## 2 Related Work  
A review of related work within the areas of security risk and critical infrastructure, mainly focusing on the transportation sector, is presented in this section. The related work is divided into two domains, namely, international standards or frameworks, used by organizations and research studies. **International Standards. ** International standards or frameworks exist in cyber domain and have been widely used in critical infrastructure risk domain, due to the increasing severity of cyberattacks. As mentioned in Section 1, NIST has released standards that assist organizations towards the cyber risk management such as the qualitative impact-likelihood matrix in NIST SP800-30 [25]. NIST's Cyber Security Framework for Critical Infrastructure [33], targets to assist stakeholders within critical infrastructure domain, into management of cybersecurity related risk and cyber resilience. It builds on three core structures, namely, framework core (i.e., discuss the management of cyber risk), implementation tiers (i.e., discuss the standards that more effectively suit organizations cybersecurity program), and framework profile (i.e., discuss identified opportunities for improving organizations cybersecurity). NIST standards are mainly applicable to manage risks arising from remote attacks (i.e., through the Internet) and insider attacks. Additionally, the standards provide guidance on how to protect valuable assets in cyber space (e.g., sensitive data) by performing activities at the level of an organization (e.g., employees training). Contrary to this, this approach presented in this paper rigorously focusses on cyber-attacks at the sensing area (i.e., sensing layer), which result in physical impacts (i.e., cyber-physical attacks) and emerge from the exposure of IoT devices at physical space. Furthermore, the discussed control barriers originate from the engineering domain (e.g., motion detectors) and aim to protect the IoT enabled transportation infrastructure. NIST 8228 internal report [34], aims to inform federal agencies and organizations on how to manage IoT cybersecurity and privacy risks. The report identifies high level considerations that may affect the management of cybersecurity and privacy risks for IoT devices (e.g., interaction with physical systems) as compared to conventional IT devices. Although the report provides valuable information about cyber security risks determined by the use of IoT devices, it does not provide a method to assess these risks. Common Vulnerability Scoring System (CVSS) [35], is an open framework that assists organizations to assess and prioritize their vulnerability management processes.. Although it focuses on measuring the severity of security vulnerabilities, it has been widely integrated in risk assessment procedures [36]. For example, the exploitability metrics of Base Score (e.g., Attack vector), which are considered in this approach, represent the intrinsic characteristics of a vulnerability that are constant over time and across user environments. The Base metric produces a score that ranges from zero to ten to measure the severity of vulnerability, based on human judgement. CVSS [35] is only applicable for measuring the severity of vulnerabilities, rather than assessing the risks that emerge from their exploitation. **Research Studies. ** Studies in the transportation sector have focused on security issues of advanced transportation elements (e.g., vehicles) that communicate wirelessly (i.e., vehicle-to-vehicle and vehicle-to-infrastructure communication), rather than considering harm that these elements can cause to the transportation infrastructure [37; 38; 39]. A risk assessment process for policymakers and engineers was presented by [PERSON] et al. [40], to raise security awareness of exploitable in-vehicle network security vulnerabilities. Due to the lack of statistical data in cyber-attacks, a qualitative impact-likelihood matrix, that follows the guidelines of NIST SP800-30 standards [25] was applied.