Increasing set of functionalities, network interoperability, and system design complexity have introduced easily exploitable security vulnerabilities in cyber-physical systems (CPS). Furthermore, the tight interaction between information technology and physical world, as well as the rising levels of autonomy, make these systems vulnerable to attacks beyond the standard cyber-attacks; relying exclusively on conventional security techniques may be unfeasible due to resource-constraints and long system lifetime. Consequently, there is a need to change the way we reason about security in CPS, and start designing platform-aware attack-resilient components and architectures capable providing strong safety and performance guarantees even under attack. In this talk, I will present research challenges and our recent efforts in this domain, starting from cyber-physical security techniques that (a) capture effects of attacks on system performance, (b) introduce attack-resilience into components at each level of the autonomy stack, and (c) enable mapping of the desired Quality-of-Control (QoC) under attack guarantees into real-time platform requirements in way that supports design-time tradeoffs between the QoC under attack and security-related overhead. For systems with varying levels of autonomy and human interaction, I will also show how we can exploit human power of inductive reasoning and the ability to provide context, to improve the overall security guarantees. Finally, I will present how we can capture security-related CPS specification as hyperproperties, and introduce statistical model checking methods to check such specifications.