STRIDE‐Based Threat Modeling for Smart Hazard Analysis and Critical Control Points in the Korean Food Industry

ABSTRACT With the acceleration of the Fourth Industrial Revolution, information and communications technology (ICT) has been increasingly implemented in the food industry to improve convenience. In Korea, this implementation is known as Smart Hazard Analysis and Critical Control Points (Smart HACCP). Smart HACCP offers advantages such as real‐time monitoring and automation through the integration of Internet of Things (IoT) technologies, among others, into the traditional HACCP system. However, these advantages can also introduce critical security vulnerabilities in the equipment and system. For example, tampering with the Critical Control Point (CCP) data in smart HACCP can lead to problems that result in casualties during the distribution process. Therefore, ensuring the security of smart HACCP is of the utmost importance. Despite the increased risk, only a few attempts have been made to address the security vulnerabilities of smart HACCP. Furthermore, much of the existing literature focuses mainly on adapting the system to specific industries, such as the food sector. Therefore, in this paper, we identify smart HACCP threats using STRIDE threat modeling and propose attack scenarios based on the finding. Our experimental results reveal approximately 183 threats in smart HACCP, comprising 142 threats identified using the Microsoft Threat Modeling Tool and an additional 41 threats considering the characteristics of smart HACCP. Based on the experiment, we derive three attack scenarios and evaluate them using a standard module and a real‐world enterprise in Korea.