# Cybersecurity and Safety Co-Engineering of Cyberphysical Systems--A Comprehensive Survey
## 1 Introduction  
The unification of embedded systems with communication technologies gave rise to \"Cyber Physical Systems (CPS)\". Such systems are deployed in several application domains, such as automotive, smart manufacturing, and healthcare. Due to the \"double nature\" of such systems--merging of the cyber and the physical worlds--ensuring both safety and cybersecurity are important prerequisites to their reliable operation. Thus, the study of potential hazards and threats, and the assessment of safety and cybersecurity risks that potential accidents and cyberattacks pose, is important; it is also, usually, complicated. This is because there exist strong dependencies between the two domains, even though cases where they are independent do also exist. Three types of such dependencies have been identified and studied in Reference [1]:  
1. **Conditional dependencies:** Safe operations may be conditioned by cybersecurity, for example, malicious modifications of sensor data or control programs may prevent safety systems from protecting an installation in accidental conditions. Conversely, safety may be a condition for cybersecurity, for example, when unmanaged catastrophic conditions weaken the security posture of a system or an organization, and lead to opportunistic malicious acts. 2. **Reinforcement:** Safety and cybersecurity measures can be complementary, for example, event and activity logging may be used both for attack detection and accident anticipation, as well as post-event analysis. 3. **Conflict:** If safety and cybersecurity are considered separately for the same system, it is possible that conflicting requirements or measures may be identified, for example, a safety requirement for an automatic door shutting system, would be to leave the door open, whereas a security requirement would be to leave the door locked in case of failure. Therefore, there is a need to analyze both the safety and the cybersecurity of CPSs by employing a single approach. Such an approach can be employed to identify system faults/vulnerabilities, hazards/threats, safety/security requirements, and to assess safety/security risks. Security engineering approaches aim to identify, assess, and manage risks related to the confidentiality, integrity, and availability of the targeted system/component. Various methods for security engineering have been proposed in the literature, that focus on different phases of the system lifecycle. General approaches assess and manage the overall security risk of a system, whilst methods also exist that facilitate the analysis in a particular phase of the lifecycle such as the requirements engineering, the threat analysis, the vulnerability analysis, or the risk analysis phases. Safety engineering approaches aim to identify, assess, and manage risks related to the safety of the system, of humans, and of the environment. Various safety engineering methods exist, designed for different application domains and for different types of system safety (e.g., functional safety, operational safety etc.). Similarly with the security engineering methods case, different approaches exist for hazard analysis, fault analysis, cause analysis, and safety risk analysis and management. Accordingly, security and safety co-engineering approaches aim to identify, assess, and manage risks related to both security and safety in systems which are influenced from both the cyber and the physical world/environment. Such approaches are classified according to their goal in three categories [2]:  
* **Security-informed safety approaches:** Approaches that extend the scope of safety engineering by adapting cybersecurity-related techniques. * **Safety-informed security approaches:** Approaches that extend the scope of security engineering by adapting safety-related techniques. * **Combined safety and security approaches:** Combined approaches for safety and cybersecurity co-engineering.