Cyber-physical security assessment