# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 1 Introduction  
Generally, cyber-physical systems are real-time and robust independent systems with high performances requirements [1]. They are used in many application domains, including critical infrastructures, such as the national power grid, transportation, medical, and defense. These applications require the attainment of stability, performance, reliability, efficiency, and robustness, which require tight integration of computing, communication, and control technological systems [2]. CPSs of critical infrastructures have always been the target of criminals and are affected by security threats [3] because of their complexity and cyber-physical connectivity. These CPSs face security breaches when people, processes, technology, or other components are being attacked or risk management systems are missing, inadequate, or fail in any way. The attackers target confidentialdata, such as customer information or other valuable records [4]. It is likely that the threats of CPSs will only increase in the future as the use of these systems become widespread. However, there are sensible safety measures that organizations can consider to minimize losses from their destruction. It is possible to control damages and recover from an attack and its consequences with the appropriate insight through research and a domain expert's assistance [5]. Managing CPS security risk is not about eliminating all risks; it is about determining and understanding the risk rating of events and putting the right processes or controls in place to manage them in accordance with the organization's risk tolerance level. Risk management is a continuous process, not a one-time event [3]. In response to an event(s), there is an urgent need for organizations to truly understand their cyber-physical security status and employ the necessary and urgent corrective actions to rectify weaknesses [6]. Risk can be defined as an uncertain event that may occur due to a system malfunction or failure that could harm assets, such as human beings or the environment, and also influence the organization's achievement on strategic, operational, and financial objectives [7]. Risk management is a key discipline for making effective decisions and communicating the results within organizations. It proactively identifies potential managerial and technical problems so that appropriate actions can be taken to reduce or eliminate the probability and/or impact of these problems [8]. There are many existing risk management methods for CPSs [9; 10; 11; 12] However risk management in CPSs is challenging because of the increased complexity of the systems, the evolution of risk levels, human factor threats comprising of unintentional breaches of security, the unsuspicious use of infected information media giving away sensitive information, and lack of awareness and human errors [13]. In addition, cascading failures occur because of interdependencies among components and infrastructures. Importantly, threats affecting one part of a CPS can propagate to other parts through the network, which interconnects different parts of the CPS and affects other parts. As security threats grow, the organization needs a comprehensive cybersecurity risk management system to identify unique cybersecurity threats and their trends. The authors of a previous paper [14] discussed the challenges for securing CPS and analyzed security mechanisms for prevention, detection and recovery, resilience, and deterrence of attacks for securing CPS. A previous work [15] proposed a layered approach for evaluating risk based on security to prevent, mitigate, and tolerate attacks both on physical power applications and cyber infrastructures. The paper identifies the importance of combining both power application security and supporting infrastructure security into the risk assessment process and provides a methodology for impact evaluation. Also, another paper Ref.