## 3 Cyber-Physical Risk Assessment Approach  
Due to the complex nature of critical infrastructure domain, risk assessment methods should be adapted to each sector (e.g., maritime, transportation) individually [41]. Thus, the cyber-physical risk assessment approach presented in this paper focuses on critical transportation infrastructure and can be performed by stakeholders who act as assessors (i.e., operators, security, and civil engineers). Similarly to existing risk assessment methods, this approach is based on the identification and assessment of vulnerability, threat, and impact [50]. As shown in Figure 1, this approach incudes six activities. The first activity, as shown in Figure 1 (_Identification of vulnerabilities in the wireless sensor network protocol_), includes the identification of vulnerabilities that are present in the wireless  
Figure 1: Overview of cyber-physical risk assessment approach. network protocol used by the IoT devices to communicate. This activity can be facilitated by the use of public vulnerability databases (e.g., Common Vulnerabilities and Exposures [51]) as well as research [52] and experimental studies [53]. The identified vulnerabilities are used in the second activity to identify potential cyber-physical attack scenarios (_Identification of cyber-physical attack scenarios_), that enable their exploitation. Identification of cyber-physical attack scenarios necessitates the role of stakeholders who have bespoke knowledge of their system [42]. Indeed, the preparation of cyber-physical attack scenarios requires the consideration of weaknesses not only in cyber space but also in the physical space (e.g., deficient physical protection). The main attack scenarios against IoT devices (e.g., battery drainage, eavesdropping etc) that can be used in this approach, have been discussed in detail in the literature [54]. The second activity (refer to Figure 1) can be further facilitated with the use of publicly available catalogues of common attack patterns (e.g., CAPEC [55]) that describes how specific parts of an attack are designed and executed based on real world examples, as well as experimental studies [56]. Cyber-physical attack scenarios identify how vulnerability in the IoT network can be exploited by a threat source to damage physical space. The third, fourth and fifth activities revolve on the assessment of the vulnerabilities that can be exploited in a cyber-physical attack scenario, the threat source who attempts to exploit them, and the adversarial physical impact that can be caused by the successful exploitation of vulnerability. As shown in Table 1, the assessment of vulnerabilities and threat source requires assessors to assign a numerical score: (i) in the decision scale (X\({}_{i}\)), that describes the level of their characteristics with respect to the considered IoT based WSN; and (ii) in the importance index (W\({}_{i}\)), that describe the importance of their characteristics with respect to their effect on the completion of cyber-physical attack scenario. More precisely, in Activity 3 assessors define the level of vulnerability characteristics and their importance: _Attack vector_ (X\({}_{\text{AV}}\), W\({}_{\text{AV}}\)), _Attack complexity_ (X\({}_{\text{AC}}\), W\({}_{\text{AC}}\)), _User interaction_ (X\({}_{\text{UL}}\), W\({}_{\text{UI}}\)), _Privileges required_ (X\({}_{\text{PR}}\), W\({}_{\text{PR}}\)), and _Interoperability_ (X\({}_{\text{IO}}\), W\({}_{\text{IO}}\)). These characteristics are similar to those considered in CVSS [35]. The overall assessment of vulnerability is computed as the weighted average of the level of vulnerability characteristics. In Activity 4 assessors define the level of threat source characteristics and their importance: _Knowledge_ (X\({}_{\text{KN}}\), W\({}_{\text{KN}}\)), _Resources_ (X\({}_{\text{RE}}\), W\({}_{\text{RE}}\)), _Psychology_ (X\({}_{\text{PS}}\), W\({}_{\text{PS}}\)), _and Terrorism experience_ (X\({}_{\text{Te}}\), W\({}_{\text{Te}}\)).