As the general development trend of the automotive industry, connected and autonomous vehicles (CAVs) can be used to increase transportation safety, promote mobility choices, reduce user costs, and create new job opportunities. However, with the increasing level of connectivity and automation, malicious users are able to easily implement different kinds of attacks, which threaten the security of CAVs. Hence, this paper provides a comprehensive survey on the cyber-security in the environment of CAVs with the aim of highlighting security problems and challenges. Firstly, based on the types of communication networks and attack objects, it classifies various cyber-security risks and vulnerabilities in the environment of CAVs into in-vehicle network attacks, vehicle to everything network attacks, and other attacks. Next, it regards cyber-risk as another type of attacks in the environment of CAVs. Then, it describes and analyzes up-to-date corresponding defense strategies for securing CAVs. In addition, it concludes several available cyber-security and safety standards of CAVs, which is helpful for the practical application of CAVs. Finally, several challenges and open problems are discussed for the future research.