INDUSTRIAL INTERNET OF THINGS VULNERABILITIES AND THREATS: WHAT STAKEHOLDERS NEED TO CONSIDER

Authors: Fred Hoffman, M Aazam, S Zeadally, K Harras, D Acharjya, N Ahmed, F Alaba, M Othman, I Hashem, F Alotaibi, G Andersson, P Donalek, R Farmer, N Hatziargyriou, I Kamwa, P Kundur, N Martins, J Paserba, P Pourbeik, J Sanchez-Gasca, R Schulz, A Stankovic, C Taylor, V Vittal, M Asplund, S Nadjm-Tehrani, A Atamli, A Martin, H Boyes, B Hallaq, J Cunningham, T Watson, M Caselli, E Zambon, J Petit, F Kargl, S Choi, Y Chang, J Yun, W Kim, G Corb, C Foglietta, C Palazzo, S Panzieri, M Eigner, P Evans, M Annunziata, B Filkins, D Wylie, S Forsstrm, I Butun, M Eldefrawy, U Jennehag, M Gidlund, P Fremantle, P Scott, J Fu, Y Liu, H Chao, B Bhargava, Z Zhang, R Gavin, A Hassanzadeh, S Modi, S Mulchandani, B Huberman, C Karlof, D Wagner, Y Joo, T Tan, R Lee, M Assante, T Conway, X Li, J Niu, M Bhuiyan, F Wu, M Karuppiah, S Kumari, C Maple, M Mrquez, R Herrera, A Mejas, F Esquembre, J Andjar, O Mavropoulos, H Mouratidis, A Fish, E Panaousis, J Mehnen, H He, S Tedeschi, N Tapoglou, F Mouton, L Leenen, H Venter, E Ortiz, L Reinerman-Jones, G Matthews, X Peng, P Zhu, Y Zhu, P Hu, Cui, C Yan, A Sadeghi, C Wachsmann, M Waidner, A Sajid, H Abbas, K Saleem, D Serpanos, M Wolf, Cham Springer, M Shetty, D Manjaiah, L Trautman, P Ormerod, E Vasilomanolakis, J Daubert, M Luthra, V Gazis, A Wiesmaier, P Kikiras, A Willner, M Yazdinejad, F Nayyeri, N Afshari - Issues in Information Systems 2019 cited by 10

The Industrial Internet of Things, or IIoT, introduces Internet-enabled devices into industrial process systems operating in the energy, transportation, healthcare, utilities, cities, agriculture, and other critical infrastructure sectors, establishing linkages between previously-air gapped information technology (IT) and operational technology (OT) networks. While the introduction of these Internet-enabled devices creates new efficiencies, improves performance, increases productivity, and increases profitability, it also introduces new security challenges and risks. IIoT is a system of systems; the architecture of a single IIoT system consists of different layers, with each layer performing a distinct function, having unique operational characteristics, and relying upon different devices and communication protocols than other layers of the system. Because of the unique characteristics of these various layers and functions, the vulnerabilities and threats associated with them also differ. Many internal stakeholders are involved in the conceptualization, planning and implementation of an organization's adoption of IIoT; while some may be experienced and knowledgeable technologists, others are not. Regardless of one's technical knowledge, recognition of the potentially-catastrophic consequences of successful exploitation of those vulnerabilities necessitate at least some familiarity with security vulnerabilities and threats associated with the various IIoT layers and sub-systems. The purpose of this article is to identify for IIoT stakeholders some of the vulnerabilities and threats associated with various layers and functions of an IIoT architecture and illuminate the need for a comprehensive, systematic, and layer-appropriate approach to IIoT security.