## 5 Position and Opportunities for Further Research
### Security of Safety-Critical CPSs  
To address the security aspects of safety-critical CPS, the research questions discussed in Section 1 are refined as follows.  
1. Are the existing models, languages and frameworks for the development of CPSs expressive enough to specify security requirements in CPSs?
2. Are there any existing methods and techniques that can formally verify the specified security requirements in CPSs? If the answer to Research Question 2 is \"yes\", can the identified techniques efficiently support and be integrated to the existing safety analyses?
3. Are there any existing techniques to support secure run-time environment for CPSs?  
It can be observed that there exist several approaches, analyses and even frameworks addressing security in time- and safety-critical industrial CPSs. Although, the systematic incorporation of security into the system development during the design time and its run-time assessment at the operational phase, which is of special importance for safety-critical CPSs, is not yet mature. The solutions considered in this paper that support time time predictability hold only if the data integrity, authentication and authorisation and other relevant security objectives are supported. Given the strong dependency between timing predictability, safety and security, this paper states security as a prerequisite for timing predictability in time- and safety-critical CPSs.  
In the development secure CPSs, one of the main challenges is coming from the fact that a particular solution (e.g., a hash-function insuring messages integrity) cannot provide any guarantees just by itself, as its implementation and security policies specifying the solution usage play a crucial role in verification of whether it actually covers the required security objective. Hence, we advocate addressing security via the top-down approach at the system level and building a security assurance case in order to systematise the way security is provided and supported. An assurance case can be defined as \"_an enabling mechanism to show that the system meets its prioritized requirements_\" [54]. The system trustworthiness and reasoning upon it is the core of an assurance case. It can be built for a system property such as safety [55], security [36] or ethics [56]. We envision the security assurance case as a way to collect and structure arguments over the system being acceptably secure. Being dynamic by its nature, security requires run-time updates and refinements, e.g., patches. However, it is not feasible in terms of time, money and efficiency to develop a security case from the scratch each time there is an update. The challenge of handling the updates in an efficient way within a security case is a gap in the current research that needs to be addressed. There are also works on joint safety and security assurance cases [42] that allow addressing security-informed safety.  
Now, we answer the research questions (posed in Section 1) given the state of the art in safety-critical CPSs. First, there are several existing methods for requirements elicitation in the security domain [57; 58] as well as for joint consideration of safety and security [59; 60]. Second, there are many existing techniques and tools for the formal verification of these requirements [61; 62]. Moreover, many works are aiming on alignment of safety and security process in their different phases including requirements engineering one [42]. However, there is a gap in supporting run-time frameworks that can provide a secure run-time environment for the systems, which is crucial given how often updates and patches can be required.