# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 6 Discussion
### Comparison with Existing Study Results  
The results of our case study were compared with existing study results in the literature. The integrated cyber-security risk management approach is a comprehensive approach compared to other works from literature. A previous author Ref. [3] presented various security threats and incidents that occurred on different critical infrastructure domains. The work introduces some security measures including vulnerability assessments and penetration testing approaches for critical infrastructure; however, the focus of this paper was not only on vulnerability assessment, but on how clearly risk needs to be assessed, mitigated, and controlled. Asset identification and cascading vulnerabilities were not considered as a result of the interdependency between assets. A previous work [36] offers an insightful review of the possible solution paths to understand the industrial control systems security trends in relation to cyber threats, vulnerabilities, attacks, and impacts on the industrial control system (ICS). The work did not implement any practical approach to identify assets, assess vulnerabilities, threats, and mitigate risks, but only suggested some techniques. Authors of a previous paper Ref. [41] proposed a risk and vulnerability analysis method for critical infrastructure which focuses on serious events, emphasizing dependencies between critical infrastructure sectors. However, no detailed analysis has been carried out to uniquely identify critical assets and vulnerabilities of those assets, or to identify those particular chains of events (cascading vulnerabilities). A previous paper Ref. [21] proposed a unified risk management approach for a power grid system. Risk assessment, including threat and vulnerability, as well as categorizing, was discussed, but assets were not critically identified, cascading vulnerabilities were not considered, and controls were not put in place to mitigate the risk. The authors of a previous paper Ref. [9] emphasized the need for a comprehensive risk management method which covers all stages of the risk management process, our work focuses on this to improve the cyber-security of the CPS. The authors of a previous paper Ref. [10] proposed a quantitative method for mitigating cyber-security risk in information systems, our work quantified risk by identifying critical assets first, then assessing vulnerabilities. Likelihood of cyber-attack scenarios were generated to further identify the risk level and apply proper controls. The authors of a previous paper Ref. [13], in their risk assessment process, identified some risks such as unsuspicious use of infected information media, giving away of sensitive information, and lack of awareness. Our work identified all these risks, including human errors, loss of power supply, unavailability of power supply, loss of revenue to the power grid, and breach of security goals. The authors of a previous paper Ref. [15] proposed a layered approach that evaluates risks based on security, our work evaluated risks based on cyber-attacks as well as physical attacks and evaluates risk level and proper controls. The authors of a previous paper Ref. [14] discussed a mechanism for preventing, detecting, and recovering attacks for securing CPS, our work provided a mechanism for identifying critical assets, assessing cascading vulnerabilities, generating cyber-attack scenarios, impact of the attack occurring, and provided mitigation controls to properly secure the CPS. None of the works provide a systematic risk management process that identifies critical assets before assessing vulnerabilities, and also focuses on the initial vulnerability impact that leads to the cascading vulnerabilities effect. Our work identifies and compares the existing risk mitigation strategies for CPS in critical infrastructure, and therefore, gives critical infrastructure organizations a chance to perform an in-depth analysis for cyber-security on CPS.