Metrics for Cyber-Physical Security: a call to action

Cyber-physical systems, by definition, have an effect on assets and people in the real world. Security factors, thus, should play a central role in every decision regarding their deployment and configuration, but this is possible only if said factors are properly defined and can be objectively measured. In this paper, we summarize the state of the art in security metrics, and advocate the need for a research effort aimed at taking the field to a new level of formal soundness and practical usability.