Threat modeling in cyber-physical systems

To design a secure system we need to understand its possible threats; more specifically we need to understand how the components of the architecture are compromised and used by an attacker in order to fulfill his objectives and how the attack proceeds through these units. We can do this using misuse patterns, an artifact we have introduced in earlier work. Threat modeling of IT systems has been widely explored but there is no much work on cyber-physical system (CPS) threats. CPSs are complex and heterogeneous systems and have many vulnerabilities. We discuss here how to extend misuse patterns to describe CPS threats and how to enumerate and unify CPS threats. This approach can be valuable to complement methodologies to build secure CPSs. We show our ideas through a metamodel and an example.