\documentclass[a4paper]{article}
\usepackage[margin=18mm]{geometry}
\usepackage{corasdiagram}

\begin{document}

\section*{Semantic-First CORAS Demo}

\begin{center}
\begin{corasassetdiagram}[x=.95cm,y=.95cm,asset columns=3]
  \party[id=company,scope=asset-scope]{Company}
  \asset(direct)[id=availability,scope=asset-scope]{Availability of server}
  \asset(direct)[id=confidentiality,scope=asset-scope,order=2]{Confidentiality of information}
  \asset(indirect)[id=reputation,scope=asset-scope,order=3]{Company's reputation}

  \corasscope[
    name=asset-box,
    scope=asset-scope,
    kind=asset-scope,
    party=company,
    party corner=left
  ]

  \assigns{company -> availability}[asset value=critical]
  \assigns{company -> confidentiality}[asset value=critical]
  \assigns{company -> reputation}
  \harms{availability -> reputation}
  \harms{confidentiality -> reputation}
\end{corasassetdiagram}
\end{center}

\newpage

\section*{Threat and Risk}

\begin{center}
\begin{corasthreatdiagram}[x=.92cm,y=.92cm,min edge gap=10mm]
  \lane{1}{
    \threat(deliberate)[id=hacker]{Hacker}
    \threatscenario[
      id=unauth,
      likelihood=Possible,
      likelihood basis={3,15:30y}
    ]{Unauthorised access to the system}
    \threatscenario[
      id=malware,
      likelihood=Possible,
      likelihood basis={1.5,7.5:30y}
    ]{Malware in ECDIS system}
    \unwantedincident[
      id=down,
      risk ref=R4,
      likelihood=Possible,
      likelihood basis={1.8,8.4:30y}
    ]{ECDIS system not available}
  }
  \lane{2}{
    \threat(nonhuman)[id=nonhuman]{Non Human Threat}
    \threatscenario[
      id=hardware,
      likelihood=Unlikely,
      likelihood basis={1,3:30y}
    ]{Hardware error}
    \unwantedincident[
      id=degraded,
      risk ref=R5,
      likelihood=Possible,
      likelihood basis={2.96,9.71:30y}
    ]{ECDIS system degraded}
  }
  \lane{3}{
    \threat(accidental)[id=crew]{Crew member}
    \threatscenario[
      id=human,
      likelihood=Likely,
      likelihood basis={30,150:30y}
    ]{Human error}
    \unwantedincident[
      id=falsedata,
      risk ref=R6,
      likelihood=Likely,
      likelihood basis={27.06,133.5:30y}
    ]{ECDIS system displaying false data}
  }

  \asset(direct)[id=ecdis,right=degraded,text width=34mm]{ECDIS integrity and availability}
  \junction[id=join,left=degraded]{}

  \initiates{hacker -> unauth}[vulnerability={Poor security design,Unpatched system}]
  \leadsto{unauth -> malware}
  \leadsto{unauth -> down}[conditional likelihood={0.4}]
  \initiates{nonhuman -> hardware}[vulnerability={Substandard materials used to produce hardware}]
  \initiates{crew -> human}[vulnerability={Overworked staff or staff lacking knowledge}]

  \leadsto{{hardware,human} -> join}
  \leadsto{join -> {degraded,falsedata}}
  \leadsto{malware -> down}[conditional likelihood={0.8}]
  \leadsto{{malware,human} -> degraded}[conditional likelihood={0.9}]
  \leadsto{human -> falsedata}[conditional likelihood={0.8}]

  \impacts{down -> ecdis}[consequence={Catastrophic (5)}]
  \impacts{degraded -> ecdis}[consequence={Major (4)}]
  \impacts{falsedata -> ecdis}[consequence={Catastrophic (5)}]
\end{corasthreatdiagram}

\vspace{10mm}

\begin{corasriskdiagram}[x=.95cm,y=.95cm,min edge gap=10mm]
  \lane{1}{
    \threat(deliberate)[id=rt-hacker]{Hacker}
    \risk[id=rt-r4,risk ref=R4,risk level=unacceptable]{ECDIS system not available}
  }
  \lane{2}{
    \threat(nonhuman)[id=rt-nonhuman]{Non Human Threat}
    \risk[id=rt-r5,risk ref=R5,risk level=unacceptable]{ECDIS system degraded}
    \asset(direct)[id=rt-asset,right=rt-r5]{ECDIS integrity and availability}
  }
  \lane{3}{
    \threat(accidental)[id=rt-crew]{Crew member}
    \risk[id=rt-r6,risk ref=R6,risk level=unacceptable]{ECDIS system displaying false data}
  }

  \initiates{rt-hacker -> {rt-r4,rt-r5,rt-r6}}
  \initiates{rt-nonhuman -> {rt-r4,rt-r5,rt-r6}}
  \initiates{rt-crew -> rt-r6}

  \impacts{{rt-r4,rt-r5,rt-r6} -> rt-asset}
\end{corasriskdiagram}
\end{center}

\newpage

\section*{Treatment and Overview}

\begin{center}
\begin{corastreatmentdiagram}[x=.9cm,y=1cm,layout=manual,min edge gap=10mm]
  \threat(deliberate)[id=td-hacker,at={(0,4.5)}]{Hacker}
  \vulnerability[id=td-weakauth,at={(3.2,4.5)}]{Weak authentication}
  \threatscenario[
    id=td-account,
    at={(7.8,4.5)},
    likelihood=Possible,
    likelihood basis={3,15:30y}
  ]{Compromised account}
  \risk[
    id=td-risk,
    at={(13.8,4.5)},
    risk ref=R7,
    risk level=unacceptable
  ]{Unauthorised control of payment service}
  \asset(direct)[id=td-service,at={(20.0,4.5)}]{Payment service}
  \treatmentscenario[id=td-mfa,at={(7.8,8.8)}]{Enforce phishing-resistant MFA}

  \initiates{td-hacker -> td-account}[vulnerability={td-weakauth}]
  \leadsto{td-account -> td-risk}[conditional likelihood={0.8}]
  \impacts{td-risk -> td-service}[consequence={high}]
  \treats{td-mfa -> td-weakauth}[treatment category={Reduce likelihood}]
\end{corastreatmentdiagram}

\vspace{12mm}

\begin{corastreatmentdiagram}[mode=overview,x=.95cm,y=.95cm,min edge gap=10mm]
  \risk[id=ov-risk1,risk ref=R8,risk level=unacceptable]{Credential theft}
  \risk[id=ov-risk2,risk ref=R9,risk level=acceptable]{Session hijack}
  \asset(direct)[id=ov-asset]{User accounts}
  \treatmentscenario[id=ov-treatment1]{Hardware keys}
  \treatmentscenario[id=ov-treatment2]{Session binding}
  \junction[id=ov-junction]{}

  \impacts{{ov-risk1,ov-risk2} -> ov-asset}
  \treats{ov-treatment1 -> ov-junction}[treatment category={Reduce likelihood}]
  \treats{ov-treatment2 -> ov-junction}[treatment category={Reduce consequence}]
  \treats{ov-junction -> {ov-risk1,ov-risk2}}
\end{corastreatmentdiagram}
\end{center}

\end{document}
