Robust Security Assurance in Cyber-Physical Systems: From Attack Diagnosis to Attack Resilience