## 2 Related Work
The process synthesizes security incidents from the current literature and real-world cyber events, to visualize a risk matrix, related to safety, operation, reliability, and security issues that emerged from in-vehicle network security vulnerabilities. The maritime transportation sector includes crucial activities (export and import of goods) that face security threats. [PERSON] et al. [41] applied previously proposed cyber security risk assessment approaches (i.e., [42]) to a real case study of a container port. Stakeholders (e.g., port staff, IT managers) were actively involved in the approach by participating in interviews and questionnaires to assess cyber risk under different attack scenarios. Cyber risk was calculated as a summation of likelihood and impact, based on stakeholders' answers, while mitigation strategies (e.g., use of stronger passwords) were briefly discussed when risk values were not acceptable. ENISA released a report [43] to outline good practices for cybersecurity in the maritime sector, providing a list of security threats (e.g., social engineering) and measures (e.g., security awareness raising program) in relation to critical operations. [PERSON] et al. [44] highlight that existing cyber risk frameworks alone, are unable to address new threats that are arising in IoT-based systems. Indeed, current cybersecurity assessment methods alone cannot directly address the needs of IoT-based smart environments [45]. To address this gap, [PERSON] et al. [46] proposed an approach that enables decision makers in critical systems (e.g., healthcare sector), to identify and assess cyber-physical attack paths, rather than the risks that emerge from them, due to the existence of IoT devices. The method, which was tested in the healthcare sector, relies on qualitative and quantitative scales and builds on attack trees topologies [47], a recursive algorithm and exploitability metrics of CVSS [35]. The enablement of cyber-physical attack paths due to the existence of IoT devices was highlighted by [PERSON] et al. [48]. They proposed an approach to identify unexpected chains of events and subsequent potential impacts due to addition or removal of a device to/from an existing network, mainly applicable for industrial IoT applications (i.e., smart homes). The application of the approach was demonstrated, using a language and tool for relational models (i.e., Alloy [49]) in realistic IoT use cases (i.e., smart home devices). Although research studies succeed in raising security awareness in the transportation sector, they have certain limitations. Firstly, they focus on the protection of interactive transportation elements (i.e., vehicles) from cyber-attacks, rather than the critical transportation infrastructure itself [40]. Existing research studies have not considered cyber-attacks that take place in the sensing area of a critical transportation infrastructure and impact physical space, but rather focus on remote cyber-attacks. Additionally, studies that ground their risk calculation on attacker profiles have only considered a limited number of profile characteristics. For example, in [41; 46] only a limited numbers of profile characteristics (e.g., skills of an attacker) were considered to calculate the likelihood of an attack. However, as critical transportation infrastructure can also be the target of terrorist activities, other characteristics should also be considered. For example, attacker motives (e.g., ideology, political) could substantially affect the targets of an attack and the effort that the attacker will put to achieve their objectives. In the approach presented in this paper, a detailed attacker (also referred to as threat source) profile is considered based on the literature (i.e., latent content analysis) and the cyber-physical perspective of an IoT enabled transportation infrastructure. Finally, in comparison with previous studies that treat all threat source profile characteristic equally, we weigh the characteristics using importance indexes determined using expert judgement.