After the International Maritime Organisation introduced the Maritime Cyber Risk Management in Safety Management Systems Resolution in 2017, with the compliance date set for January 2021, the Maritime industry has displayed an increased focus on its cyber-security. This quantitative research, supported by the socio-technical perspective, explores the employee perceptions of cyber-security onboard cruise ships. The results show that the cruise industry has made an attempt to increase its cyber-security by introducing a formal policy and training their employees. Employees, as a consequence, perceive cyber-security to be important. However, employee perceptions are not reflective of their behaviours onboard. This is because there are various technical and organizational obstacles to their cyber-security practices which have been overlooked. As a result, the cruise industry could do more to prioritise cyber-security on a day-to-day level in order to make sure that the employee experience is in alignment with cyber-security policies.
The research shows that the maritime industry could benefit from applying the sociotechnical perspective to its cyber-security strategy. Currently, the day-to-day level cybersecurity is being ignored by the cruise ship sector. As a result, employees are aware of the threat of a cyber-attack at sea, they perceive cyber-security to be important, they are receiving training and are aware of cyber-security policies. However, there is a disparity between their intentions and their practices which is a result of daily obstacles and challenges preventing them from following cyber-security policies.
This paper will be comprised of three parts. The first, will explain the background and situate this research amongst other relevant literature. Next, an overview of the research methodology will be outlined and its limitations presented. Lastly, the paper will discuss the results, offering recommendations and suggestions for future research.
In 2017, the maritime industry was awakened to the importance of cyber-security when
Maersk Shipping Solutions was hit with what the White House said to be, ‘the most destructive
and costly cyber-attack in history’ [
Within the maritime industry, the approach to cyber-security, often focuses on highlighting
the various ways that a vessel could be exploited [
However, so far, the cruise ship industry has escaped focus, despite there being evidence
of cyber-exploitation within the sector [
Furthermore, despite the IMO guidelines highlighting the importance of the adoption of a
holistic approach to cyber-security [
Currently, there is extremely limited discussion of cyber-security from humanistic
approach. However, the human factor is a vital contribution and is in need of attention [
The literature provided from the socio-technical perspective adopts an employee
perspective in order to try to understand user behaviour. Oftentimes, users are aware of their
role in cyber-security, but their intentions do not match their practices [
Similarly, it is not sufficient to just train employees because workplace cyber-security
practices degrade overtime [
Aside from understanding and changing user behaviour, the socio-technical perspective
highlights that there are other factors which influence employee’s practices. Oftentimes there
are many social and organisational factors acting as an obstacle to employee’s cyber-security
which are overlooked. For instance, the needs of the designers, compared to the needs of the
users are not in alignment [
It is also important that the organisational culture is in alignment with the cyber-security policies in order to encourage good cyber-security practices. This helps to communicate the importance of cyber-security to employees and promote compliance with cyber-security policies [40].
There is evidence that the maritime industry could greatly improve its cyber-security by considering the socio-technical in its strategy. Interestingly, after the Maersk attack, the U.S. Coast Guard discovered that crew members were aware that computers onboard had been compromised, they avoided using them for personal tasks out of fear of being compromised but disregarded the threat when conducting professional tasks. It was therefore said that “simple cyber hygiene would have prevented this issue… it’s in the day-to-day that these things happen” [41]. This evidence highlights the dangers of relying heavily on a technical approach to cyber-security and ignoring the humanistic elements of cyber-security. Consequently, the maritime industry should adopt a holistic approach to cyber-security, considering people, processes and technology combined [42].
This research therefore seeks to apply the socio-technical perspective to the maritime industry to see if this environment could also gain the benefits of adopting the perspective to its cyber-security strategy. The research assumption is that staff members onboard are conducting common practices which could be putting cruise ships at risk of a cyber-attack. These behaviours are the result of daily challenges which are acting as an obstacle for staff members. This research therefore aims to gain an employee perspective of cyber-security onboard cruise ships and apply the socio-technical perspective in order to understand the reasons behind their behaviour.
Using a quantitative method, this research was conducted via the use of a computerised self-administered questionnaire design [43] which was formed mostly of closed-ended questions [44]. The justification for the appropriateness of this method, is that cyber-security is generally something that not everyone is particularly knowledgeable about. Many people consider it to be an expert subject and are intimidated about discussing the topic. Additionally, given that cruise ship employees come from all over the world and speak many different languages, using qualitative research to explore the perceptions of someone whose first language is not English would potentially discourage participants from taking part. Instead, asking participants to simply select a number as a response, rather than requiring them to attempt to express their answer about an expert subject in their second language, was considered more appropriate. Consequently, in order to gain responses which were useful, a quantitative design was adopted to give structure and support to the participants’ responses. To provide explanation for the selected responses, an interpretivist epistemology [45] was used with inductive reasoning.
The questions were answered on a five-point Likert Scale [46] in order to assess the level of agreement with the statement proposed [47] ranging from ‘Strongly agree’ to ‘Strongly disagree’. Open-ended questions, producing qualitative data, were also used in the questionnaire, giving participants the chance to offer a subjective response based on their own experience and support the inductive reasoning.
The sample of cruise ship employees was obtained through a nonprobability purposive sampling method [48] obtained through Facebook ‘Crew Only’ groups and LinkedIn. The researcher was already a member of many of these closed groups on Facebook but selected specific groups based on the diversity of the members, ensuring it was comprised of employees in differing job roles and varying cruise ship companies. This enabled a wider exploration of the perceptions and also was an attempt to avoid reputational damage to any one company in particular. Once permission was obtained from the group administrators, the researcher posted a message in the groups, informing members of the research, containing a link to the questionnaire if the participant wanted to participate.
Those who were in a job role that had access to an IT system between 2018-2020 were invited to take part. The IMO guidelines were released in 2017, so the time frame selected enabled companies the chance to respond, and ensured that the exploration of the perceptions of employees was from the time which there was cyber-security awareness within the maritime industry.
According to the Facebook group descriptions, there was approximately 50,000 group members combined. However, it is difficult to determine how many of these members were actively engaging in the group at the time. It is also important to highlight that these groups are for social purposes and so, many members are no longer employed, nor have been in a long time. As a result, they may not have been working for a cruise company when cyber-security was a priority and therefore not eligible to partake in the research.
A total of 155 participants completed the questionnaire. The responses from the closedended questions were analysed using descriptive statistics [49]. IBM SPSS software was used to facilitate this to avoid human error. Confidence intervals of the proportion were also calculated using the modified Wald method [50]. 3.1.
The researcher will now briefly outline the limitations of this research so that the results within their given context. Due to the quantitative method adopted and questionnaire design, the exploration of employee perceptions was limited in scope. Therefore inductive reasoning, supported by the answers from the qualitative questions, was used to give further explanation to results. This therefore means that the research is not completely objective and has an element of researcher influence.
The questionnaire was also conducted in English by many participants who are not fluent speakers. Given that cyber-security is considered a complex subject, there is a chance that some participant’s comprehension of the questions may have been reduced. Some staff members who were not entirely comfortable with partaking in the research due to it being conducted in English may have even been put off taking part.
Embracing the use of the internet to conduct the research was a useful aid during a pandemic. Without such a tool, it would have been extremely challenging to obtain the perceptions of employees who were scattered around the globe. However, not all employees are connected to the internet, nor are necessarily on social media, or a part of Crew Groups on Facebook. Therefore, by embracing this method of sampling, the generalisability of the results to the entire population is reduced.
Furthermore, the sample obtained was a size which enabled an exploration to be obtained into the perceptions of employees. However, the results represent a snap-shot of the number of staff members employed in total across the entire industry.
The researcher would also like to highlight that the cruise industry has paused its operations for over a year. Therefore this research required employees to recall their experiences. This means that their responses may have been influenced by lack of memory. Furthermore, in the year that has passed, the cruise industry may have taken more steps to improve its cybersecurity which has yet to be rolled out to employees.
1. The cruise ship industry is raising cyber-security awareness amongst employees This explains the employee awareness of cyber-security policies, their experience of training onboard and the maintenance of their awareness.
This explains employee perceptions of a cyber-attack/the importance of cyber-security.
It then proceeds to discuss employee’s onboard behaviour.
This explains the various obstacles which are influencing employee’s cyber-security practices onboard.
This section will be comprised of three parts, presenting a discussion of each of these key findings. 4.1.
This finding will be discussed in three parts. The first part will present the findings from the exploration of the employee’s experience of training. The second part will focus on the maintenance of their training and awareness. The third part will discuss the impact of the current approach to training and awareness maintenance.
The results show that the cruise industry appears to be attempting to improve its cybersecurity in accordance with the IMO guidelines. A formal cyber-security policy has been introduced, which 68.4% of employees confirmed had already been established (90% CI [0.6197, 0.7418]). Alongside this, 67.7% of employees received cyber-security training (90% CI [0.6130, 0.7358]). which was given to employees occupying the full range of job roles onboard. However, there are limitations to the cruise ship industry’s efforts which will be outlined below.
The training was not always conducted prior to the employee using an IT system onboard, due to employees being left to ‘settle in’ before being given cyber-security training. Employees also explained that the cyber-security training was ‘not taken seriously’.
Furthermore, not all employees who are using an IT system are being trained; those in job roles that are more centred around IT are more likely to receive training at 71.4% (90% CI [0.5471, 0.6748]), compared to those who said that they used an IT system as part of their role but not centrally, with only 45.5% receiving training (90% CI [0.0381, 0.1058]).
Furthermore, although the training was given to those in varying levels of authority, those with increased authority were more likely to receive cyber-security training, as displayed in the bar graph below.
100 80 60 40 20 0
78.4% 70.5%
51.6% Senior Management Departmental Management Team Member Management
Employees also explained that oftentimes the training was not job specific and ‘quite generic’. An employee explained: ‘each position has different levels of access (a media manager has open access to the internet - entertainment hosts is an intranet so closed access) the risks for these 2 roles for example would be different’.
This meant that only 45.8% (90% CI [0.7212, 0.8305]) of employees strongly agreed that cyber-security was important for their job role. Therefore, the standardised training given to employees in varying job roles, meant that they disregard it and considered it irrelevant to their role onboard.
Similarly, given that cyber-security is considered a complex subject for most, and that the cruise ship environment is made up of employees speaking many different languages, it was also suggested that the training not only be more job specific, but also employee specific. For instance, an employee explained: ‘Have important training like cyber security be offered in multiple languages for easier understanding. Cyber security training uses specific vocabulary that may be difficult for crew members who speak English as an additional language’.
Therefore, the exploration of the employee experience of training, shows that there is more work to be done to make it as efficient as it could be.
Next, the researcher will discuss the maintenance of training and awareness. The results show that only 16.1% of participants received any further additional training to maintain their knowledge (90% CI [0.1182, 0.2160]). Instead, passive forms of cyber-awareness, such as publications were the main source of maintenance. The bar graph below presents the various methods that were used to keep employees up-to-date with cyber-security.
50 40 30 20 10 0
42.6% 21.3% 18.15%
16.1% Publications Departmental I was not kept Additional meetings up-to-date training 1.9% Other
Lastly, this section will discuss the impact of the current approach to training and awareness maintenance. The implications of the sporadic training, conducted with a standardised, generic session, suggests to the employees that cyber-security is, at present, not something which is considered as everyone’s responsibility onboard. As a result, employees perceived cyber-security as an IT department responsibility only. When asked how they would respond to a suspicious threat, participants most commonly selected that they would contact the IT department. This resulted, in some instances, with the IT department becoming overburdened. For instance, an employee explained: ‘…IT was prompt with fixing the issue when reported but it was hard to get a hold of them via either phone or email. Typically I did not come across security problems but if I had, not much was promoted in terms of equipping managers with the tools they’d need to combat or prepare against’.
Furthermore, the lack of maintenance of cyber-security awareness is implying that cyber-security training is a tick box exercise. As a result, employees are disregarding their training on a practical day-to-day level, and putting the trust in the IT department to mitigate threats.
This finding will discuss the perceptions of the employee and their practices onboard. Employee perceptions surrounding cyber-security and cyber threats appear to be reflective of the increased concerns of the maritime industry in general. 76.1% of employees strongly agreed or agreed that a cyber-attack on a cruise ship is a threat (90% CI [0.7006, 0.8130]) and 92.9% of the employees believed that cyber-security onboard is important (90% CI [0.8865 to 0.9569]).
The employee’s perceptions surrounding cyber-security appear to be influenced by the training that they received, as demonstrated in the table below.
However, when examined more closely, the results show that the employees seem to
be more concerned about cyber-security than is evident from their practices. Despite these
perceptions, 81.8% of employees conducted practices onboard that could result in a
cyberattack (99% CI [0.5485, 0.7423]), therefore showing that there is a disparity between the
intentions of the employees and their conduct onboard, which supports the findings of
Albrechsten [
Connected a personal device to a professional IT
system Used a personal device to conduct professional tasks
It was found that the training did have some level of impact on the employee’s conduct. Of the participants who received training, 78.6% selected behaviours (90% CI [0.3190, 0.4464]), compared to 87.5% of participants selecting behaviours who did not receive training (90% CI [0.8380, 0.9601]). However, due to the limitations of the training which were discussed above, the influence of training on the employee’s practices is limited. 4.3.
The results show that despite the indication of an attempt to increase cyber-security onboard, cyber-security on a day-to-day level is not being prioritised. This is resulting in many organisational obstacles for the employees. This section will present a deeper understanding of the factors which are influencing their practices.
Firstly, there is a misalignment between cyber-security practices, and the needs of the
employees in executing their job role. This is consistent with the work of Hooper & McKissask
[
Similarly, a lack of connectivity onboard meant that employees were left with no choice but to work around cyber-security policies. For instance, an employee explained: 24% ‘I was also required to take company electronics off of the ship into insecure internet connections in order to complete program updates as the ship internet was not strong enough to do so’.
This suggests that the cruise ship companies are not prioritising cyber-security on a practical level. This is supported by the fact that another significant reason for employee workarounds onboard was simply, a lack of resources. Employees were left with no choice but to use their own, potentially insecure devices, to conduct professional tasks because they did not have the resources needed.
Lastly, a cruise ship is an environment which encompasses employees living and working in the same space whilst being detached from the outside world. This presents obstacles to employees which need to be considered when forming cyber-security policies. For instance, a lack of connectivity both in port and onboard, as well as the high cost of Wi-Fi for crew, meant that employees commonly explained that they used onboard, professional devices and networks to conduct their personal correspondence. For instance, a participant explained: ‘I was in the middle of a house purchase and needed to scan and send documents overthere is often no time or appropriate place in ports we visit to do this.’
Therefore, it is not just the professional tasks of employees which are encouraging workarounds, but also personal factors, that have not been considered as part of the cybersecurity strategy, which are forcing them to disregard cyber-security policies.
There is also a misalignment between the corporate policies and the workplace routines,
consistent with the findings of Sadok et al. [
Furthermore, although employees knew that their practices were jeopardising the cyber-security of the vessel, they explained commonly that they were ‘normal’. For instance, an employee explained: ‘I can't say I have ever really thought twice about the security risk factor in doing so and everybody does it so it seems like the normal thing to do.’
In some instances, these behaviours were even encouraged, or considered a benefit to the position onboard. For instance, an employee explained: ‘I also used my office computer to do personal things, yet was never told not to do so on it. I was actually advised by head office that it was one of the “perks” of my job.’ Consequently, the misalignment between the organisational cyber-security policies and the culture onboard, implies to employees that on a day-to-day basis, breaking cyber-security rules is normal and acceptable. 4.4.
Overall, although the results outlined above indicate that the cruise ship industry has attempted to improve its cyber-security strategy with increased training and awareness amongst employees, there is still progress to be made. The researcher recommends that training is given more thoroughly across departments to every employee, and is more job specific, to communicate the relevancy of cyber-security to each crew member. IT is also strongly recommended, that the training sessions are delivered in various languages for those who do not speak English as their first.
It is also the recommendation of the researcher that the training sessions and awareness
of employees onboard is maintained. As per Albrechsten & Hovden, this should be most
beneficially conducted through the use of interactive methods of cyber-security awareness [
The researcher also recommends that the cyber-security culture onboard also needs to be addressed. As per Alshaikha, this has been seen to improve cyber-security for a sustained amount of time. There are various ways that the culture could be achieved [40]. Firstly, it must be communicated to employees that cyber-security is everyone’s responsibility and not just the role of the IT department. Ultimately, at sea, every crew member’s supreme priority is safety. For instance, an employee explained: ‘Safety is our number one priority it is very important that we see different aspect on how we can deal on such incidents. This training should be considered as very important as this is a safety issue.’
Currently onboard, employees often experience safety drills to maintain their knowledge of safety procedures, as well as keep safety as a forefront priority. The cruise industry should seek to treat cyber-security as just as important, by consistently reinforcing employee’s awareness that vessels are made up of complex, interlinking cyber-physical systems [51] and adopting good cyber-security practices is vital to protect the overall safety of the vessel. It should also be communicated often to employees that adopting good cybersecurity practices is a necessity of every crew member onboard to prevent harm coming to all those onboard. Employees should also be informed often of what could be suspicious and how they should act if they see such occurrences. This could be done on a large scale with a drill in order to reinforce not only the importance, but also the notion that it is everyone’s responsibility onboard.
As suggested by Alshaikha another way that the cyber-security culture onboard could be improved could be through the use of incentives, similar to ‘employee of the month’ which would reward individuals who have raised awareness of a threat or conducted good cybersecurity onboard [40]. This would ignite a collective call to action, acting as a reminder to be cyber-security mindful, and alter the perceptions that poor cyber-security practices are ‘normal’ and acceptable onboard.
The researcher also recommends that the organisational approach to cyber-security
adopts a more employee centric approach in order to mitigate some of the challenges that they
face which are ultimately impacting their cyber-security practices. As per Sadok et al., it is
vital that cyber-security practices are influenced by the employees who are affected by security
controls [
Time and time again, employees blamed a lack of resources, and inconvenience as a reason for their behaviours onboard. This could be mitigated by increasing the number of secure portable devices which are available to employees so that they do not opt to use their personal device.
Lastly, it is important not just to mitigate the misalignments in the employees professional experience, but also their personal conduct also. The cost of crew Wi-Fi, and poor connectivity, is deterring employees from using the correctly assigned network. Employee’s must have the ability to contact home and carry out personal tasks onboard, easily and affordably. If this is not the case, their personal needs will take priority over cyber-security measures.
To conclude, employees are aware of the importance of cyber-security onboard, yet they are conducting practices onboard which are putting cruise ships at risk of exploitation. Although employees appear to be the weak link in the cyber-security onboard, their behaviours are influenced by many, humanistic and organisational factors. Their practices are therefore the product of organisational weaknesses which have arisen because the employee perspective, and the practical day-to-day level cyber-security, have not been considered. Therefore, the cruise ship industry could take cyber-security more seriously.
Although employees are receiving training, it is rolled out amongst employees sporadically, delivered through sessions which are standard and generic across many different job roles. This means that employees consider cyber-security as irrelevant to them. Furthermore, after the training has been conducted, it is not maintained, meaning that there has been little consideration about how to actually change the behaviour of employees in the long term. This means that employees are trusting the cruise ship companies and IT departments to maintain the cyber-security of the vessel, without fully considering their role, and the potential impacts of their behaviours.
There are also misalignments between the corporate cyber-security policies, the manager’s expectations and the experience of employees when trying to balance their tasks and the cybersecurity practices. This means that employees are working around them or disregarding them. Furthermore, the organisational cyber-security culture does not mirror the culture onboard. This communicates to employees that cyber-security does not really matter.
This research highlights the dangers of relying heavily on a technical approach to cybersecurity within the maritime industry. Applying the socio-technical perspective to the maritime environment produces results which are consistent with the perspective’s previous research. Therefore, this research shows that there are many benefits, discussed throughout, which could be gained from applying the socio-technical perspective to the cyber-security of the cruise ship sector, and the maritime industry more generally. By adopting a socio-technical perspective within the maritime industry, a more holistic cyber-security strategy will be formed, which will ultimately provide more efficient protection.
The findings of this research were mostly as expected, particularly surrounding the level of common behaviours that are conducted onboard, potentially putting cruise ships at risk. However, particularly surprising was the perceptions of employees. The researcher assumed that employees were unaware of the threat of a cyber-attack/did not perceive cyber-security to be important, which would explain why frequent common bad practices were being conducted onboard. This research suggests the opposite, which although, initially was alarming to discover, upon reflection, was actually reassuring. This therefore means that it is the obstacles which are impacting employee behaviour, which ultimately can be addressed more easily than altering people’s perceptions.
This research hopes to encourage the application of the socio-technical approach within the maritime industry more so in the future. There are many areas to pursue, the avenues of which can vary depending on the corporate level. For instance, on a higher level, the researcher would suggest that an exploration of the designer perspective would be useful. Are they aware of the lives of crew members onboard and do they take it into account when they are designing the policies?
Similarly, an exploration into the efficiency of the corporate approach to training and awareness could be conducted. For instance, given that the cruise ship industry, and the maritime industry in general is made up of employees from all over the globe, future research could consider cyber-security perceptions across varying nationalities. This research suggests that employees speaking different languages may find it more difficult to comprehend the training. Therefore, the researcher would recommend future exploration surrounding the efficacy of conducting cyber-security training in various different languages for the employees who do not speak English as their first language. If cyber-security awareness and training was not only more job specific, but more tailored to the employee’s learning needs, would their practices improve?
Alternatively, on a more managerial level, it would also be useful to explore the perceptions of the shoreside employees. As mentioned, oftentimes the employee behaviours onboard are the result of a request at shoreside. Future research could investigate whether the perceptions of the two sides are similar, the challenges that shoreside face and how these two elements of the organisation come together in order to reduce the conflict which is currently occurring.
Lastly, this exploration encompasses employees from various cruise lines. However, future research could focus on one single cruise ship and explore the perceptions and experience of employees in greater depth. This would allow a deeper understanding of the cyber-security practices on a more specific level rather than generically across the entire industry.
Ultimately, this research aims to encourage the adoption of a more holistic approach to cyber-security within the maritime industry, particularly with the support of the socio-technical perspective, to not only understand, but also alter user behaviour. Now is the time to take an employee centric approach to understand how to secure vessels. The researcher hopes that this is the start of employees onboard being seen as a solution to cyber-security, rather than part of the problem.
[40] M. Alshaikha, Developing cybersecurity culture to influence employee behaviour: A practice perspective, Computers & Security, 98 (2020). https://doi.org/10.1016/j.cose.2020.102003 [41] I. Bramson, Cyber Risk Series – United States Coast Guard, 2020. URL: https://open.spotify.com/episode/2hqSRYPsLHo0a2r5D5FUk5?si=PQN0UmIHThCb531DFgJ7k w&nd=1 [42] A. Garcia-Perez, M. Thurlbeck, E. How, Towards cyber security readiness in the Maritime industry: A knowledge-based approach (2017). https://pure.coventry.ac.uk/ws/portalfiles/portal/12219284/Towards_Cyber_Security_Readiness_ In_The_Maritime_Industry.pdf [43] V. Vehovar, K. Manfreda, Overview: online surveys, in: N. Fielding, R. Lee, G. Blank. (Ed.), The Sage Handbook of online research methods. 2nd. ed., Sage Publications Ltd, London, UK, 2017, pp. 143-161. https://www.doi.org/10.4135/9781473957992 [44] C. Leddy-Owen, Questionnaire Design, in: N. Gilbert, P. Stoneman (Ed.), Researching Social
Life, 4th ed., Sage Publications, London, UK, 2016., pp. 245-257. ISBN: 9781412946629 [45] V. D. Alexander, H. Thomas, A. Cronin, J. Feilding, J. Moran-Ellis, Mixed Methods, in: N.
Gilbert, P. Stoneman (Ed.), Researching Social Life, 4th ed., Sage Publications, London, UK, 2016., pp. 119-139. ISBN: 9781412946629 [46] R. Likert, A technique for the measurements of attitudes, Archives of Psychology 22 (1932) 556. [47] A. Bryman, Social Research Methods, 5th ed., Oxford University Press, New York, NY, 2016. [48] E. Ruel, W. Wagner |||, B. Gillespie, Nonprobability sampling and sampling hard-to-find populations, in: E. Ruel, W. Wagner |||, B. Gillespie (Ed.), The practice of survey research, Sage Publications, London, UK, 2016, pp. 149-159. https://www.doi.org/10.4135/9781483391700 [49] P. Stoneman, Analysis Survey Data, in: N. Gilbert, P. Stoneman (Ed.), Researching Social Life, 4th ed., Sage Publications, London, UK, 2016., pp. 389-411. ISBN: 9781412946629 [50] A. Agresti, B. Coull, Approximate Is Better than "Exact" for Interval Estimation of Binomial
Proportions, The American Statistician 52 (1998) https://doi.org/10.2307/2685469 [51] V. Bolbot, G. Theotokatos, L. Bujorianu, E. Boulougouris, D. Vassalos, Vulnerabilities and safety assurance methods in Cyber-Physical Systems: A comprehensive review, Reliability Engineering & System Safety, 182 (2019). https://doi.org/10.1016/j.ress.2018.09.004