# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 4 An Integrated Risk Management Approach
### Risk Management Process
#### 4.2.3 Activity 3: Vulnerability Assessment and Threat Identification
A score of 1-5 is given for the _VR_ as shown in Table 2. \(V\) = Vulnerability type, this will be the various vulnerability types associated with each critical asset as shown in Table 7. CA = Critical Asset. For example, if three vulnerabilities (V3.1, V3.2, and V3.4) from the checklist above were identified as a Software asset, the vulnerabilities will be rated using the _VR_ score to get the vulnerability impact on the software asset using Equation (3):  
\[VI(CA)=\text{V3.1}_{4}+\text{V3.2}_{3}+\text{V3.4}_{4}=11/3=3.67\] \begin{table}
\begin{tabular}{c c c} \hline \hline
**Score (VR)** & **Criteria** & **Description** \\ \hline VR.5 & Very high & One or more major weaknesses have been identified that make the asset extremely susceptible to an attack. The organization has no capability of resisting the occurrence of a threat. \\ \hline VR.4 & High & One or more major weaknesses have been identified that make the asset highly susceptible to an attack. The organization has the low capability of resisting the occurrence of a threat. \\ \hline VR.3 & Medium & A weakness has been identified that makes the asset moderately susceptible to an attack. The organization has the reasonable capability of resisting the occurrence of a threat. \\ \hline VR.2 & Low & A minor weakness has been identified that slightly increases the susceptibility of the asset to an attack. The organization has a good capability of resisting the occurrence of a threat. \\ \hline VR.1 & Very low & No weaknesses exist. The organization has an excellent capability of resisting the occurrence of a threat. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Vulnerability rating table. In this case, the vulnerability impact of the software asset is low, therefore there is little possibility of a threat occurring. The more the vulnerability is identified as an asset, the higher the vulnerability impact on the asset. To calculate vulnerability impact of an entire system, the total Vulnerability Impact of each \(CA\), \(VI(CA)\) will be summed together and divided by the total number of assets identified using the equation below:  
\[VI(S)\sum_{VA\ (CA)=1}^{n}\frac{VI\ (CA1)+VI(CA2)\ldots+VI(CAn)}{total\ number\ of\ assets} \tag{3}\]  
where \(S\) = Overall Critical Infrastructure System. The category of the overall vulnerability system will have a range between 10 and 100% indicating vulnerability. Step 3: Identify threats  
The final step of this activity identifies the threat caused by the existence of a vulnerability which affects the critical assets of a critical infrastructure and its ability to deliver its services. Critical Infrastructures can be remotely controlled over the internet by the implementation of IT systems [39]. This implementation of IT systems on critical infrastructures and the interconnection between the two has given room for cyber threats leading to security concerns. Vulnerabilities such as the denial of service or malware attacks, which are famous in Critical Infrastructures, can lead to threats thereby, causing security challenges to the interconnected devices [40]. This task will also look at the different threats that affect critical assets, consequently, creating the occurrence of a risk or risks.