The specific risk considerations imparted by cyber-physical systems

Abstract

Cyber-physical systems, as found in power plants, factories, or hospitals, include industrial control systems, medical devices, or IoT devices. Because of their unique use case, as well as design and maintenance restraints, they require specific cybersecurity and risk considerations. We need to be aware of the generally lower security posture, higher impact potential, and difficult and complex recovery associated with them. On a side note, as of recently, we also need to be concerned about the reverse scenario (i.e., physical attacks targeting IT infrastructure). For example, the discussion and political controversy about Huawei 5G wireless infrastructure is, in a sense, about the risk of physical devices affecting our information-dependent economy. The risks to data confidentiality could be mitigated, but the risks to availability and integrity are much more difficult to assess and mitigate.15 Another example of a kinetic attack on cyber infrastructure was the recent event of Israel's defense forces bombing a building in Gaza because it was suspected to be the base of a Hamas hacking group that had attacked Israel.16 We also need to be aware that cyber incidents are seldom limited to individual devices; instead, they tend to affect other, integrated systems, the immediate environment, or even the larger infrastructure. The harm potential includes severe physical harm, as well as larger economic and/or social impact.