# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 4 An Integrated Risk Management Approach
### Modeling Concepts  
The proposed approach includes a set of modeling concepts that are essential to understand, manage, and express cybersecurity risks. We have identified a few concepts necessary for the development of the cybersecurity risk management approach. Based on those concepts, an in-depth exploration of the numerous methods, tools, and techniques that can be used for a risk management approach in the CPS has been performed. An overview of the concepts used by the proposed approach is explained below:  
* Actor: An actor is an entity, generally a human user, a system, an organization, or a process each with a specific strategic goal within its organizational setting and carries out specific activities to generate cybersecurity risk management actions or receive the generated cybersecurity risk management actions by another actor [31]. This requires the organization to appoint efficient actors to carry out various tasks to guide and lead in achieving its goals. The actors are identified as stakeholders, such as government employees, IT providers, and utilities, employees, consumers, owners and operators, customers, users, and providers with skills within a particular location. * Goals: Goals signify the overall aims and objectives of an actor which supports the interest and continuity of the business. There are expectations to support the organization and include the KPIs of the organization, security, and organizational goals. KPIs allow the critical infrastructure organization actors to make a keen decision about the organization's continuity; they include confidentiality, availability, and integrity. Figure 1: An integrated risk management approach. * Risks: Risk can be defined as the possibility of an unwanted outcome as a result of an incident, event, or occurrence, as determined by its likelihood and the associated consequences. The risk is inevitable in a business, however, it is the role of the actors to ensure that risks are kept to a minimum to achieve the goals. Once the risk has been identified, it is necessary to have a mitigation plan or any other solution to counterattack the risk. Risks are the potential consequences of the system and could possibly compromise the security of the CPS and not meet the actor's expectations. A CPS risk could be classified under security, operational, nontechnical, technical, and governance or regulatory parameters. These risks could obstruct the security of the CPS and require an appropriate assessment. The risk assessment will be based on likelihood, impact, and residual analysis, which helps in identifying which risk needs to be controlled by following different control strategies. * Assets. Assets are defined as tangible or intangible entities which are necessary and have values to the CPS organization. Identification of key assets, and putting a value on each key asset, is an important process of risk management. These key assets could be people, services, facilities, processes, etc. It is important to identify critical assets as well as estimate their critical failure modes or impact of the loss. An asset has two features: (i) criticality and (ii) category. Criticality is defined as a measure of the consequences associated with the degradation or loss of an asset. It is the major indicator used by organizations to determine which asset is of more value to the business continuity. Category classifies assets according to its level of sensitivity and security requirements. The criticality of an asset category can be high, medium, or low, which means that assets with high rating are the most valuable to the organization. * Controls. The set of security protections or countermeasures to avoid or minimize security risks in CPS critical infrastructure are called controls. Controls are also the mechanism used to provide security to the CPS, and they are characterized by combining technical and nontechnical controls which are used to deter anticipated and unanticipated threats from exploiting known vulnerabilities.