In this paper we consider a typical architecture for a networked control system under false-data injection attacks. Under a previously proposed adversary modeling framework, various formulations for quantifying cyber-security of control systems are proposed and formulated as constrained optimization problems. These formulations capture trade-offs in terms of attack impact on the control performance, attack detectability, and adversarial resources. The formulations are then discussed and related to system theoretic concepts, followed by numerical examples illustrating the various trade-offs for a quadruple-tank process.