# A Methodological Approach to Securing Cyber-Physical Systems for Critical Infrastructures
## 3 Open (Sub-)Challenges
### Transversal Challenges  
**Privacy and Security.** Ensuring security and privacy is crucial within these extensively automated IoT networks. However, the constrained resources available on IoT devices, coupled with stringent operational requirements, often make traditional security solutions inadequate. Security strategies for IoT must consider the limited computational power, radio bandwidth, and energy resources of these devices while ensuring the efficient processing of large volumes of data and quick response times. Furthermore, security measures that may initially be effective can become obsolete as attackers continuously evolve their tactics to bypass detection mechanisms. Consequently, the unique requirements of IoT systems demand the development of innovative, sophisticated, and customized security approaches to address the wide range of security challenges they face.  
**Economics of Cybersecurity.** As stated in Section 2, effective cybersecurity must take economic aspects into account. Indeed, the special feature of cyber risk poses many open challenges. A first issue in quantifying cyber risk from an economic and financial perspective is to estimate the frequency and severity of cyber incidents. Indeed, the availability of data on financial losses due to cyber incidents is a challenging issue for several reasons: cyber events and data loss-related data are scarce and usually not available in the desired granularity and amount [49; 50]. Further, cyber threats evolve in a highly non-stationary cyber risk landscape. Aggregated cyber risks are due to common IT architectures or complex interconnections that are difficult to capture [32]. Even the term 'cyber' risk can refer to many heterogeneous types of risk with different types of impact and, ultimately, root causes [51].  
Regarding security investments, the key quantity is the ratio of cost to benefit. In terms of a production function, it would be the amount of output per unit of input. An open challenge is the quantification of the benefits deriving from a specific investment, the security level of the information system, and the suitable metrics to compare different investments strategies [52]. It follows that we need to quantify the monetary cost of security mapped with respect to the security level, and then we need to assess the benefits stemming from it. Finally, to compare different investment strategies, we need to choose suitable security metrics. An open challenge here is the selection of a suitable risk reduction strategy which can be economically affordable.  
Another point highlighted in Section 2 is that, aside from risk mitigation by investing in countermeasures, the financial risk of security incidents can be transferred to third parties, notably cyber-insurers. Cyber insurance can be seen as complementary to investing in protection measures. The open challenge here is to find reliable criteria to determine whether it is worthwhile to sign an insurance policy. In principle, if the premium is lower than the difference between the benefit and cost of security, this can be considered a viable investment option [53].