{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T15:30:02Z","timestamp":1786980602576,"version":"build-2736575974"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T00:00:00Z","timestamp":1661126400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T00:00:00Z","timestamp":1661126400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Research council of Norway","award":["280617"],"award-info":[{"award-number":["280617"]}]},{"name":"Norwegian centre for cybersecurity in critical sectors","award":["310105"],"award-info":[{"award-number":["310105"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2023,6]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>A cyber-physical attack is a security breach in cyber space that impacts on the physical environment. The number and diversity of such attacks against Cyber-Physical Systems (CPSs) are increasing at impressive rates. In times of Industry 4.0 and Cyber-Physical Systems, providing security against cyber-physical attacks is a serious challenge which calls for cybersecurity risk assessment methods capable of investigating the tight interactions and interdependencies between the cyber and the physical components in such systems. However, existing risk assessment methods do not consider this specific characteristic of CPSs. In this paper, we propose a dependency-based, domain-agnostic cybersecurity risk assessment method that leverages a model of the CPS under study that captures dependencies among the system components. The proposed method identifies possible attack paths against critical components of a CPS by taking an attacker\u2019s viewpoint and prioritizes these paths according to their risk to materialize, thus allowing the defenders to define efficient security controls. We illustrate the workings of the proposed method by applying it to a case study of a CPS in the energy domain, and we highlight the advantages that the proposed method offers when used to assess cybersecurity risks in CPSs.<\/jats:p>","DOI":"10.1007\/s10207-022-00608-4","type":"journal-article","created":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T02:03:01Z","timestamp":1661133781000},"page":"563-578","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":28,"title":["Dependency-based security risk assessment for cyber-physical systems"],"prefix":"10.1007","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3142-1583","authenticated-orcid":false,"given":"Aida","family":"Akbarzadeh","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sokratis K.","family":"Katsikas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,8,22]]},"reference":[{"issue":"3\u20134","key":"608_CR1","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1016\/j.ijcip.2012.08.003","volume":"5","author":"C Alcaraz","year":"2012","unstructured":"Alcaraz, C., Lopez, J.: Analysis of requirements for critical control systems. Int. J. Crit. Infrastruct. Prot. 5(3\u20134), 137\u2013145 (2012)","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"608_CR2","unstructured":"Abrams, M., Weiss, J.: Malicious control system cyber security attack case study-Maroochy water services, Australia. Tech. Rep, Mitre Corp McLean VA McLean (2008)"},{"issue":"4","key":"608_CR3","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1109\/MC.2011.115","volume":"44","author":"TM Chen","year":"2011","unstructured":"Chen, T.M., Abu-Nimeh, S.: Lessons from stuxnet. Computer 44(4), 91\u201393 (2011)","journal-title":"Computer"},{"key":"608_CR4","doi-asserted-by":"publisher","first-page":"99 905","DOI":"10.1109\/ACCESS.2021.3095713","volume":"9","author":"H.\u00a0H Addeen","year":"2021","unstructured":"Addeen, H..\u00a0H., Xiao, Y., Li, J., Guizani, M.: A survey of cyber-physical attacks and detection methods in smart water distribution systems. IEEE Access 9, 99 905-99 921 (2021)","journal-title":"IEEE Access"},{"key":"608_CR5","doi-asserted-by":"crossref","unstructured":"Castellanos, J.\u00a0H., Ochoa, M., Zhou, J.: Finding dependencies between cyber-physical domains for security testing of industrial control systems. In: Proceedings of the 34th Annual Computer Security Applications Conference, pp. 582\u2013594 (2018)","DOI":"10.1145\/3274694.3274745"},{"issue":"12","key":"608_CR6","doi-asserted-by":"publisher","first-page":"1431","DOI":"10.1002\/cpe.1679","volume":"23","author":"C Alcaraz","year":"2011","unstructured":"Alcaraz, C., Lopez, J., Zhou, J., Roman, R.: Secure SCADA framework for the protection of energy control systems. Concurr. Comput. Pract. Exp. 23(12), 1431\u20131442 (2011)","journal-title":"Concurr. Comput. Pract. Exp."},{"key":"608_CR7","doi-asserted-by":"crossref","unstructured":"Stellios, I., Kotzanikolaou, P., Psarakis, M., Alcaraz, C.: Risk assessment for IoT-enabled cyber-physical systems. In: Advances in Core Computer Science-Based Technologies, pp. 157\u2013173. Springer (2021)","DOI":"10.1007\/978-3-030-41196-1_8"},{"key":"608_CR8","unstructured":"Power systems management and associated information exchange\u2014data and communications security\u2014Part 1: Communication network and system security\u2014Introduction to security issues. International Electrotechnical Commission, Geneva, CH, Standard, May (2007)"},{"issue":"9","key":"608_CR9","first-page":"834","volume":"11","author":"L Wang","year":"2016","unstructured":"Wang, L., Qu, Z., Li, Z.: The design and implementation of attack path extraction model in power cyber physical system. J. Commun. 11(9), 834\u2013840 (2016)","journal-title":"J. Commun."},{"key":"608_CR10","doi-asserted-by":"crossref","unstructured":"Chen, Y., Boehm, B., Sheppard, L.: Value driven security threat modeling based on attack path analysis. In: 2007 40th Annual Hawaii International Conference on System Sciences (HICSS\u201907), p. 280a. IEEE (2007)","DOI":"10.1109\/HICSS.2007.601"},{"key":"608_CR11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-25808-5","volume-title":"Safe and Secure Cyber-Physical Systems and Internet-of-Things Systems","author":"M Wolf","year":"2020","unstructured":"Wolf, M., Serpanos, D.N.: Safe and Secure Cyber-Physical Systems and Internet-of-Things Systems. Springer, Berlin (2020)"},{"key":"608_CR12","doi-asserted-by":"crossref","unstructured":"Koscher, K., Savage, S., Roesner, F., Patel, S., Kohno, T., Czeskis, A., McCoy, D., Kantor, B., Anderson, D., Shacham, H.: Experimental security analysis of a modern automobile. In: 2010 IEEE Symposium on Security and Privacy, pp. 447\u2013462. IEEE Computer Society (2010)","DOI":"10.1109\/SP.2010.34"},{"key":"608_CR13","doi-asserted-by":"crossref","unstructured":"Yampolskiy, M., Horvath, P., Koutsoukos, X. D., Xue, Y., Sztipanovits, J., Systematic analysis of cyber-attacks on CPS-evaluating applicability of DFD-based approach. In: 2012 5th International Symposium on Resilient Control Systems, pp. 55\u201362. IEEE (2012)","DOI":"10.1109\/ISRCS.2012.6309293"},{"key":"608_CR14","unstructured":"Shakarian, P.: Stuxnet: Cyberwar Revolution in Military Affairs. Technical Reports, Military Academy West Point NY (2011)"},{"key":"608_CR15","volume-title":"Information Technology Risk Management in Enterprise Environments","author":"J Kouns","year":"2010","unstructured":"Kouns, J., Minoli, D.: Information Technology Risk Management in Enterprise Environments. Wiley, Hoboken (2010)"},{"key":"608_CR16","first-page":"11","volume-title":"Risk Management for CPS Security","author":"S Ali","year":"2018","unstructured":"Ali, S., Al\u00a0Balushi, T., Nadir, Z., Hussain, O.: Risk Management for CPS Security, pp. 11\u201334. Springer International Publishing AG, Cham (2018)"},{"issue":"2","key":"608_CR17","doi-asserted-by":"publisher","first-page":"163","DOI":"10.1007\/s00766-013-0195-2","volume":"20","author":"R Scandariato","year":"2015","unstructured":"Scandariato, R., Wuyts, K., Joosen, W.: A descriptive study of Microsoft\u2019s threat modeling technique. Requir. Eng. 20(2), 163\u2013180 (2015)","journal-title":"Requir. Eng."},{"key":"608_CR18","unstructured":"Freund, J., Jones, J.: Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann (2014)"},{"key":"608_CR19","unstructured":"Dorofee, C.\u00a0A.\u00a0A.: Managing Information Security Risks: The Octave (SM) Approach (2002)"},{"key":"608_CR20","unstructured":"Shevchenko, N., Frye, B.\u00a0R., Woody, C.: Threat modeling for cyber-physical system-of-systems: methods evaluation. In: Carnegie Mellon University Software Engineering Institute Pittsburgh United..., Technical Reports (2018)"},{"issue":"4","key":"608_CR21","doi-asserted-by":"publisher","first-page":"65","DOI":"10.3390\/fi12040065","volume":"12","author":"G Kavallieratos","year":"2020","unstructured":"Kavallieratos, G., Katsikas, S., Gkioulos, V.: Cybersecurity and safety co-engineering of cyberphysical systems-a comprehensive survey. Future Internet 12(4), 65 (2020)","journal-title":"Future Internet"},{"issue":"2","key":"608_CR22","doi-asserted-by":"publisher","first-page":"92","DOI":"10.1080\/23335777.2019.1600035","volume":"5","author":"V Lamba","year":"2019","unstructured":"Lamba, V., \u0160imkov\u00e1, N., Rossi, B.: Recommendations for smart grid security risk management. Cyber-Phys. Syst. 5(2), 92\u2013118 (2019)","journal-title":"Cyber-Phys. Syst."},{"key":"608_CR23","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13635-020-0101-7","volume":"2020","author":"K Kandasamy","year":"2020","unstructured":"Kandasamy, K., Srinivas, S., Achuthan, K., Rangan, V.P.: IoT cyber risk: a holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process. EURASIP J. Inf. Secur. 2020, 1\u201318 (2020)","journal-title":"EURASIP J. Inf. Secur."},{"key":"608_CR24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.cose.2015.09.009","volume":"56","author":"Y Cherdantseva","year":"2016","unstructured":"Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., Stoddart, K.: A review of cyber security risk assessment methods for SCADA systems. Comput. Sec. 56, 1\u201327 (2016)","journal-title":"Comput. Sec."},{"key":"608_CR25","doi-asserted-by":"publisher","first-page":"1288","DOI":"10.1016\/j.procs.2016.04.268","volume":"83","author":"G Macher","year":"2016","unstructured":"Macher, G., Armengaud, E., Brenner, E., Kreiner, C.: Threat and risk assessment methodologies in the automotive domain. Procedia Comput. Sci. 83, 1288\u20131294 (2016)","journal-title":"Procedia Comput. Sci."},{"issue":"3","key":"608_CR26","doi-asserted-by":"publisher","first-page":"221","DOI":"10.1049\/iet-cps.2018.5068","volume":"4","author":"X Lyu","year":"2019","unstructured":"Lyu, X., Ding, Y., Yang, S.-H.: Safety and security risk assessment in cyber-physical systems. IET Cyber Phys. Syst. Theory Appl. 4(3), 221\u2013232 (2019)","journal-title":"IET Cyber Phys. Syst. Theory Appl."},{"key":"608_CR27","doi-asserted-by":"crossref","unstructured":"Homer, J., Varikuti, A., Ou, X., McQueen, M.\u00a0A.: Improving attack graph visualization through data reduction and attack grouping. In: International Workshop on Visualization for Computer Security, pp. 68\u201379. Springer (2008)","DOI":"10.1007\/978-3-540-85933-8_7"},{"issue":"3","key":"608_CR28","doi-asserted-by":"publisher","first-page":"650","DOI":"10.1109\/TII.2015.2420951","volume":"11","author":"S Pan","year":"2015","unstructured":"Pan, S., Morris, T., Adhikari, U.: Classification of disturbances and cyber-attacks in power systems using heterogeneous time-synchronized data. IEEE Trans. Industr. Inf. 11(3), 650\u2013662 (2015)","journal-title":"IEEE Trans. Industr. Inf."},{"key":"608_CR29","doi-asserted-by":"crossref","unstructured":"Krotofil, M., Kursawe, K., Gollmann, D.: Securing industrial control systems. In: Security and Privacy Trends in the Industrial Internet of Things, pp 3\u201327. Springer (2019)","DOI":"10.1007\/978-3-030-12330-7_1"},{"key":"608_CR30","unstructured":"Skopik, F., Smith, P.\u00a0D.: Smart grid security: Innovative solutions for a modernized grid. Syngress (2015)"},{"issue":"4\u20135","key":"608_CR31","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.physrep.2005.10.009","volume":"424","author":"S Boccaletti","year":"2006","unstructured":"Boccaletti, S., Latora, V., Moreno, Y., Chavez, M., Hwang, D.-U.: Complex networks: structure and dynamics. Phys. Rep. 424(4\u20135), 175\u2013308 (2006)","journal-title":"Phys. Rep."},{"key":"608_CR32","doi-asserted-by":"crossref","unstructured":"Akbarzadeh, A., Pandey, P., Katsikas, S.: Cyber-physical interdependencies in power plant systems: a review of cyber security risks. In: 2019 IEEE Conference on Information and Communication Technology, pp 1\u20136. IEEE (2019)","DOI":"10.1109\/CICT48419.2019.9066188"},{"key":"608_CR33","doi-asserted-by":"crossref","unstructured":"Akbarzadeh, A., Katsikas, S.: Identifying critical components in large scale cyber physical systems. In: Proceedings of the IEEE\/ACM 42nd International Conference on Software Engineering Workshops, pp. 230\u2013236 (2020)","DOI":"10.1145\/3387940.3391473"},{"key":"608_CR34","doi-asserted-by":"crossref","unstructured":"Bernsmed, K., Fr\u00f8ystad, C., Meland, P.\u00a0H., Nesheim, D.\u00a0A., R\u00f8dseth, \u00d8.\u00a0J.: Visualizing cyber security risks with bow-tie diagrams. In: International Workshop on Graphical Models for Security, pp. 38\u201356. Springer (2017)","DOI":"10.1007\/978-3-319-74860-3_3"},{"issue":"1\u20132","key":"608_CR35","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1504\/IJCIS.2013.051606","volume":"9","author":"P Kotzanikolaou","year":"2013","unstructured":"Kotzanikolaou, P., Theoharidou, M., Gritzalis, D.: Assessing n-order dependencies between critical infrastructures. Int. J. Crit. Infrastruct. 6 9(1\u20132), 93\u2013110 (2013)","journal-title":"Int. J. Crit. Infrastruct. 6"},{"issue":"5","key":"608_CR36","doi-asserted-by":"publisher","first-page":"1685","DOI":"10.3390\/s21051685","volume":"21","author":"A Akbarzadeh","year":"2021","unstructured":"Akbarzadeh, A., Katsikas, S.: Identifying and analyzing dependencies in and among complex cyber physical systems. Sensors 21(5), 1685 (2021)","journal-title":"Sensors"},{"key":"608_CR37","unstructured":"FIRST: Common vulnerability scoring system v3.1: User guide. https:\/\/www.first.org\/cvss\/v3.1\/user-guide (2019)"},{"key":"608_CR38","doi-asserted-by":"crossref","unstructured":"Zeller, M.: Myth or reality-does the aurora vulnerability pose a risk to my generator? In: 2011 64th Annual Conference for Protective Relay Engineers, pp. 130\u2013136. IEEE (2011)","DOI":"10.1109\/CPRE.2011.6035612"},{"key":"608_CR39","doi-asserted-by":"crossref","unstructured":"Zinsmaier, S., Langweg, H., Waldvogel, M.: A practical approach to stakeholder-driven determination of security requirements based on the GDPR and common criteria. In: 6th International Conference on Information Systems Security and Privacy, pp. 473\u2013480 (2020)","DOI":"10.5220\/0008960604730480"},{"issue":"82","key":"608_CR40","first-page":"16","volume":"800","author":"K Stouffer","year":"2011","unstructured":"Stouffer, K., Falco, J., Scarfone, K., et al.: Guide to industrial control systems (ICS) security. NIST Spec. Publ. 800(82), 16 (2011)","journal-title":"NIST Spec. Publ."},{"issue":"7","key":"608_CR41","doi-asserted-by":"publisher","first-page":"4332","DOI":"10.1109\/TII.2018.2884728","volume":"15","author":"J Hong","year":"2018","unstructured":"Hong, J., Nuqui, R.F., Kondabathini, A., Ishchenko, D., Martin, A.: Cyber attack resilient distance protection and circuit breaker control for digital substations. IEEE Trans. Industr. Inf. 15(7), 4332\u20134341 (2018)","journal-title":"IEEE Trans. Industr. Inf."},{"key":"608_CR42","doi-asserted-by":"crossref","unstructured":"Hong, J.\u00a0B., Kim, D.\u00a0S.: Performance analysis of scalable attack representation models. In: IFIP International Information Security Conference, pp. 330\u2013343. Springer (2013)","DOI":"10.1007\/978-3-642-39218-4_25"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-022-00608-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-022-00608-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-022-00608-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,5,25]],"date-time":"2023-05-25T21:14:50Z","timestamp":1685049290000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-022-00608-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,22]]},"references-count":42,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,6]]}},"alternative-id":["608"],"URL":"https:\/\/doi.org\/10.1007\/s10207-022-00608-4","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,8,22]]},"assertion":[{"value":"22 August 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with human participants performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}}]}}