## 3 Cyber-Physical Risk Assessment Approach
### Threat Source Characteristics  
The threat source characteristics that are considered in this approach are based on attacker's attributes proposed in the literature and by considering that an IoT based WSN operates in both cyber and physical space. The broader lack of access to organizational information related to cyber-attacks, has led to the adoption of a generic threat source description that cannot sufficiently describe an attacker profile and affect risk assessment [61]. The lack of detailed characteristics and knowledge gap with respect to the threat source profile has been highlighted by [PERSON] et al. [62]. Therefore, a latent content analysis of the existing literature was performed in this paper to identify the fundamental characteristics of threat sources. The identified characteristics are mainly based on the outcomes of the detailed research by [PERSON] et al. [62], which describes a set of attacker profiles based on different dimensions, namely _Knowledge_, _Resources_ and _Psychology_. _Knowledge_ describes the level of expertise, related to cyber skills (e.g., attack methods, attack patterns) and of understanding of the exploitable vulnerability that is under attack. The more complex the exploitation of a vulnerability, the more expertise the threat source needs to have, thus \(W_{\text{KN}}\) should be greater. The higher the level of _Knowledge_ determined by the assessors, the greater the level of \(X_{\text{KN}}\). _Resources_ describe the level of: (i) manpower, indicating whether the threat source acts alone, in small or larger groups; (ii) tools/ability, indicating whether the threat source has access to the means necessary for the attack; and (iii) financial support, indicating the budget available to the threat source. A cyber-physical attack scenario that requires access to manpower, tools and financial support should be assigned a high importance index (\(W_{\text{RE}}\)). Assessors should determine at what level a threat source has manpower, tools/ability and financial support to assign a level to \(X_{\text{RE}}\). _Psychology_ describes the motivation of the threat source. Motivation indicates the motives (e.g., ideology, religious) that drive the threat source to accomplish their goal and affect the effort put in the performed attack. A cyber-physical attack scenario that requires strong motives and effort to be accomplished, should be assigned a greater \(\text{W}_{\text{PS}}\) importance index. Assessors should determine the level motivation of the threat source to assign a score to \(\text{X}_{\text{PS}}\). However, all the aforementioned characteristics described originate from cyber-attacks. In this risk assessment approach, _Terrorism experience_ originating from the physical space is also considered. This characteristic has not been considered in previous work. Critical transportation infrastructure has always been an appealing target due its value to terrorist organizations [63]. However, a significant number of remote cyber-attacks have been conducted against critical infrastructure by terrorist organizations, indicating an expansion of malicious activities to cyber space [64,65]. The exposure of IoT devices in the sensing area of an IoT enabled transportation infrastructure will offer them new opportunities to impact the physical space by exploiting cyber vulnerability (i.e., cyber-physical attack). Terrorism experience refers to the experience of threat source to remain undetected in public secured areas (e.g., where the IoT based WSN is located) and the ability of the threat source to access valuable information (e.g., sensitive national data) to detect critical targets related to highly exploitable vulnerabilities that can harm the physical transportation infrastructure. A level should be assigned to \(\text{X}_{\text{Te}}\) by the assessors depending on these aforementioned characteristics.