  The widespread use of software-intensive cyber systems in critical
infrastructures such as ships (CyberShips) has brought huge benefits, yet it
has also opened new avenues for cyber attacks to potentially disrupt
operations. Cyber risk assessment plays a vital role in identifying cyber
threats and vulnerabilities that can be exploited to compromise cyber systems.
A number of methodologies have been proposed to carry out these analyses. This
paper evaluates and compares the application of three risk assessment
methodologies: system theoretic process analysis (STPA-Sec), STRIDE and CORAS
for identifying threats and vulnerabilities in a CyberShip system. We
specifically selected these three methodologies because they identify threats
not only at the component level, but also threats or hazards caused due to the
interaction between components, resulting in sets of threats identified with
each methodology and relevant differences. Moreover, STPA-Sec which is a
variant of the STPA is widely used for safety and security analysis of cyber
physical systems (CPS); CORAS offers a framework to perform cyber risk
assessment in a top-down approach that aligns with STPA-Sec; and STRIDE
(Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service,
Elevation of Privilege) considers threat at the component level as well as
during the interaction that is similar to STPA-Sec. As a result of this
analysis, this paper highlights the pros and cons of these methodologies,
illustrates areas of special applicability, and suggests that their
complementary use as threats identified through STRIDE can be used as an input
to CORAS and STPA-Sec to make these methods more structured.
