Security Decisions for Cyber-Physical Systems based on Solving Critical Node Problems with Vulnerable Nodes