# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## 4 Harmonized Taxonomy  
The harmonized taxonomy captures the essential elements as defined in Sections 2 and 3. It is separated into three domains, where the central lifecycle domain serves to anchor the other two domains (i.e., the support and analysis domain as well as the risk assessment and management domain). The discussion that follows references the labels (i.e., the blue circles enclosing a number or character) in Figure 12 to facilitate the explanation of the taxonomy. The system lifecycle itself (1) is a simplified version of the ISA cycle, with the design and maintenance phases acting as core phases. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Taxonomy Author(s)** & \multicolumn{4}{c}{**Core Elements Addressed**} \\
**Operational Risk Assessment** & **Threats** & **Vulnerabilities** & **Technology** & **Digital Forensics** \\ \hline [PERSON] et al. [17] & X & X & X & \\ [PERSON] et al. [19] & X & X & & \\ [PERSON] et al. [20] & X & X & & X \\ [PERSON] et al. [22] & & & & X \\ [PERSON] et al. [21] & & & X & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The relationship between the taxonomies and core elements. Figure 12: Harmonized information security taxonomy for cyber physical systems. The design phase is important, as this is where the initial risk assessment for the CPS will be performed, considering threats and vulnerabilities. The envisaged risks will be addressed through a supporting technology and digital forensic implementation design. After CPS implementation, the maintenance phase becomes critical. This is where incidents will likely be experienced during active operation and where incident detection, response, analysis and defense optimization will need to take place. The core element grouping within the support and analysis domain (2) as well as the risk assessment and management domain (3) reflects the relationship between analyzing and assessing the risks and scenarios in the risk assessment and management domain on the one hand and mitigating the risks and improving the processes contained in the support and analysis domain on the other hand. This paper discusses and highlights the following relationships:  
* Actions and implementations to provide information security as required in the CPS lifecycle;
* Risk analysis domain: 1. Risk assessment; 2. Threat identification and assessment; 3. Vulnerability identification and assessment. * Risk mitigation domain: 1. Supporting technology for prevention (proactive), detection and response (reactive); 2. Information collection and incident analysis through digital forensics. The harmonized taxonomy reflects these relationships in its design and layout. An overview of the harmonized taxonomy is given in Figure 12, while the finer details are presented in Section 3. Space constraints limit the amount of detail that can be presented in Figure 12.  
While the core elements within the domains are treated as separate actions, this should never be performed in isolation. As shown in Section 3, there are overlaps and dependencies between the different elements, and ignoring this will lead to gaps in the coverage of the taxonomy. These gaps will in turn invalidate the comprehensive aim of the harmonized taxonomy. In the following paragraphs, the taxonomy structure and elements are discussed in more detail. The support and analysis (2) domain consists of supporting technology (4) and digital forensics (5). The supporting technology (referring to proactive (a) and reactive (b) technology) is applicable throughout the life of the system. The proactive technology is required to limit intrusions, whereas reactive technology limits the spread and impact of intrusions. Both the proactive and reactive technologies are further divided into network (c), host (d) and application (e) level technologies, but the actual technologies are very different between the proactive and reactive technologies (see Figure 10 again). Apart from the preparation phase (f), the digital forensic elements are almost purely reactive.