The transformation of the cloud-integrated industrial cyber-physical systems' architecture makes industrial field equipment more exposed to the cyber-attacks, which puts forward higher security requirements for the industrial field layer. As the structure becomes more complex and cyber-attacks become more intelligent, it is difficult to accurately obtain the security state, and the traditional state-based security decision-making method will not achieve effective protection. This paper proposes a security decision-making approach for the field layer of industrial cyber-physical systems. First, the field area is divided according to the functional structure, and then the attack defense tree is constructed by analyzing the potential correlation between attack goals, attack events and defense strategies. Then, from the perspective of attack and defense attributes, the fuzzy analytic hierarchy process is used to quantify the payoff of the defense strategy. Combined with part of the attack state to construct the partially observable Markov decision process model, and the optimal security strategy is obtained by solving the model. Finally, a simplified Tennessee-Eastman process control system is used to verify that the proposed method can effectively decide the optimal security stategy.