In the context of sensor attacks on linear time-invariant cyber-physical systems, we propose a model-based cumulative sum (CUSUM) procedure for identifying falsified sensor measurements. To fulfill a desired detection performance-given the system dynamics, control and estimation schemes, and noise statistics-we derive tools for designing and tuning the CUSUM procedure. We characterize the state degradation that a stealthy attacker can induce to the system while remaining undetected by the detection procedure. Moreover, we quantify the advantage of using a dynamic detector (CUSUM), which leverages the history of the state, over a static detector (Bad-Data) which uses a single measurement at a time. Simulation experiments are presented to illustrate the performance of the detection scheme.