An approach for assessing the functional vulnerabilities criticality of CPS components

• A method for assessing the vulnerability criticality of CPS components is proposed. • CVSS scores are used for quantitative vulnerability analysis. • BAG is generated based on the CPS structure, considering known vulnerabilities. • PROMETHEE II ranks and identifies the most vulnerable system components. Timely identification of critical security flaws in a cyber-physical system makes identifying risks and potential threats possible. To address this issue, threat models are created to better understand potential vulnerabilities that must be considered to ensure system reliability. Selecting the optimal solution for assessing the functional vulnerabilities criticality of cyber-physical system components is a complex process since all vulnerabilities must be identified, classified, and quantified according to a unified approach as part of the cybersecurity process. An effective tool for cyber-physical systems analysis is the Bayesian attack graph. Each path in the graph represents a sequence of attacks that an attacker can use to achieve a specific goal, such as gaining access to sensitive data or controlling a system. This paper proposes a quantitative method for assessing the vulnerability criticality of cyber-physical system components based on the Promethee II multi-criteria decision-making method. It allows ranking and identification of the system's most vulnerable components. The proposed approach is evaluated using a threat model and three scenarios of cyberattacks on a cyber-physical system. Comparison with TOPSIS, VIKOR, and ELECTRE methods proves the effectiveness of the proposed approach. The proposed approach can help technical specialists make more reasoned decisions when ranking critical vulnerabilities of cyber-physical system components to provide security measures and prevent cyberattacks.