*2.1. Securing Cyber–Physical Systems*

The National Institute of Standards and Technology (NIST) defines cyber-security as "the process of protecting information by preventing, detecting and responding to attacks" [36]. The prevention of attacks against information technology systems is defined in terms of three security goals: confidentiality, integrity and availability, known as the CIA triad. These goals are also applied to CPS to maintain security.

Confidentiality ensures data or system resources "are not disclosed to unauthorised individuals, processes, or devices" [37]. The operation of CPS requires, *inter alia*, data from instrumentation devices, controllers, supervisory control systems, monitoring and safety systems. Unauthorised access to this data is potentially useful for preparing and implementing attacks and for industrial espionage. Integrity deals with "guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity" [38]. Violating integrity could interfere with the operation of CPS and undermine the reliability and safety of the CPS process. Availability deals with "timely, reliable access to data and information services for authorised entities" [39]. Many CPS are continuous systems and loss of availability can cause systems to shut down and interrupt the production process. Usually, integrity and availability are the most important concern for critical cyber–physical systems [40], but the priority given to each of these security goals depends on the risks associated with loss of these properties in the context of a particular system.

Cyber–physical systems have control properties that need to be maintained. These include stability, observability, controllability, safety and efficiency [41], as well as accuracy, responsiveness, rapid disturbance rejection and low control effort. Security attacks aimed at sabotaging CPS involve the manipulation of these properties; thus, the maintenance of these properties, even when the system is under attack, is an essential component of ensuring the security of CPS.

#### *2.2. Attacks against Cyber–Physical Systems*

Figure 2 shows the typical components of a networked CPS. The controller is given a process reference (Setpoint-SP) as the desired process output to maintain. The sensor measures the output of the physical process (Measured Process Value-PV) and sends this over a network to the controller. The controller (for example a PLC) receives these values, compares the PV against the desired SP reference value, calculates a control command (Manipulated Variable-MV) and sends this, through the network, to the actuator. The actuator acts on this command and outputs a physical control action that modifies the process. Attacks against CPS involve attacking components of CPS to achieve either data exfiltration, which involves gathering sensitive information about the CPS, or sabotage, which involves disrupting the process.

Adversaries use a range of tools to carry out attacks against elements of Figure 2. These include attacks that compromise sensors, actuators and controllers to modify their settings or configurations so that incorrect signals are sent to relevant components; for example, incorrect control commands from controller to actuator or incorrect PVs from sensor to controller. Attacks can be carried out against the network: modifying the data in transit (replaying old data, dropping data, injecting false data); denying or delaying the flow of data (e.g., DoS, jamming attacks); or impersonating another actor (for example IP and ARP spoofing and communication hijacking). Eavesdropping attacks against networks can be carried out to gather information related to the operation of CPS, such as identifying communication protocols, open ports, hosts and applications, and sniffing network traffic. Physical attacks can be carried out against CPS components, e.g., to modify the location of devices; change device calibration; install rogue devices on the network; install malware via portable devices (e.g., USB sticks); cause changes in sensor values by manipulating the physical environment of the devices; and cause physical damage to devices.

The success of an attack depends on the resources and skills available to adversaries as well as system vulnerabilities and the absence of appropriate independent layers of protection designed to prevent mal-operation due to operator error, random equipment failure or cyber-attack. Vulnerabilities are typically introduced into CPS due to: poor security design; insecure network communication protocols; insecure backdoors and holes in the virtual or physical network perimeter; insecure software and hardware; poor management of security or ineffective policies and inappropriate physical access [40]. To exploit a CPS, a highly motivated adversary with high skills and resources can purchase zero-day vulnerabilities that are, by definition, not yet public, as seen in the past (e.g., Stuxnet [11]).

**Figure 2.** Typical cyber–physical system.

Adversaries have a wide variety of motivations, and impact goals depend on these motivations. Potential impacts include process disruption; damage to production, equipment, safety and the environment; data disclosure; data loss; disruption to assets; injuries and loss of life; damage to reputation; and financial damage.

#### *2.3. Security Measures for Cyber–Physical Systems*

Security mechanisms to protect systems against malicious behaviour can be divided into three main categories: *preventive*, *reactive* and *responsive* measures. *Preventive* measures are security controls implemented to prevent attacks such as authentication; access control; network segmentation; maintaining confidentiality and integrity of transmitted data and in storage using cryptographic techniques; patching software vulnerabilities; deploying usable and effective security management policies that defines roles and procedures for managing and maintaining security; personnel awareness and training programs to understand threats; and measures for protecting the supply chain [40]. *Reactive* or *detection-based* measures are security controls implemented to identify attacks and anomalous behaviour such as intrusion/anomaly-based monitoring and detection for process and host; antivirus and other malware monitoring tools; and safety management systems. After an attack is detected, *response* strategies include measures to reduce damage; for example, reconfiguring the network; restricting access to network; systems or devices; deploying designed-in redundancies; and shutting down the system.

#### **3. Methodology for Systematic Review**

Our aim in this paper is to review and gain an understanding of cyber-security research targeted at protecting cyber–physical systems in the water sector, thence to identify areas that require future research. The Preferred Reporting Items for Systematic Reviews (PRISMA) [42] guidelines were followed, as illustrated in Figure 3. A set of question research questions were devised to analyse and evaluate the relevant publications. A set of electronic databases and a search strategy was designed to identify the publications. Inclusion and exclusion criteria were used to assess the eligibility of each publication. The eligible publications were then manually inspected to extract relevant evidence for analysis.

**Figure 3.** Systematic literature review process, adapted from [42].

#### *3.1. Research Questions*

To identify, classify and evaluate the existing cyber-security work within water sector, a set of research questions were identified.


countries investing the least and most in research in these areas, and why this could be the case. Security of national infrastructure services such as water often require a joint effort from academia, governmental bodies and industry.

