## 1 Introduction  
Cyber-physical production systems (CPPSs) are one of today's major technological driving factors. A wide range of current technologies, e.g., industrial automation, the Internet of Things (IoT), robotics, big data and cloud computing are incorporated within current CPPSs [1]. CPPSs consist of widely dispersed components which each contribute to the overall industrial systems. Therefore, the IoT is a novel upgrade of industrial automation control systems (IACSs). It benefits from the communication between billions of devices and enables sophisticated data processing methods over the Internet [2]. Formerly, corporate networks for production planning, ordering of materials or job scheduling were separated from IACS networks. Due to the required communication ties to the outside world, this top-level company information technology infrastructure was already vulnerable to external attacks. Moreover, IACS networks encompassing corporate networks and proprietary IACS networks have been replaced with commercial-off-the-shelf (COTS) equipment which is based on Ethernet TCP/IP. Therefore, cyber risks also affect the security of IACS networks. Furthermore, total system complexity has skyrocketed in recent years, and new threats are being introduced, jeopardizing the controllers within IACS networks, as these COTS components were never designed to work with them. In many circumstances, replacing them with attack-proof controllers is neither possible nor supplied by the machinery provider. Moreover, this would also disrupt the industrial the continuous operation of the production process. Multiple components are interacting with each other and communicating over networks or the public Internet. This means cybersecurity risks, potential exploits and potential failures. Therefore, a company must ensure that the confidentiality, integrity and availability (CIA) of data or system components are secured at all times in order to guarantee functionality and privacy at all times. Threat modeling has become an important tool in identifying potential threats to a system, including risk management and mitigation measures. In recent years, AIT has developed an automated approach towards threat modeling in the cyber-physical domain and the spreading of threats throughout a technological system, based on a system model, a threat database and security attributes.  
In this paper, we will not only explain the concept of threat modeling but even go one step further and identify the low-hanging fruit within the analyzed model and enhance the results with the requirements of the IEC62443 standard. This is to identify certain \"gate\" components where a threat can be mitigated before being propagated throughout the parts of the system. Thus, we introduce an approach to find the minimum number of security measures yielding the maximum security impact by considering the effectiveness of the optimized security attributes against multiple types of cyber incidents. Consequently, we seek to apply security measures at relevant points within the system, and thus mitigate the risk for the following components while omitting the necessity to implement the same security measure at all of the components. Formal verification (B-method) was used to evaluate this approach and ensure that no violations for security measures over the whole system exist. B-method can verify the model's consistency through extracting proof obligations that must hold through all operation states. Security measures were embedded in the B-model as invariants.