Cyber-Physical Systems Security—A Survey <s> C. CPS Models and Aspects <s> We're about to acquire a significant new cyber- vulnerability. The world's energy utilities are starting to install hundreds of millions of 'smart meters' which contain a remote off switch. Its main purpose is to ensure that customers who default on their payments can be switched remotely to a prepay tariff; secondary purposes include supporting interruptible tariffs and implementing rolling power cuts at times of supply shortage. The off switch creates information security problems of a kind, and on a scale, that the energy companies have not had to face before. From the viewpoint of a cyber attacker - whether a hostile government agency, a terrorist organisation or even a militant environmental group - the ideal attack on a target country is to interrupt its citizens' electricity supply. This is the cyber equivalent of a nuclear strike; when electricity stops, then pretty soon everything else does too. Until now, the only plausible ways to do that involved attacks on critical generation, transmission and distribution assets, which are increasingly well defended. Smart meters change the game. The combination of commands that will cause meters to interrupt the supply, of applets and software upgrades that run in the meters, and of cryptographic keys that are used to authenticate these commands and software changes, create a new strategic vulnerability, which we discuss in this paper. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> C. CPS Models and Aspects <s> We present a generic yet practical framework for assessing security risks to cyber-physical systems (CPSs). Our framework can be used to benchmark security risks when information is less than perfect, and interdependencies of physical and computational components may result in correlated failures. Such environments are prone to externalities, and can cause huge societal losses. We focus on the risks that arise from interdependent reliability failures (faults) and security failures (attacks). We advocate that a sound assessment of these risks requires explicit modeling of the effects of both technology-based defenses and institutions necessary for supporting them. Thus, we consider technology-based security defenses grounded in information security tools and fault-tolerant control in conjunction with institutional structures. Our game-theoretic approach to estimating security risks facilitates more effective defenses, especially against correlated failures. <s> BIB002
A CPS component might have the ability to communicate with control centers or other CPS components. This same component could also contain a sensor, an actuator, or both to connect to the physical world. Each one of these capabilities has different security implications that may result from the interactions of the component's parts and their capabilities. For example, a CPS component's communication and computational functions are not expected to affect the physical world, and yet might be exploited to cause unexpected behaviors with physical consequences. Similarly, the physical properties of this component, in addition to the physical properties of the object of interest in the physical world that the CPS controls and monitors, can also cause unexpected attacks that might result in nonphysical consequences such as misleading information sent to the network. This heterogeneity of CPS, among components, or within a component itself, results in a lack of understanding of new types of security threats that would exploit such heterogeneity. The need to clearly distinguish between such aspects for security analysis arises. Thus, we propose to view any CPS from three aspects: 1) cyber; 2) cyber-physical; and 3) physical. The physical aspect includes components that directly interact with the physical world, such as sensors and actuators. Their properties might have security/safety-related issues. The cyber and cyber-physical aspects include anything that does not directly interact with the physical world, e.g., computations, communication processes, and monitoring activities. The two aspects share some features but the key difference lays in how they interact with the physical components. In our CPS model, cyber components do not interact directly with the physical components, whereas cyber-physical components do. Such seemingly subtle difference helps in CPS security analysis. In other words, the cyber-physical aspect is where the cyber and physical worlds can connect. In Fig. 3 , we incorporated the aforementioned CPS view in the annotated figure shown in Fig. 2 . In Fig. 3, (1) indicates aspects that we consider cyber, whereas (2) denotes cyberphysical aspects. Note the dashed line separating (1) and BIB002 shows how the same component can be considered cyber and cyber-physical at the same time depending on the presence or absence of the interaction with the physical world. BIB001 shows that the physical properties of any part of a CPS system could play a role in security issues. Therefore, we need to include them in the physical aspect. In the following paragraphs, we present how our abstract model can capture the CPS aspects in the representative applications. For each application, we show a figure annotated with the CPS aspects: 1) cyber; 2) cyber-physical; and 3) physical. Fig. 4 depicts the CPS aspects in a PLC scenario, where it is used for controlling the temperature in a chemical plant. The goal is to maintain the temperature within a certain range. If the temperature exceeds a specified threshold, the PLC is notified via a wireless sensor attached to the tank, which in turn, notifies the control center of the undesired temperature change. Alternatively, in closed-loop settings, the PLC could turn the cooling system on to reduce that tank's temperature within the desired range.