The analysis of cyber-physical system wrt. threats and their imposed risk is supported by various analysis methods and activities. Each of them is typically applied in a certain phase of the overall process, however, they are neither limited to a dedicated process nor are they meant to be executed just once. Instead they can be performed in an iterative way.
There are a number of concepts and artifact types used throughout the activities which are quickly introduced and explained in the following table:
Table 1.1: Cybersecurity Concepts
| Concept | Description |
|---|---|
 Vulnerability | Weakness in a cyber-physical system that can
be exploited by one or multiple Attacks.
Vulnerabilities can be systematically identified by doing a "Vulnerability Analysis"
(or "Vulnerability Assessment"). They can be categorized for example in "Physical"
and "Communication". Example: Using already or soon to be deprecated cryptographic algorithms |
 Attack | Attempted and deliberate action or interaction with the system or its
environment that has the potential to result in an adverse consequence. Attacks are
malicious attempts to compromise Assets,
potentially resulting in Threats. Attacks can be
hypothetical or manifested (e.g. known attacks, published in attack knowledge
bases). Example: Abuse of privileges by staff (insider attack) |
 Threat |
Potential cause of an unwanted incident, which may result in a harm to a system or organization, basically wanted or unwanted results of Attacks (to Assets). Harm may include "financial losses" and "operational damages" (e.g. loss of vehicle functionality), and "privacy violation" (to driver, vehicle owner etc.). Example: Data held on back-end servers being lost or compromised ("data breach") |