# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 4 An Integrated Risk Management Approach
### Risk Management Process
#### 4.2.4 Activity 4: Risk Assessment  
Risk assessment is a challenging task for the overall risk management process due to difficulties in quantifying the risk, specifically in CPS domain. We advocate to identify and evaluate the critical assets and vulnerabilities of the assets so that it eases the risk assessment activity. The first step of this activity generated the cybersecurity attack scenario based on the asset and threat from the previous activity, followed by other steps which are given below. Step 1: Generate cyber-security attack scenario  
This step generates the cyber-security attack scenario based on the identified assets, threats, and potential vulnerabilities. The cyber-security attack scenario is a combination of threats, vulnerabilities, and assets. Typically those vulnerabilities and threats that have cascade-linked with each other are included in order to generate an attack scenario. Every attack scenario will have an impact to oppose the organizational goals of the critical infrastructure. Therefore, the cybersecurity attack scenario has interdependency between the vulnerabilities and threat to exploit risk. Due to the interdependency between components of a critical infrastructure organization, cascading effects are likely to occur. Vulnerabilities cascade through each other to trigger threat which eventually turns into a risk. In terms of the cascading effect, it could be a logical, cyber, physical, or geographical cascade subject, depending on its type of interdependency. The concept of the cyber-security attack scenario is used in the approach to clearly define the type of activities that occur during risk assessment. Step 2: Determine the likelihood of a cyber-security attack scenario  
This step determines the likelihood of the risk event of the attack scenario generated in step 1. To generate the likelihood of the attack scenario, we consider the access point, attacker's location and capability, entry and target point, numbers of vulnerabilities exploited by the attacker and the skill of the attacker. This assessment will be performed by estimating two quantities, which are the likelihood of the potential scenario \(S\) occurring multiplied by the vulnerability impact as a result of the number of vulnerabilities identified which is estimated using historical evidence, empirical data and other factors. The risk \(R\) is calculated by multiplying the likelihood of the cyber security attack scenario and its impact as shown in Equation (4), where \(i\) refers to the number of each type of incident that could result in scenario \(S\) occurring and affecting the system. The Table 3 below shows three different levels that will determine the likelihood of the attack scenario occurring and the \(R_{i}\) likelihood. \[R_{i}=L(S_{i})\ \times\ VI \tag{4}\]  
where,  
* \(L(S)\) = the likelihood of the occurrence of the scenario \(S\). * \(i=1,2,3\dots\ n\). The number of each incident that could result in a scenario occurring. * \(R_{i}\) = risk; \(S\) = a scenario; \(L\) = likelihood; \(VI\) = vulnerability impact. Step 3: Attackers' skill and location  
The location and skill of the attacker are based on their knowledge and expertise in organizing, executing, and succeeding in an attack. The attacker's characteristics, capability, and possible location will be explained below. The attacker's location could be internal, end-to-end, external, or physical. An internal attacker's location is usually found within the network of the organization. We consider three different levels of attacker skill which are given below and a general procedure to determine the likelihood  
* Level 1: At this level the attacker has insufficient knowledge, skill, and/or resources to perform a successful attack. This attacker is most likely to be found in any of the three locations mentioned above. * Level 2: At this level, the attacker has moderate skill level and resources to exploit one known vulnerability successfully, and the attacker is most likely to be found in the three locations mentioned above.