# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.2 Cyber Resilience Analysis  
To address the question of how existing frameworks and systems that address CPSs in smart cities support cyber resilience, we consider the scope of resilience within the cybersecurity discipline and the evidence reported in the primary studies. To achieve this, the primary studies were organised in order of the reported evidence of how the cyberattacks across the physical and digital domains were addressed and how the external or insider threats were approached. Although cyber resilience is widely acknowledged by governments including the UK's National Cyber Security Strategy 2016-2021, which promotes the cyberspace resilience by shaping technical standards that govern emerging technologies, promoting best practices and security-by-design [5], the Joint Committee on National Security and Strategy in their report acknowledged that the UK Government must do more to improve the cyber resilience of the critical national infrastructure (CNI) [89]. Cyber resilience has been acknowledged as a challenge in the IoT; President [PERSON] issued an Executive Order (EO) 13636 to strengthen the critical infrastructure cybersecurity resilience. Likewise, improving cyber resilience is at the forefront of the Australian Government [88]. Despite many efforts to define the term \"resilience\" and although CPS resilience is accepted as an important aspect by the scientific community, governments and industry, it is a multi-dimensionaland multi-disciplinary facet that has no clear and uniform definition or performance metrics [92, 93]. The term resilience is described by the NIST as \"[t]he ability to quickly adapt and recover from any known or unknown changes to the environment through a holistic implementation of risk management, contingency, and continuity planning\" [94]. Furthermore, to evaluate CPS resilience, several areas of CPS resilience were studied including policy [95], correlation of resilience on probability and impact of performance under adverse conditions [96] and risk and resilience correlation [93]. The nature of CPSs is multi-dimensional, converging physical and cyber domains in a highly complex ecosystem integrating systems, software, people and services. In our approach to establishing how CPSs in smart cities support cyber resilience, we were able to investigate the primary studies according to specific layers within the TCP/IP model--a standard model used in computer networks, based on modern DFIR general-purpose frameworks--based on adversary type and by the smart sector covered by each study. **Layers** were identified with reference to the TCP/IP model described in RFC 1122 [97]. The TCP/IP model consists of four layers which, from the lowest to the highest, are the link layer, the internet layer (network), the transport layer, and the application layer. The primary studies can be categorised into three layers: physical, communication (aligns to the Internet and transport layers of the TCP/IP model) and application. A similar categorization approach was taken by authors [92] to define CPS resilience. For example, the physical layer includes physical faults, component failure and the delivery of the attacks through access within the security perimeter including attacks on CPS controllers, sensors and actuators. The communication category includes communication-environment-based disruptions and attacks like denial of service (DoS), man-in-the-middle (MiM), the user to root type buffer overflow or remote to user ftp write. The application category included false data injection (FDI), malware and other services and cloud storage and web application-based attacks. Some incidents can fit into more than one category [98].