  Over the last years, Industrial Control Systems (ICS) have become
increasingly exposed to a wide range of cyber-physical threats. Efficient
models and techniques able to capture their complex structure and identify
critical cyber-physical components are therefore essential. AND/OR graphs have
proven very useful in this context as they are able to semantically grasp
intricate logical interdependencies among ICS components. However, identifying
critical nodes in AND/OR graphs is an NP-complete problem. In addition, ICS
settings normally involve various cyber and physical security measures that
simultaneously protect multiple ICS components in overlapping manners, which
makes this problem even harder. In this paper, we present an extended security
metric based on AND/OR hypergraphs which efficiently identifies the set of
critical ICS components and security measures that should be compromised, with
minimum cost (effort) for an attacker, in order to disrupt the operation of
vital ICS assets. Our approach relies on MAX-SAT techniques, which we have
incorporated in META4ICS, a Java-based security metric analyser for ICS. We
also provide a thorough performance evaluation that shows the feasibility of
our method. Finally, we illustrate our methodology through a case study in
which we analyse the security posture of a realistic Water Transport Network
(WTN).
