Evaluation of a Cyber Risk Assessment Approach for Cyber–Physical Systems: Maritime- and Energy-Use Cases

In various domains such as energy, manufacturing, and maritime, cyber–physical systems (CPSs) have seen increased interest. Both academia industry focused on the cybersecurity aspects of systems. The assessment cyber risks in a CPS is popular research area with many existing approaches that aim to suggest relevant methods practices. However, few works addressed extensive objective evaluation proposed approaches. this paper, standard-aligned methodology presented empirically conducted evaluate newly risk approach for CPSs. approach, which called FMECA-ATT&CK based failure mode, effects criticality analysis (FMECA) process enriched semantics encoded knowledge Adversarial Tactics, Techniques, Common Knowledge framework (ATT&CK). Several experts were involved conducting two processes, Bow-Tie, against use cases different application domains, particularly an autonomous passenger ship (APS) maritime-use case digital substation energy-use case. This allows group characteristics, namely, applicability, feasibility, accuracy, comprehensiveness, adaptability, scalability, usability. results highlight positive utility model-based, design-level, component-level CPSs several identified directions improvements. Moreover, method characteristics been demonstrated enablers thorough methods.