Toward Grading Cybersecurity & Resilience Posture for Cyber Physical Systems

Cyber Physical Systems (CPS) present a large, tempting attack surface for malicious actors. We propose a manageable and directly-applicable approach for grading the cyber resilience of these systems through a system lens. These metrics are designed to aid policymakers in clearly understanding the trade-offs in the development of more secure and resilient CPSs. We begin by surveying the current landscape to manage cyber risks in CPSs and evaluate how grading systems will help alleviate risks. Next, we propose a qualitative set of cyber resilience metrics that combine together to allow to qualitatively evaluate a system's cyber resilience. Finally, we characterize the socio-economic benefits of such CPS grading, how it can be integrated into the current policy landscape, and propose policy guidelines and initiatives required by regulators and industries to incorporate and enforce such metrics.