Cyber-Physical Systems Security—A Survey <s> A. Cyber-Physical Systems <s> Global electrical grids are verging on the largest technological transformation since the introduction of electricity into the home. The antiquated infrastructure that delivers power to our homes and businesses is being replaced with a collection of digital systems called the smart grid. This grid is the modernization of the existing electrical system that enhances customers' and utilities' ability to monitor, control, and predict energy use. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber-Physical Systems <s> In the last years there has been an increasing interest in the security of process control and SCADA systems. Furthermore, recent computer attacks such as the Stuxnet worm, have shown there are parties with the motivation and resources to effectively attack control systems. While previous work has proposed new security mechanisms for control systems, few of them have explored new and fundamentally different research problems for securing control systems when compared to securing traditional information technology (IT) systems. In particular, the sophistication of new malware attacking control systems--malware including zero-days attacks, rootkits created for control systems, and software signed by trusted certificate authorities--has shown that it is very difficult to prevent and detect these attacks based solely on IT system information. In this paper we show how, by incorporating knowledge of the physical system under control, we are able to detect computer attacks that change the behavior of the targeted control system. By using knowledge of the physical system we are able to focus on the final objective of the attack, and not on the particular mechanisms of how vulnerabilities are exploited, and how the attack is hidden. We analyze the security and safety of our mechanisms by exploring the effects of stealthy attacks, and by ensuring that automatic attack-response mechanisms will not drive the system to an unsafe state. A secondary goal of this paper is to initiate the discussion between control and security practitioners--two areas that have had little interaction in the past. We believe that control engineers can leverage security engineering to design--based on a combination of their best practices--control algorithms that go beyond safety and fault tolerance, and include considerations to survive targeted attacks. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber-Physical Systems <s> The development of a trustworthy smart grid requires a deeper understanding of potential impacts resulting from successful cyber attacks. Estimating feasible attack impact requires an evaluation of the grid's dependency on its cyber infrastructure and its ability to tolerate potential failures. A further exploration of the cyber-physical relationships within the smart grid and a specific review of possible attack vectors is necessary to determine the adequacy of cybersecurity efforts. This paper highlights the significance of cyber infrastructure security in conjunction with power application security to prevent, mitigate, and tolerate cyber attacks. A layered approach is introduced to evaluating risk based on the security of both the physical power applications and the supporting cyber infrastructure. A classification is presented to highlight dependencies between the cyber-physical controls required to support the smart grid and the communication and computations that must be protected from cyber attack. The paper then presents current research efforts aimed at enhancing the smart grid's application and infrastructure security. Finally, current challenges are identified to facilitate future research efforts. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber-Physical Systems <s> The most visible use of computers and software is processing information for human consumption. The vast majority of computers in use, however, are much less visible. They run the engine, brakes, seatbelts, airbag, and audio system in your car. They digitally encode your voice and construct a radio signal to send it from your cell phone to a base station. They command robots on a factory floor, power generation in a power plant, processes in a chemical plant, and traffic lights in a city. These less visible computers are called embedded systems, and the software they run is called embedded software. The principal challenges in designing and analyzing embedded systems stem from their interaction with physical processes. This book takes a cyber-physical approach to embedded systems, introducing the engineering concepts underlying embedded systems as a technology and as a subject of study. The focus is on modeling, design, and analysis of cyber-physical systems, which integrate computation, networking, and physical processes. The second edition offers two new chapters, several new exercises, and other improvements. The book can be used as a textbook at the advanced undergraduate or introductory graduate level and as a professional reference for practicing engineers and computer scientists. Readers should have some familiarity with machine structures, computer programming, basic discrete mathematics and algorithms, and signals and systems. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber-Physical Systems <s> Balancing security, privacy, safety, and utility is a necessity in the health care domain, in which implantable medical devices (IMDs) and body area networks (BANs) have made it possible to continuously and automatically manage and treat a number of health conditions. In this work, we survey publications aimed at improving security and privacy in IMDs and health-related BANs, providing clear definitions and a comprehensive overview of the problem space. We analyze common themes, categorize relevant results, and identify trends and directions for future research. We present a visual illustration of this analysis that shows the progression of IMD/BAN research and highlights emerging threats. We identify three broad research categories aimed at ensuring the security and privacy of the telemetry interface, software, and sensor interface layers and discuss challenges researchers face with respect to ensuring reproducibility of results. We find that while the security of the telemetry interface has received much attention in academia, the threat of software exploitation and the sensor interface layer deserve further attention. In addition, we observe that while the use of physiological values as a source of entropy for cryptographic keys holds some promise, a more rigorous assessment of the security and practicality of these schemes is required. <s> BIB005
While there does not exist a unanimously accepted and authoritative definition of CPS, we can simply say that CPS are systems used to monitor and control the physical world. They are perceived as the new generation of embedded control systems, such that CPS are networked embedded systems. In addition, systems, where sensor and actuator networks are embedded, are also considered CPS BIB002 . Because of the reliance on IT systems, CPS could be defined as IT systems that are integrated into physical world application  . This integration is a result of the advancements in the information and communication technologies (ICTs) to enhance interactions with physical processes. These definitions highlight the heavy presence of the interactions between the cyber and the physical worlds. An increasing dependence on CPS is growing in various applications such as energy, transportation, military, healthcare, and manufacturing. CPS can be called different names, depending on the application using them. For example, a very important and representative CPS is the supervisory control and data acquisition (SCADA) system, which is used in CI such as the smart grid and ICSs. Other examples have emerged in medical devices such as wearable and implantable medical devices (IMDs). In addition, a network of small control systems is embedded in modern cars to improve fuel efficiency, safety, and convenience. Here we introduce briefly four representative applications of CPS that we will cover throughout this paper. 1) Industrial Control Systems: ICS refers to control systems used to enhance the control, monitoring, and production in different industries such as the nuclear plants, water and sewage systems, and irrigation systems. Sometimes ICS is called SCADA or distributed control systems. For consistency, we will use the term ICS hereafter. In ICS, different controllers with different capabilities collaborate to achieve numerous expected goals. A popular controller is the programmable logic controller (PLC), which is a microprocessor designed to operate continuously in hostile environments BIB004 . This field device is connected to the physical world through sensors and actuators. Usually, it is equipped with wireless and wired communication capacity that is configured depending on the surrounding environments. It can also be connected to PC systems in a control center that monitors and controls the operations. 2) Smart Grid Systems: The smart grid is envisioned as the next generation of the power grid that has been used for decades for electricity generation, transmission, and distribution. The smart grid provides several benefits and advanced functionalities. At the national level, it provides enhanced emission control, global load balancing, smart generation, and energy savings. Whereas at the local level, it allows home consumers better control over their energy use that would be beneficial economically and environmentally BIB001 . The smart grid is comprised of two major components: 1) power application and 2) supporting infrastructure BIB003 . The power application is where the core functions of the smart grid are provided, i.e., electricity generation, transmission, and distribution. Whereas the supporting infrastructure is the intelligent component that is mainly concerned with controlling and monitoring the core operations of the smart grid using a set of software, hardware, and communication networks. 3) Medical Devices: Medical devices have been improved by integrating cyber and physical capabilities to deliver better health care services. We are more interested in medical devices with cyber capabilities that have physical impact on patients. Such devices are either implanted inside the patient's body, called IMDs, or worn by patients, called wearable devices. They are usually equipped with wireless capabilities to allow communication with other devices such as the programmer, which is needed for updating and reconfiguring the devices. Wearable devices communicate with each other or with other devices, such as a remote physician or smartphone BIB005 . 4) Smart Cars: Smart cars (intelligent cars) are cars that are more environment-friendly, fuel-efficient, safe, and have enhanced entertainment and convenience features. These advancements are made possible by the reliance on a range of 50-70 computers networked together, called electronic control units (ECUs). ECUs are responsible for monitoring and controlling various functions such as engine emission control, brake control, entertainment (radio and multimedia players) and comfort features (cruise control and windows opening and closing).