# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## Evaluation
### Introduction to the Integrated Risk Management Process
#### 5.4.4 Activity 4: Risk Assessment
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Asset Name** & **Vulnerability** & **Vulnerability** & **Equation (3)** & **Vulnerability** \\  & **Type** & **Rating Score (VR)** & **Impact (V1)** \\ \hline Hardware & V4.1, V4.2 & 3, 4 & 7/2 = 3.50 & Low \\ SCADA system & V3.1, V3, V3.5 & 3, 2, 4 & 9/3 = 3.00 & Low \\ Communication and networks & V2.3 & 5 & 5/1 = 5.00 & Medium \\ People & V1.2, V1.3 & 3, 4 & 7/2 = 3.50 & Low \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Vulnerability impact assessment. Step 2: Determine the likelihood of a cyber-security attack scenario  
This step determines the likelihood, by estimating the potential attack scenario occurring multiplied by the vulnerability impact when it occurs by following Equations (2) and (4). * **Scenario 1:** \[ \begin{array}{c}VI=\text{V3.5 VRS}+\text{V3.6 VRR}+\text{V1.4 VRS}/3\\ VI=13/3=4.33\\ R_{i}=0.93\times 4.33=3.85\end{array} \] Based on scenario 1, three vulnerabilities were identified and the impact of the vulnerability is 4.33, which means that the vulnerability is medially rated. Therefore, the likelihood of the attack scenario occurring is 3.85 and it is almost certain to occur. * **Scenario 2:** \[ \begin{array}{c}VI=\text{V3.6 VRR}+\text{V3.4 VRE}+\text{V3.5 VRS}/3\\ VI=9/3=3.00\\ R_{i}=0.78\times 3.00=2.34\end{array} \] Based on scenario 2, three vulnerabilities were identified and the impact of the vulnerability is 3.00, which means that the vulnerability is average. Therefore, the  
* Scenario 1: The attacker bridged confidentiality, availability, and integrity by disrupting communications and gaining access to passwords, and authenticity by gaining access to the communication systems; the reputation of the organization is at stake. The impact will be based on the KPI bridged, and the KPI is assigned a weighted score based on a subjective judgment by the stakeholders. Impact of the scenario is the sum of all the KPI affected and the likelihood of the scenario occurring. \[I=0.93+0.61+0.55+0.71+0.33=3.13\] Therefore, impact on the KPI from the likelihood of the cyber-attack scenario generated is 3.13, which means that the impact is low. * Scenario 2: The attack bridged the organization's availability, confidentiality, integrity, authenticity, maintainability, and reputation. The weight assigned to each KPI is based on the extent to which the attack impacted the organization negatively. \[I=0.97+0.75+0.60+0.65+0.68+0.49=4.14\] which means the attack impact on the organization was average. * Scenario 3: The attacker bridged availability, confidentiality, nonrepudiation, integrity, and authentication by resetting the smart meter and adjusting it for his own financial benefit. \[I=1.00+0.45+0.56+0.63+0.71=3.35\] This means the attack impact is low impact to the organization, and the organization can operate without any major breakdown. Step 4: Identify the risk level  
The risk level for each scenario generated will be the likelihood of the attack scenario generated and the impact of the attack on the organizations KPI, by following Equation (6). Discos have agreed to accept any risk below 3, but anything from 3 and above, the risk is controlled. The risk level for each scenario is identified as shown below:  
* Scenario 1: \[RL=3.85+3.13=6.98\text{ (high)}\]
* Scenario 2: \[RL=2.34+4.14=6.48\text{ (high)}\]
* Scenario 3: \[RL=4.00+3.35=7.35\text{ (high)}\]