  We address the attack impact evaluation problem for control system security.
We formulate the problem as a Markov decision process with a temporally joint
chance constraint that forces the adversary to avoid being detected throughout
the considered time period. Owing to the joint constraint, the optimal control
policy depends not only on the current state but also on the entire history,
which leads to the explosion of the search space and makes the problem
generally intractable. It is shown that whether an alarm has been triggered or
not, in addition to the current state is sufficient for specifying the optimal
decision at each time step. Augmentation of the information to the state space
induces an equivalent convex optimization problem, which is tractable using
standard solvers.
