Bridging the Cyber–Physical Divide: A Novel Approach for Quantifying and Visualising the Cyber Risk of Physical Assets

Abstract

Critical infrastructures and their physical assets are under increasing threat of cyber-attacks as technological integration creates cyber–physical systems (CPSs). This has led to an urgent need to better understand which physical assets in these systems are most at risk, but this requires crossing the divide between cyber and physical risk assessments. However, existing cyber-security methods generally focus solely on the vulnerabilities and security of the cyber network and efforts to quantify the impacts of these cyber vulnerabilities on physical assets are generally limited to the consideration of individual attacks, rather than system-wide risk assessments. Similarly, risk assessments of physical infrastructure systems generally ignore potential impacts due to cyber-attacks. To overcome this cyber–physical divide in risk assessment, we introduce a novel approach for assessing risk across this divide. The proposed approach assesses the cyber risk of physical assets as a function of the vulnerabilities of their connected cyber components, and the contribution of cyber components to this risk. The approach is demonstrated with a case study of the C-Town water distribution system. The results indicate that the approach shows a modified prioritisation of risk compared to that obtained using conventional cyber or physical assessments, highlighting the importance of considering the connection between cyber and physical components in risk assessments of critical infrastructure and their physical assets.