitted.
that regard, Leander et al. [27] considered multiple scenarios There are endeavors to automate certain aspects (e.g., [53]),
reflecting different phases of the lifecycle. In one of their however for true continuity at manageable cost and at a flexible
scenarios a pump device in a flow control loop needs to be scale, a complete automation of the threat modeling process
replaced due to some malfunction. To manage the scenario, seems desirable. To achieve this, the entire threat modeling
lifecycle entry and exit actions respectively for the old and process needs to be more systematic and requiring less of
new device are defined. expert knowledge. For instance, in [54] the security description
of a full plant is formulated with AutomationML, which is
D. Challenges and Future Research Directions generated from the existing artifacts, created during the design
While the number of publications on threat modeling and engineering phase. Adding the vision of threat modeling
processes utilizing STRIDE is increasing (Figure 1), open being continuous, it could be adapted such that each device
questions and challenges remain. Based on the studied publica- independently provides meta-data describing itself, contribut-
tions (Table I), the following challenges have been identified: ing to a complete picture regarding the security of the plant.
Modeling of physical components. No standardized represen- Consequently, a DFD can be auto-generated based on the
tations for physical components exist in a DFD. A common interconnectedness and the provided meta-data of each device.
standard, which is widely known and accepted, is missing.
Two studies [16], [33] contribute towards this goal by devel- V. R ELATED W ORK
oping templates for MTMT. Notably, Khalil et al. [19] address Other works mainly focus on threat modeling concepts in
this issue by using different notions for software-related and general and how they are used, or perform threat modeling
physical processes. on a specific use case, however, to the best of our knowledge,
Level of detail. Current publications derive DFDs based on we found no comparable work that investigates thoroughly the
expert knowledge without a systematic approach to determine use of STRIDE in the OT domain.
relevant security processes and entities. In such cases, the level Lohmann et al. [55] provide a systematic literature review
of detail may vary, which can lead to too simplified DFDs, on threat modeling concepts in general and also answer ques-
overlooking security-relevant information, or overly complex tions about the phases addressed according to the ISO 27005
DFDs, which causes increased workload for subsequent pro- risk management process. To find a general overview of the
cess steps. landscape within computer science, the authors in [55] only
Scalability. Modeling systems with numerous entities in a include journal publications with at least two citations. In our
single DFD becomes impractical. Questions arise regarding work, on the other hand, we want to explore a quite narrow
how to partition a DFD without losing security-relevant in- area (OT domain), hence, we did not include such limitations,
formation and how to handle entities that are similar but not to not overlook any relevant publication. Benyahya et al. [56]
identical. While tools like MTMT automate the application of review threat analysis and risk assessment methodologies for
the STRIDE methodology, studies reveal that this automated vehicles. They evaluate them with focus on highly connected
approach easily generates a significant number of threats (for and automated vehicles.
example, 879 in case of [40]), making manual processing af-
terwards cumbersome. Thus additional efforts need be directed VI. C ONCLUSION
towards reducing the amount of work for subsequent stages. In this study, we focused on the application of STRIDE
Usability. In the studied publications, the aspect of usability when performing threat modeling of OT systems. The aim was
in the ICS domain was only investigated by Li et al. [14]. to get an overview of the current state of the art and identify
More specifically, they propose to additionally evaluate the open challenges in the field of threat modeling for ICS. As

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
other OT sub-domains face similar challenges, we consider [11] J.-P. Monteuuis, A. Boudguiga, J. Zhang, H. Labiod, A. Servel,
all publications in the OT domain. and P. Urien, “SARA: Security automotive risk analysis method,”
in Proceedings of the 4th ACM Workshop on Cyber-Physical System
We defined research questions concerning the use of Security, Incheon Republic of Korea: ACM, May 2018, pp. 3–14.
STRIDE in the OT domain. Most publications begin the DOI : 10.1145/3198458.3198465.
threat modeling process by creating a DFD and subsequently [12] R. Ankele, S. Marksteiner, K. Nahrgang, and H. Vallant, “Require-
ments and recommendations for IoT/IIoT models to automate security
performing STRIDE-per-element. For threat prioritization, var- assurance through threat modelling, security analysis and penetration
ious methods are applied, including DREAD, attack trees and testing,” in Proceedings of the 14th International Conference on Avail-
CVSS. Overall, the automotive domain was the most dominant ability, Reliability and Security, Canterbury CA United Kingdom:
ACM, Aug. 2019. DOI: 10.1145/3339252.3341482.
with 10 publications closely followed by IIoT and ICS with [13] G. Salzillo, M. Rak, and F. Moretta, “Threat Modeling based Pen-
seven respectively six publications. The review also showed etration Testing: The Open Energy Monitor Case study,” in 13th
that working with STRIDE in the OT domain has significantly International Conference on Security of Information and Networks,
Merkez Turkey: ACM, Nov. 2020. DOI: 10.1145/3433174.3433181.
increased in the recent years. [14] K. Li, A. Rashid, and A. Roudaut, “Vision: Security-usability threat
To draw conclusions regarding threat modeling for ICS, modeling for industrial control systems,” in Proceedings of the 2021
specific aspects like physical threats, lifecycle, and safety were European Symposium on Usable Security, Karlsruhe Germany: ACM,
Oct. 2021, pp. 83–88. DOI: 10.1145/3481357.3481527.
additionally studied across all publications. While a few works [15] K. Srikumar, K. Kashish, K. Eggers, N. E. Dı́az Ferreyra, J. Koch,
address the integration of safety and security for ICS directly T. Schüppstuhl, and R. Scandariato, “STRIPED: A threat analysis
(e.g., [30], [40], [45]), a systematic modeling approach for method for IoT systems,” in Proceedings of the 17th International
Conference on Availability, Reliability and Security, Vienna Austria:
the lifecycle in STRIDE-based approaches was not found. ACM, Aug. 2022. DOI: 10.1145/3538969.3538970.
Most reviewed works did not use an extension of STRIDE [16] M. Da Silva, M. Puys, P.-H. Thevenon, S. Mocanu, and N. Nkawa,
nor proposed a modification, only four out of the final set of “Automated ICS template for STRIDE Microsoft threat modeling
tool,” in Proceedings of the 18th International Conference on Avail-
39 publications were using an extended STRIDE threat model. ability, Reliability and Security, Benevento Italy: ACM, Aug. 2023.
Based on the results, five challenges that need particular DOI : 10.1145/3600160.3605068.
attention were identified; namely the modeling of physical [17] A. Sukiasyan, H. Badikyan, T. Pedrosa, and P. Leitao, “Secure data
exchange in industrial Internet of Things,” Neurocomputing, vol. 484,
components, the level of detail used for the analysis, scala- pp. 183–195, May 2022. DOI: 10.1016/j.neucom.2021.07.101.
bility, modeling of the lifecycle, and the usability of security [18] A. Akkad, G. Wills, and A. Rezazadeh, “An information security
mitigations in ICS. model for an IoT-enabled smart grid in the Saudi energy sector,”
Computers and Electrical Engineering, vol. 105, p. 108 491, Jan.
For the future, given the increasing frequency of cyber 2023. DOI: 10.1016/j.compeleceng.2022.108491.
attacks on ICS and considering the simultaneous ongoing [19] S. M. Khalil, H. Bahsi, H. O. Dola, T. Korõtko, K. McLaughlin, and
initiatives for a highly-flexible smart manufacturing, the threat- V. Kotkas, “Threat modeling of cyber-physical system - a case study
of a microgrid system,” Computers & Security, vol. 124, p. 102 950,
modeling processes need to become less time-consuming, Jan. 2023. DOI: 10.1016/j.cose.2022.102950.
consequently moving towards a higher level of automation. [20] R. Khan, K. McLaughlin, D. Laverty, and S. Sezer, “STRIDE-
based threat modeling for cyber-physical systems,” in 2017 IEEE
PES Innovative Smart Grid Technologies Conference Europe (ISGT-
R EFERENCES Europe), Torino: IEEE, Sep. 2017. DOI: 10.1109/ISGTEurope.2017.
[1] K. Stouffer, M. Pease, C. Tang, T. Zimmerman, V. Pilitteri, S. Light- 8260283.
man, A. Hahn, S. Sravia, A. Sherule, and M. Thompson, “Guide to [21] B. Ramis Ferrer, S. O. Afolaranmi, and J. L. M. Lastra, “Principles
operational technology (OT) security,” National Institute of Standards and risk assessment of managing distributed ontologies hosted by
and Technology, Sep. 2023. DOI: 10.6028/NIST.SP.800-82r3. embedded devices for controlling industrial systems,” in IECON 2017
[2] ENISA threat landscape 2022: July 2021 to July 2022, eng. Heraklion: - 43rd Annual Conference of the IEEE Industrial Electronics Society,
ENISA, 2022, OCLC: 1370608603. Beijing: IEEE, Oct. 2017, pp. 3498–3505. DOI: 10 . 1109 / IECON .
[3] ENISA threat landscape for ransomware attacks, eng. Heraklion: 2017.8216592.
ENISA, 2022, OCLC: 1347439621. [22] H. Sandor and G. Sebestyen-Pal, “Optimal security design in the
[4] A. Shostack, Threat modeling: Designing for security. John Wiley & Internet of Things,” in 2017 5th International Symposium on Digital
Sons, 2014. Forensic and Security (ISDFS), Tirgu Mures, Romania: IEEE, Apr.
[5] M. Howard and S. Lipner, The security development lifecycle. USA: 2017. DOI: 10.1109/ISDFS.2017.7916496.
Microsoft Press, 2006. [23] M. Cagnazzo, M. Hertlein, T. Holz, and N. Pohlmann, “Threat mod-
[6] M. Hankel and B. Hankel. (2015). The reference architectural model eling for mobile health systems,” in 2018 IEEE Wireless Communica-
industrie 4.0 (RAMI 4.0). Accessed: 2022-09-26, [Online]. Available: tions and Networking Conference Workshops (WCNCW), Barcelona:
https : / / www. zvei . org / en / press - media / publications / the - reference - IEEE, Apr. 2018, pp. 314–319. DOI: 10 . 1109 / WCNCW . 2018 .
architectural-model-industrie-40-rami-40. 8369033.
[7] International Organization for Standardization (ISO), “ISO 13849- [24] M. D. Furtado, R. D. Mushrall, and H. Liu, “Threat Analysis of the
1:2023 – Safety of machinery — Safety-related parts of control Security Credential Management System for Vehicular Communica-
systems — Part 1: General principles for design,” Standard, 2023. tions,” in 2018 IEEE International Symposium on Technologies for
[8] K. Tuma and R. Scandariato, “Two architectural threat analysis tech- Homeland Security (HST), Woburn, MA, USA: IEEE, Oct. 2018. DOI:
niques compared,” in Software Architecture: 12th European Confer- 10.1109/THS.2018.8574206.
ence on Software Architecture, ECSA 2018, Madrid, Spain, September [25] M. Hagan, F. Siddiqui, S. Sezer, B. Kang, and K. McLaughlin,
24–28, 2018, Proceedings 12, Springer, 2018, pp. 347–363. “Enforcing policy-based security models for embedded socs within
[9] H. Snyder, “Literature review as a research methodology: An the internet of things,” in 2018 IEEE Conference on Dependable and
overview and guidelines,” en, Journal of Business Research, vol. 104, Secure Computing (DSC), Kaohsiung, Taiwan: IEEE, Dec. 2018. DOI:
pp. 333–339, Nov. 2019. DOI: 10.1016/j.jbusres.2019.07.039. 10.1109/DESEC.2018.8625140.
[10] M. M. Islam, A. Lautenbach, C. Sandberg, and T. Olovsson, “A [26] W. Park, D. Choi, and K. Lee, “Threat analysis of Wi-Fi connected
risk assessment framework for automotive embedded systems,” in dashboard camera,” in 2018 International Conference on Platform
Proceedings of the 2nd ACM International Workshop on Cyber- Technology and Service (PlatCon), Jeju: IEEE, Jan. 2018. DOI: 10.
Physical System Security, Xi’an China: ACM, May 2016, pp. 3–14. 1109/PlatCon.2018.8472768.
DOI : 10.1145/2899015.2899018.

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.
[27] B. Leander, A. Causevic, and H. Hansson, “Cybersecurity challenges networks,” in 2022 IEEE 95th Vehicular Technology Conference:
in large industrial IoT systems,” in 2019 24th IEEE International Con- (VTC2022-Spring), Helsinki, Finland: IEEE, Jun. 2022. DOI: 10.1109/
ference on Emerging Technologies and Factory Automation (ETFA), VTC2022-Spring54318.2022.9860359.
Zaragoza, Spain: IEEE, Sep. 2019, pp. 1035–1042. DOI: 10 . 1109 / [42] C. Schmittner, A. M. Shaaban, and G. Macher, “ThreatGet: Ensuring
ETFA.2019.8869162. the Implementation of Defense-in-Depth Strategy for IIoT Based on
[28] T. W. Tseng, C. T. Wu, and F. Lai, “Threat analysis for wearable IEC 62443,” in 2022 IEEE 5th International Conference on Industrial
health devices and environment monitoring internet of things integra- Cyber-Physical Systems (ICPS), Coventry, United Kingdom: IEEE,
tion system,” IEEE Access, vol. 7, pp. 144 983–144 994, 2019. DOI: May 2022. DOI: 10.1109/ICPS51978.2022.9816864.
10.1109/ACCESS.2019.2946081. [43] Z. A. Sheikh and Y. Singh, “A Hybrid Threat Assessment Model for
[29] A. Aigner and A. Khelil, “A security qualification matrix to efficiently Security of Cyber Physical Systems,” in 2022 Seventh International
measure security in cyber-physical systems,” in 2020 32nd Interna- Conference on Parallel, Distributed and Grid Computing (PDGC),
tional Conference on Microelectronics (ICM), Aqaba, Jordan: IEEE, Solan, Himachal Pradesh, India: IEEE, Nov. 2022, pp. 582–587. DOI:
Dec. 2020. DOI: 10.1109/ICM50269.2020.9331797. 10.1109/PDGC56933.2022.10053332.
[30] S. Hollerer, W. Kastner, and T. Sauter, “Towards a threat modeling [44] P. Sindhwad and F. Kazi, “Exploiting Control Device Vulnerabilities:
approach addressing security and safety in OT environments,” in Attacking Cyber-Physical Water System,” in 2022 32nd Conference
2021 17th IEEE International Conference on Factory Communication of Open Innovations Association (FRUCT), Tampere, Finland: IEEE,
Systems (WFCS), Linz, Austria: IEEE, Jun. 2021, pp. 37–40. DOI: Nov. 2022, pp. 270–279. DOI: 10.23919/FRUCT56874.2022.9953826.
10.1109/WFCS46889.2021.9483591. [45] L. M. Castiglione and E. C. Lupu, “Which Attacks Lead to Haz-
[31] M. R. A. Asif, K. F. Hasan, M. Z. Islam, and R. Khondoker, ards? Combining Safety and Security Analysis for Cyber-Physical
“STRIDE-based cyber security threat modeling for IoT-enabled pre- Systems,” IEEE Transactions on Dependable and Secure Computing,
cision agriculture systems,” in 2021 3rd International Conference on 2023. DOI: 10.1109/TDSC.2023.3309778.
Sustainable Technologies for Industry 4.0 (STI), Dhaka, Bangladesh: [46] J. A. Font, J. Jarauta, R. Gesteira, R. Palacios, and G. López, “Threat
IEEE, Dec. 2021. DOI: 10.1109/STI53101.2021.9732597. models for vulnerability analysis of IoT devices for Manipulation of
[32] C. Cilleruelo, J. Junquera-Sanchez, L. de-Marcos, N. Logghe, and Demand attacks,” in 2023 JNIC Cybersecurity Conference (JNIC),
J.-J. Martinez-Herraiz, “Security and privacy issues of data-over- Vigo, Spain: IEEE, Jun. 2023. DOI: 10 . 23919 / JNIC58574 . 2023 .
sound technologies used in IoT healthcare devices,” in 2021 IEEE 10205781.
Globecom Workshops (GC Wkshps), Madrid, Spain: IEEE, Dec. 2021. [47] F. Siddiqui, R. Khan, S. Y. Tasdemir, H. Hui, B. Sonigara, S.
DOI : 10.1109/GCWkshps52748.2021.9682007. Sezer, and K. McLaughlin, “Cybersecurity engineering: Bridging the
[33] L. H. Flå, R. Borgaonkar, I. A. Tøndel, and M. Gilje Jaatun, “Tool- security gaps in advanced automotive systems and ISO/SAE 21434,”
assisted threat modeling for smart grid cyber security,” in 2021 Inter- in 2023 IEEE 97th Vehicular Technology Conference (VTC2023-
national Conference on Cyber Situational Awareness, Data Analytics Spring), Florence, Italy: IEEE, Jun. 2023. DOI: 10.1109/VTC2023-
and Assessment (CyberSA), Dublin, Ireland: IEEE, Jun. 2021. DOI: Spring57618.2023.10200490.
10.1109/CyberSA52016.2021.9478258. [48] M. Muckin and S. C. Fitch, “A threat-driven approach to cyber
[34] M. Girdhar, J. Hong, Y. Yoo, and T.-j. Song, “Machine learning- security,” Lockheed Martin Corporation, 2014.
enabled cyber attack prediction and mitigation for EV charging [49] T. Srivatanakul, J. A. Clark, and F. Polack, “Effective security require-
stations,” in 2022 IEEE Power & Energy Society General Meeting ments analysis: HAZOP and use cases,” in Information Security: 7th
(PESGM), Denver, CO, USA: IEEE, Jul. 2022. DOI: 10 . 1109 / International Conference, ISC 2004, Palo Alto, CA, USA, September
PESGM48719.2022.9916914. 27-29, 2004. Proceedings 7, Springer, 2004, pp. 416–427.
[35] P. Ruf, J. Stodt, and C. Reich, “Security threats of a blockchain-based [50] The MITRE Corporation, MITRE ATT&CK, https://attack.mitre.org/,
platform for industry ecosystems in the cloud,” in 2021 Fifth World 2023.
Conference on Smart Trends in Systems Security and Sustainability [51] G. Sabaliauskaite and A. P. Mathur, “Aligning cyber-physical system
(WorldS4), London, United Kingdom: IEEE, Jul. 2021, pp. 192–199. safety and security,” in Complex Systems Design & Management
DOI : 10.1109/WorldS451998.2021.9514058. Asia: Designing Smart Cities: Proceedings of the First Asia-Pacific
[36] K. Strandberg, T. Rosenstatter, R. Jolak, N. Nowdehi, and T. Olovs- Conference on Complex Systems Design & Management, CSD&M
son, “Resilient shield: Reinforcing the resilience of vehicles against Asia 2014, Springer, 2015, pp. 41–53.
security threats,” in 2021 IEEE 93rd Vehicular Technology Conference [52] V. Casola, A. D. Benedictis, C. Mazzocca, and R. Montanari, “Toward
(VTC2021-Spring), Helsinki, Finland: IEEE, Apr. 2021. DOI: 10.1109/ automated threat modeling of edge computing systems,” in 2021
VTC2021-Spring51267.2021.9449029. IEEE International Conference on Cyber Security and Resilience
[37] H. Zhang, Y. Pan, Z. Lu, J. Wang, and Z. Liu, “A cyber security (CSR), Rhodes, Greece: IEEE, Jul. 2021, pp. 135–140. DOI: 10.1109/
evaluation framework for in-vehicle electrical control units,” IEEE CSR51186.2021.9527937.
Access, vol. 9, pp. 149 690–149 706, 2021. DOI: 10.1109/ACCESS. [53] V. Casola, A. De Benedictis, M. Rak, and U. Villano, “Toward the
2021.3124565. automation of threat modeling and risk assessment in IoT systems,”
[38] E. A. AbuEmera, H. A. ElZouka, and A. A. Saad, “Security frame- Internet of Things, vol. 7, p. 100 056, Sep. 2019. DOI: 10.1016/j.iot.
work for identifying threats in smart manufacturing systems using 2019.100056.
STRIDE approach,” in 2022 2nd International Conference on Con- [54] M. Eckhart, A. Ekelhart, and E. Weippl, “Automated security risk
sumer Electronics and Computer Engineering (ICCECE), Guangzhou, identification using automationml-based engineering data,” IEEE
China: IEEE, Jan. 2022, pp. 605–612. DOI: 10.1109/ICCECE54139. Transactions on Dependable and Secure Computing, vol. 19, no. 3,
2022.9712770. pp. 1655–1672, May 2022. DOI: 10.1109/TDSC.2020.3033150.
[39] M. Girdhar, Y. You, T.-J. Song, S. Ghosh, and J. Hong, “Post-accident [55] P. Lohmann, C. Albuquerque, and R. Machado, “Systematic liter-
cyberattack event analysis for connected and automated vehicles,” ature review of threat modeling concepts,” in Proceedings of the
IEEE Access, vol. 10, pp. 83 176–83 194, 2022. DOI: 10 . 1109 / 9th International Conference on Information Systems Security and
ACCESS.2022.3196346. Privacy, Lisbon, Portugal: SCITEPRESS - Science and Technology
[40] S. Hollerer, M. Chabrova, T. Sauter, and W. Kastner, “Combined Publications, 2023, pp. 163–173. DOI: 10.5220/0011783000003405.
modeling techniques for safety and security in industrial automation: [56] M. Benyahya, T. Lenard, A. Collen, and N. A. Nijdam, “A systematic
A case study,” in 2022 15th International Conference on Security of review of threat analysis and risk assessment methodologies for con-
Information and Networks (SIN), Sousse, Tunisia: IEEE, Nov. 2022. nected and automated vehicles,” in Proceedings of the 18th Interna-
DOI : 10.1109/SIN56466.2022.9970541. tional Conference on Availability, Reliability and Security, ser. ARES
[41] S. K. Kuri, T. Islam, J. Jaskolka, and M. Ibnkahla, “A threat model ’23, Benevento, Italy: Association for Computing Machinery, 2023.
and security recommendations for IoT sensors in connected vehicle DOI : 10.1145/3600160.3605084.

Authorized licensed use limited to: Somaiya University. Downloaded on January 06,2025 at 11:03:13 UTC from IEEE Xplore. Restrictions apply.