  Cyber-physical systems (CPS) are at the intersection of digital technology
and engineering domains, rendering them high-value targets of sophisticated and
well-funded cybersecurity threat actors. Prominent cybersecurity attacks on CPS
have brought attention to the vulnerability of these systems, and the soft
underbelly of critical infrastructure reliant on CPS. Security modelling for
CPS is an important mechanism to systematically identify and assess
vulnerabilities, threats, and risks throughout system lifecycles, and to
ultimately ensure system resilience, safety, and reliability. This literature
review delves into state-of-the-art research in CPS security modelling,
encompassing both threat and attack modelling. While these terms are sometimes
used interchangeably, they are different concepts. This article elaborates on
the differences between threat and attack modelling, examining their
implications for CPS security. A systematic search yielded 428 articles, from
which 15 were selected and categorised into three clusters: those focused on
threat modelling methods, attack modelling methods, and literature reviews.
Specifically, we sought to examine what security modelling methods exist today,
and how they address real-world cybersecurity threats and CPS-specific attacker
capabilities throughout the lifecycle of CPS, which typically span longer
durations compared to traditional IT systems. This article also highlights
several limitations in existing research, wherein security models adopt
simplistic approaches that do not adequately consider the dynamic, multi-layer,
multi-path, and multi-agent characteristics of real-world cyber-physical
attacks.
