Focusing on detecting cyber-attacks, especially stealthy ones, this chapter introduces a uniform model for attacks, representing them as either unknown inputs or feedback on system variables. A new concept, kernel attacks, is defined: attacks whose input and output signals lie in the system kernel subspace. Relationships between kernel attacks and traditional stealthy attacks are examined, along with existence conditions for various CPS configurations. Novel detection schemes are proposed, centred on generating and fusing input and output residuals. The chapter concludes by addressing simultaneous detection of cyber-attacks and faults, and the configuration of resilient CPSs.