# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.2 Cyber Resilience Analysis
**DFIR Support** was investigated concerning the phases that form the basic foundation of an IR plan accordingly to general-purpose DFIR frameworks and standards such as the Digital Forensic Research Workshop (DFRWS), Abstract Digital Forensic Model (ADFM), NIST800-61 and ISO/IEC27050, from preparation to post-incident activities to identify how the primary studies address this process. **Adversary Type** was identified within each layer, where the threat can be caused by external or internal factors. We consider an internal threat to be a threat by an adversary initiated inside the security perimeter. Such an entity is authorised to access the systems or resources within the security perimeter but acts in a way that is not authorised. Examples include malicious or disgruntled employees or contractors who have direct access and sufficient knowledge of the system or the resource. In contrast, an external threat is initiated by an adversary from outside the security perimeter. Such an entity is not authorised to access or use the systems or resources and gains access through unauthorised or illegitimate attack vectors. We investigate how the primary studies address this aspect; a similar emphasis on this approach was followed by reference [92]. **Smart Sectors** will leverage CPS performance and resilience differently. CPSs operate across different smart sectors, therefore we identify the smart sectors as reported in the primary studies. Several studies specifically focus on the applicability of resilience in terms of the CPS's ability to withstand disruptions, recover from and adapt to known and unknown threats, as shown in Table 5. For example, in their approach, reference [40] argued that optimisation between smartness and cyber resilience in a CPS is required for a balance between functionality and cybersecurity without compromising the systems' resilience. In this study, the percolation theory was used as the basis of evaluating the stress caused by disruptions. The authors in reference [99] argued that the absence of common security standards and flexible methods to assess IoT security requires dedicated testbeds to systematically evaluate the devices' resilience under various conditions. The study developed a security testbed framework for the IoT. The testbed consists of standard security testing predominantly based on well-established vulnerability scans and penetration testing methodologies including port scanning, process enumeration, fuzzing and fingerprinting. The advanced testing capabilities of the testbed are based on techniques and tools including machine learning (ML), traffic-based IoT device type identification, automatic anomaly detection and environment simulations. The number of test scenarios demonstrated the effectiveness of the testbed in detecting the IoT devices' resilience against attacks including denial of service (DoS). Another study [100] focused on CPS resilience mechanisms that can be applied during runtime to sustain resilience utilising self-healing structural adaptation. In the following study [101], the authors argued the importance of an interdisciplinary integrated approach between the cyber and physical layers. They asserted that cyber resilience-by-design must address two scopes to achieve overall resilience, the security controls, communication scope and the power engineers' scope to reinforce the weak points during the design. The study proposed an integrated cyber-physical sustainability metric framework to assess CPS cyber resilience. Further analysis investigating possible correlations with the emerging key themes discussed in this paper shows no clear geographical correlation. The studies, categorised in Table 5, except for [101], acknowledged grant funding. Time correlation was observed with a continued trend in the increase of primary studies focusing on cyber resilience in 2018 and Q1 2019. This trend could indicate a response to the emergence of new and diverse types of security-related incidents that have the potential to be damaging and disruptive.