  Identifying, analyzing, and evaluating cybersecurity risks are essential to
assess the vulnerabilities of modern manufacturing infrastructures and to
devise effective decision-making strategies to secure critical manufacturing
against potential cyberattacks. In response, this work proposes a
graph-theoretic approach for risk modeling and assessment to address the lack
of quantitative cybersecurity risk assessment frameworks for smart
manufacturing systems. In doing so, first, threat attributes are represented
using an attack graphical model derived from manufacturing cyberattack
taxonomies. Attack taxonomies offer consistent structures to categorize threat
attributes, and the graphical approach helps model their interdependence.
Second, the graphs are analyzed to explore how threat events can propagate
through the manufacturing value chain and identify the manufacturing assets
that threat actors can access and compromise during a threat event. Third, the
proposed method identifies the attack path that maximizes the likelihood of
success and minimizes the attack detection probability, and then computes the
associated cybersecurity risk. Finally, the proposed risk modeling and
assessment framework is demonstrated via an interconnected smart manufacturing
system illustrative example. Using the proposed approach, practitioners can
identify critical connections and manufacturing assets requiring prioritized
security controls and develop and deploy appropriate defense measures
accordingly.
