  As the Industrial Internet of Things (IIot) becomes more prevalent in
critical application domains, ensuring security and resilience in the face of
cyber-attacks is becoming an issue of paramount importance. Cyber-attacks
against critical infrastructures, for example, against smart water-distribution
and transportation systems, pose serious threats to public health and safety.
Owing to the severity of these threats, a variety of security techniques are
available. However, no single technique can address the whole spectrum of
cyber-attacks that may be launched by a determined and resourceful attacker. In
light of this, we consider a multi-pronged approach for designing secure and
resilient IIoT systems, which integrates redundancy, diversity, and hardening
techniques. We introduce a framework for quantifying cyber-security risks and
optimizing IIoT design by determining security investments in redundancy,
diversity, and hardening. To demonstrate the applicability of our framework, we
present two case studies in water distribution and transportation a case study
in water-distribution systems. Our numerical evaluation shows that integrating
redundancy, diversity, and hardening can lead to reduced security risk at the
same cost.
