  Cyber-physical systems, especially in critical infrastructures, have become
primary hacking targets in international conflicts and diplomacy. However,
cyber-physical systems present unique challenges to defenders, starting with an
inability to communicate. This paper outlines the results of our interviews
with information technology (IT) defenders and operational technology (OT)
operators and seeks to address lessons learned from them in the structure of
our notional solutions. We present two problems in this paper: (1) the
difficulty of coordinating detection and response between defenders who work on
the cyber/IT and physical/OT sides of cyber-physical infrastructures, and (2)
the difficulty of estimating the safety state of a cyber-physical system while
an intrusion is underway but before damage can be effected by the attacker. To
meet these challenges, we propose two solutions: (1) a visualization that will
enable communication between IT defenders and OT operators, and (2) a
machine-learning approach that will estimate the distance from normal the
physical system is operating and send information to the visualization.
