Computers in Industry 103 (2018) 97–110

Contents lists available at ScienceDirect

Computers in Industry
journal homepage: www.elsevier.com/locate/compind

Cybersecurity for Industry 4.0 in the current literature: A reference

framework
Marianna Lezzi* , Mariangela Lazoi, Angelo Corallo
Università del Salento, Dipartimento di Ingegneria dell’Innovazione, Campus Ecotekne, Via per Monteroni, s.n. 73100 Lecce Italy

A R T I C L E I N F O A B S T R A C T

Article history: The cybersecurity issues represent a complex challenge for all companies committing to Industry 4.0
Received 2 July 2018 paradigm. On the other hand, the characterization of cybersecurity concept within Industry 4.0 contexts
Received in revised form 7 September 2018 proved to be an emerging and relevant topic in the recent literature.
Accepted 10 September 2018
The paper proposes to analyse, through a systematic literature review approach, the way in which the
Available online xxx
existing state of art deals with the cybersecurity issues in Industry 4.0 contexts. In particular, the focus
will be on the investigation of the main elements associated with cybersecurity theme (i.e. asset involved
Key words:
into cyber-attacks, system vulnerabilities, cyber threats, risks and countermeasures) within those
Cybersecurity
Industry 4.0
industrial contexts where physical systems (machines, shop floors, plants) are connected each other via
Industrial Internet of Things the Internet. Four areas of analysis are defined: definitions of cybersecurity and Industry 4.0 concepts, the
Review industrial focus of the analysed studies, the cybersecurity characterization and the management
attempts of cybersecurity issues. Through the literature review analysis, a framework of the main
features characterizing each area is discussed, providing interesting evidences for future research and
applications.
© 2018 Elsevier B.V. All rights reserved.

Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
2. Research method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
2.1. Search process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
2.1.1. Searching criteria definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
2.1.2. Papers selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
2.1.3. Papers assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
4. Industrial focus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
5. Cybersecurity characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
5.1. Systems vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
5.2. Cyber threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
5.3. Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
5.4. Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
6. Managing of cybersecurity issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
6.1. Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
6.2. Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
7. A framework for cybersecurity in I-4.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
8. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

* Corresponding author.
E-mail address: [email protected] (M. Lezzi).

https://doi.org/10.1016/j.compind.2018.09.004
0166-3615/© 2018 Elsevier B.V. All rights reserved.
98 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

1. Introduction applications in the field of cybersecurity management in such

Internet-connected industrial contexts will be defined.
An ever-increasing number of companies are approaching to The next section of the paper describes the research method,
Industry 4.0 paradigm (even known as Industrial Internet of Things and, in particular, the search process (which includes searching
or Industrial Internet), by connecting the factories and plants to the criteria definition, papers selection and their assessment). In
Internet with the aim to improve their efficiency and effectiveness. Sections 3– 6, definitions of industry 4.0 and cybersecurity, the
In these Internet-connected industrial contexts, the cybersecurity target industrial focus, cybersecurity characterization and manag-
issues represent one of the most relevant challenges to be dealt ing of cybersecurity issues, based on the literature review, are
with. respectively explored. The final sections, concerning findings and
According to the management-consulting firm, McKinsey & conclusions, end the paper.
Company, Industry 4.0 transformations are potentially able to
create value equivalent to efficiency improvements of 15 to 20 2. Research method
percent [1]. This means a reduction of total machine downtime
thanks to predictive maintenance or remote monitoring, as well as This study adopts the systematic literature review approach [6]
an increase of labour productivity due to the automation of manual with the aim to characterize the cybersecurity concept within
work. Moreover, a certain number of benefits result from the Industry 4.0 contexts. This was achieved by investigating: the
possibility to analyse the huge amount of data coming from target industries to which cybersecurity refers to and the industrial
industrial processes (for instance, from sensors and actuators assets damaged; the typology of cyber-threats and the resulting
which connect machines and products to computing systems). risks for the industrial contexts; the countermeasures to be taken
These benefits include the reduction of inventories and the to deal with the cyber-attack events; the guidelines and solutions
improvement of service levels (in terms of shorter time-to-market, to manage cybersecurity issues.
delivery time and freight costs) and of the product quality (more According to the systematic approach, the literature review
compliant to the customer expectations). process was based on keywords and search terms with a replicable
Within Industry 4.0 contexts, cybersecurity plays a leading role and defined search strategy. Although the literature review cannot
in preventing the loss of companies’ competitiveness. In fact, be considered exhaustive, this provides a significant overview of
critical industrial equipment is today vulnerable to a number of the current role played by cybersecurity within Industries 4.0,
cyber-attacks, which are able to affect the entire business model. revealing as an emerging research field at international level.
According to Cisco 2018 Annual Cybersecurity Reports [2], 31% of
organizations have experienced cyber-attacks on Operational 2.1. Search process
Technology (OT); while, 38% expect attacks to extend form
Information Technology to Operational Technology. Although The search process consists of three main steps: (i) definition of
cybersecurity is perceived as a priority by 75% of experts, only searching criteria, (ii) papers selection, and (iii) papers assessment.
16% say their company is well prepared to face cybersecurity The papers search was carried out through three important
challenges [3]. This is mainly due to the lack of accurate standards indexed electronic scientific databases: Scopus (www.scopus.
to which companies can refer to, as well as the lack of managerial com), Web of Science (www.webofknowledge.com) and Scholar
and technical skills necessary to implement them. (scholar.google.it). The research took place until March 2018.
European and international organizations are moving in this Chapters of books, as well as the non-scientific material coming
direction. For instance, in 2017, European Cyber Security Organi- from Google Scholar were not considered.
zation (ESCO) collected in a document all existing standards and
specifications related to Cybersecurity in reference to the European 2.1.1. Searching criteria definition
Digital Single Market [4]. This document helps to understand The criteria for searching are based on the terms “cyberse-
which schemes (if existing) can be used by companies to address curity” and “Industry 4.0”. In order to strengthen the research,
the cybersecurity challenges. In addition, International Electro- some of the most significant related words to the cybersecurity
technical Commission (IEC) has published a guide on information concept, as well as the most accredited variants of Industry 4.0 are
security and data privacy [5], which provides guidelines to be taken into consideration.
covered in IEC publications, and explains how to implement them. In particular, concerning cybersecurity, the following definitions
IEC Publications are recommendations (accepted by IEC National were considered to create a properly taxonomy:
Committees) for international use.
In the current fast-moving scenario, it is expected that  “The ability to protect or defend the use of cyberspace from
cybersecurity will become an integral part of the strategy, design, cyber attacks” [7];
and operations of companies that embrace Industry 4.0 paradigm.  “Preservation of confidentiality, integrity and availability of
Through a systematic literature review approach, the purpose information in the cyberspace” [8];
of the paper is to investigate cybersecurity within Industry 4.0  “All activities necessary to protect cyberspace, its users and
contexts. A reference framework as basis of future research and impacted persons from cyber threats” [9];

Fig. 1. Cyber security definition.

 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 99

 “The protection of information assets by addressing threats to already been considered in the first group of papers and five are the
information processed, stored, and transported by internet- same of Scopus. Finally, the search in Scholar, conducted into
worked information systems” [10]; “Advanced Research” on “Article Title” returned three articles, one
 “Prevention of damage to, protection of, and restoration of of which has already been considered in the first group and
computers electronic communications systems, electronic another is the same of Scopus. As a result, 25 scientific papers were
communication services, wire communication, and electronic identified for the second group of papers.
communication, including information contained therein, to Overall, 55 scientific papers were identified. However, ana-
ensure its availability, integrity, authentication, confidentiality, lysing the abstract of each of them, 15 papers (four coming from the
and nonrepudiation” [11]. first group and eleven from the second one) were rejected since
considered off topic with respect to the objectives of this literature
In Fig. 1, a schematic view of the cybersecurity concept merges review. Therefore, the selection phase conduced to 40 scientific
information from the just mentioned definitions. It can be stated papers to be assessed.
that cybersecurity aims at protecting the cyberspace (which In the following Fig. 2, a summary of the paper selection results
includes both information and infrastructures) from any cyber is shown.
threat or cyber-attack. Therefore, the words “cyberspace”, “cyber
threats” and “cyber-attacks” take part of the searching criteria for 2.1.3. Papers assessment
papers selection. In order to evaluate the 40 papers selected, it was firstly defined
Due to this preliminary analysis, the first group of papers was a matrix (see Fig. 3) to record authors notes about each of these
determined through the following searching queries: papers. This matrix is composed of 17 records, in which the
following information was collected: title, authors with affili-
 (“Cybersecurity” OR “cyber security”) AND (“Industry 4.0”); ations, publication year, source, reference, abstract, keywords,
 (“Cyber attack*” OR “cyber threat*” OR “cyberspace”) AND study focus, industry, definition of industry 4.0/Industrial Internet
(“security”) AND “Industry 4.0”). of Things (and variants), definition of cyber security, industrial
asset involved into cyber security risks, systems security vulner-
On the other hand, concerning the term Industry 4.0, the Unite abilities, cyber threats, risks related to cyber attacks, and methods
States variants “Industrial Internet of Things” (even referred to to deal with cyber security risks.
with “IIoT” or “Industrial IoT”) and “Industrial Internet” (coined by The second phase of the papers' assessment involved the
General Electric) were considered [12]. For this reason, the second analysis, in a critical way, of the most significant information
group of papers is characterized by the following searching identified for each paper. The same categories of information was
queries: compared among all different papers and the main findings
discussed. In particular, the following areas were taken into
 (“Cybersecurity” OR “cyber security”) AND (“Industrial Internet consideration (a schematic description is given in Fig. 4):
of Things” OR “IIoT” OR “Industrial IoT” OR “Industrial Internet”);
 (“Cyber attack*” OR “cyber threat*” OR “cyberspace”) AND 1 Analysis of the concept of Industry 4.0/Industrial Internet of
(“security”) AND (“Industrial Internet of Things” OR “IIoT” OR Things (or variants) and that of cybersecurity;
“Industrial IoT” OR “Industrial Internet”). 2 Definition of the target industry threatened by cybersecurity
risks and the industrial assets involved in the cyber-attack
In the following, the analysis is based on the first and second events;
group of papers to identify the results of the two searching queries 3 Characterization of the cybersecurity concept, in terms of:
here defined. systems security vulnerabilities, cyber threats, risks due to
cyber-attacks and countermeasures to be taken;
2.1.2. Papers selection 4 Overview on guidelines and solutions proposed to manage
Concerning the first group of papers, the search in Scopus, cybersecurity issues.
conducted into “Title”, “Keywords” and “Abstract”, returned 31
articles, three of which are written in German language. On the The results of this comparative review are reported in the
other hand, the search in Web of Science, conduced into “Topic” following sections.
(involving Title, Abstract, Author Keywords and Keywords Plus),
returned 15 articles, 12 of which are the same of Scopus and two 3. Definitions
are written in German language. Finally, the search in Scholar,
conducted into “Advanced Research” on “Article Title” returned After having analysed the first group of papers, the main
three articles, two of which are the same of Scopus. As a result, 30 features of Industry 4.0 emerged from a certain number of
scientific papers were identified for the first group of papers. definitions; while only a paper defined the cybersecurity concept
Regarding the second group of papers, instead, the search in as “the protection of theft or damage to IT hardware, software and
Scopus returned 24 articles, four of which have already been the data stored on the systems” [13].
considered in the first group of papers. On the other hand, the A comparative analysis across the definitions of Industry 4.0 in
search in Web of Science returned 13 articles, four of which have reference to cybersecurity, allowed us to notice that some

Fig. 2. Paper selection summary.

100 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

Fig. 3. Evaluation matrix.

Fig. 4. Areas of analysis.

keywords (such as, Internet of Things, Cyber-Physical Systems, As for the first group of papers, also in this case, a comparative
manufacturing and data networking) are very common in the analysis across IIoT definitions associated with the cybersecurity
selected papers (see Table 1). These words highlight that Industry issues have revealed some common keywords (such as, sensors,
4.0 is characterized by two enabling (technological) conditions (i.e. cloud technologies, manufacturing and IoT devices networking),
Internet of Things and Cyber-Physical Systems), a target industrial which enable to characterize the IIoT concept (see Table 2). In
context (i.e. manufacturing), and an enabled condition (i.e. data particular, three main elements emerged:
networking). Consequently, combining all definitions, it can be
stated that Industry 4.0 is mainly associated with the concepts of 1 The presence of some enabling technologies (i.e. wireless sensor
Internet of Things (IoT) and Cyber-Physical Systems (CPS) within networks and cloud technologies) that, with the support of
manufacturing industrial contexts, entailing the networking of advanced industrial analytics and intelligence machine appli-
data coming from machines, products, people and, in general, the cations, play increasingly more pivotal roles in controlling and
interconnection of smart devices among different plants and monitoring functionalities of facilities;
factories. 2 The application of these technologies within manufacturing
At the same way, due to the analysis of the second group of industrial contexts (with particular reference to Industrial
papers, it was possible to investigate on the concept of Industrial Control Systems);
Internet of Things (IIoT), even referred as Industrial Internet by 3 The fact that IoT devices (associated with machines, computers
General Electric in 2014 [22]. To this purpose, a number of and people) are networked.
definitions were collected. On the other hand, only a paper among
those selected described cybersecurity, as that condition where “a Putting together the previous concepts, it can be stated that
system does what it is supposed to do and no more” [23]. Industrial Internet of Things is related to the use of wireless sensor

Table 1
Industry 4.0 key words.

Enabling (technological) conditions Industrial context Enabled condition

Industry 4.0 Internet of Things (IoT) Cyber-Physical Systems (CPS) Manufacturing Data networking
Papers reference [14–17] [16,18,19] [14–16] [14–16], [20,21], [17]
 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 101

Table 2
IIoT key words.

Enabling (technological) conditions Industrial context Enabled condition

Industrial Internet of Things Wireless sensor networks Cloud technologies Manufacturing IoT devices networking
Papers reference [24,25,22], [24,26,27] [24,28,25], [29,26,28,27]

Fig. 5. Comparison between Industry 4.0 and Industrial Internet of Things.

networks (to monitor functionalities of facilities) and cloud following way: one paper focuses on Critical Infrastructures, three
technologies (to manage data produced by sensors) within refer to energy industry, one to telecommunication, and for three
manufacturing industrial contexts. In this reference, a set of IoT of them the industry is not specified.
devices, associated with machines, computers and people, are Regarding the industrial assets involved into cyber-attack
networked, and communicate and interact with each other. events, all papers of both groups point out Industrial Control
In the following Fig. 5, a graphic representation of the key words Systems (ICS) and Cyber-Physical System (CPS) as the vulnerable
associated with the concepts of Industry 4.0 and Industrial Internet systems to be protected. In the following, the main features of the
of Things in relation to cybersecurity issues. two types of systems are briefly reported.
The Industrial Control System (ICS) is a management and
4. Industrial focus control system, which can ensure that the industrial technical
facilities run automatically, while controlling and monitoring the
This section aims at analysing the types of industry and the business processes [31]. In particular, ICSs consist of combinations
related assets threatened by cybersecurity issues within Industry of control components (e.g., electrical, mechanical, hydraulic,
4.0 and Industrial Internet of Things contexts, focusing on the pneumatic) that act together to achieve an industrial objective
industrial assets directly involved in the cyber-attack events. In the (e.g., manufacturing, transportation of matter or energy) [32].
Table 3, an overview on all selected papers is provided. These systems are commonly used in the critical infrastructures,
Due to the analysis of the two groups of papers, it can be noticed especially in the electrical, water and wastewater, oil and natural
that the manufacturing industry results the main sector in which gas, chemical, transportation, pharmaceutical, pulp and paper,
the different studies deal with the cybersecurity issues. In fact, food and beverage, and discrete manufacturing (e.g., automotive,
referring to the first group of papers, 15 on 26 papers explicitly aerospace, and durable goods) industries [32]. Actually, the
mention it. Moreover, six papers refers to Critical Infrastructures Industrial Control System is a general term that encompasses
(CI)1, without providing more details. However, CI can include a several types of control systems, including Supervisory Control and
number of sectors (among them the manufacturing one), such as Data Acquisition (SCADA) systems and Distributed Control Systems
[30]: chemical, commercial facilities, communications, critical (DCS); while, ICS core components are Programmable Logic
manufacturing, dams, defence industrial, emergency services, Controller (PLC), Remote Terminal Unit (RTU), Intelligent Electron-
energy, financial services, food and agriculture, government ic Device (IED) and the interface technology, which is to ensure the
facilities, healthcare and public health, information technology, communication of components [33] provides more information
nuclear, transportation systems, and waste and wastewater about ICS and its components.
systems. On the other hand, only one paper explicitly refers to The term Cyber-Physical System, instead, identifies anything that
healthcare industry, while for three of them the industry is not integrates computation, networking and physical processes. In other
specified. words, these systems enable the virtual digital world of computers
At the same way, considering the 14 papers taking part of the and software to merge through interaction with the physical
second group of papers, six of them explicitly refer to the analogue world. For instance, a smart manufacturing line can be
manufacturing industry; while, the remaining part splits in the considered a CPS whether the machines perform many work
processes by communicating with the components and/or the
products they are in the process of making [12]. CPSs use sensors or
1 other embedded systems to monitor and collect data from physical
European Commission defines critical infrastructure as “an asset or system,
which is essential for the maintenance of vital societal functions” [61]. processes (such as the steering of a vehicle, energy consumption, or
102 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

Table 3
Industry analysis.

Industry types

Manufacturing Critical Infrastructure Healthcare Not specified

First group of papers

Industrial assets involved ICS CPS ICS CPS Service Platform ICS CPS
Papers reference [37,15,38–40,17,41] [14,15,42,21,43,13,44,18,45] [46,47,16,48] [49,19] [50] [20,51] [52]

Industry types

Manufacturing Critical Infrastructure Energy Telecommunication Not specified

Second group of papers

Industrial asset involved ICS CPS ICS ICS Not specified ICS CPS
Papers reference [53,22,28,54,24] [28,24,55] [56] [27,26,57] [58] [25,23] [29]

temperature/humidity control). Moreover, they are supported in the Although there are different types of vulnerabilities which
definition of corrective decisions to the process by a decentralized affect CPSs or ICSs, very common are those unknown (i.e. zero-day
intelligence, which evaluates data coming from sensors or other CPSs vulnerabilities) [46,21,27,57,55]; these are placed in every
and defines in real time the possible scenarios of choice; while, interfaces between different components where there is informa-
actuators support CPSs in implementing the corrective decisions tion exchange [14]. In particular, there are a number of
able to optimize the same process. vulnerabilities in each component of SCADA systems, in particular
Downstream of this high-level analysis, it is possible to state concerning: communication infrastructure and network protocols,
that Industrial Control Systems represent an application area of application server, database server, human machine interfaces,
the Cyber-Physical Systems. This is confirmed by the literature program logic controllers, remote terminal units [40,48].
[34–36]. The evidence shows that IoT devices are attractive targets for
botnets because of security is not a priority for many manufacturers.
This is confirmed by the use of default passwords and open ports, the
5. Cybersecurity characterization
lack of built-in mechanisms to receive automatic firmware updates,
and the fact that firmware are often forgotten about once installed
Once having identified the industrial assets mainly involved
(owners do not know when their devices are used for malicious
into cybersecurity issues in Industry 4.0 contexts (in other
purposes or when firmware need to be updated) [17].
words, what needs to be protected), this section takes
Jansen [17] pinpoints the following reasons as cause of most
advantages of:
industry devices get hacked:
1 The definition of the intrinsic vulnerabilities of the systems that
 Devices in many plants run for weeks or months without any
undermine their security;
security updates or anti-virus tools;
2 The cyber threats affecting the systems;
 Many of the controllers used in ICS networks can be disrupted by
3 The risks associated with the cyber-attacks;
malformed network traffic or even by high volumes of correctly-
4 The countermeasures to deal with cybersecurity issues.

These elements are all associated with the cybersecurity

concept (see Fig. 6). In particular, (1) and (2) answer the
question “what is to be protected against?”; (3) highlights the
potential risks for the company due to the exploitation of the
system vulnerabilities at the hand of cyber-attacks (that is,
“what are the impacts?”); finally, (4) answers the question
“how should you protect yourself?”.

5.1. Systems vulnerability

Vulnerabilities are defined by Jansen and Jeschke [52] as

weaknesses in the IT or automation systems that might be
exploited by hackers to compromise the cyber-physical
system. In a more general perspective, NIST (National Institute
of Standards and Technology) glossary of key information
security terms [7] refers to vulnerability as weakness in an
information system, system security procedures, internal
controls, or implementation that could be exploited or
triggered by a threat source.
Vulnerabilities can be classified referring to remote access,
software and Local Area Network (LAN) [47], and can be
associated with both virtual machines belonging to cloud
resources and IT systems [21].
Fig. 6. Cybersecurity characterization.
 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 103

formed traffic since they were designed in an era when Furthermore, Roy et al. [43] consider three main layers in which
cybersecurity was not a concern; cybersecurity threats could act:
 Many ICS networks have multiple pathways through which
cyber-security threats can enter, bypassing existing cyberse- 1 Aware execution layer (i.e. from sensors and actuators);
curity measures (for instance, laptops which are carried in and 2 Data transport layer (i.e. from network architecture);
out of facilities or USB sticks which are used among multiple 3 Application control layer (i.e. from user data storage).
computers, without being properly checked for malware);
 Many ICS networks are still implemented as a large, flat In particular, the first layer includes physical attacks, equipment
network, with no physical or virtual isolation between unrelated failures, failures of node power lines and electromagnetic
networks (allowing the spread of malware even to remote plant interferences. In the second layer, there are denial of service
sites). attacks, routing attacks, aggregation node attacks, flood attacks
(exhausting the network resources), black hole attacks, direction
In order to address these problems, companies should misleading attacks, Sybil attacks by adding malicious nodes.
undertake a vulnerability assessment process able to identify Finally, the third layer, characterized by unauthorized accesses and
and assess potential vulnerabilities of systems [54]. In particular, taking over control of machines, as well as by dispatching of
NIST [7] defines the vulnerability assessment as “systematic malicious code, entails the leakage of user privacy and data
examination of an information system or product to determine the confidentiality in data mining operations.
adequacy of security measures, identify security deficiencies, The German Federal Office for Information Security (Bundesamt
provide data from which to predict the effectiveness of proposed für Sicherheit in der Informationstechnik - BSI) identifies the
security measures, and confirm the adequacy of such measures following main categories of cyber threats referring to Industry
after implementation”. 4.0 contexts [21]:

5.2. Cyber threats  Direct attacks on external accesses;

 Indirect attacks on the IT systems of the service provider for
The NIST glossary defines threat as “any circumstance or event which the external access has been granted;
with the potential to adversely impact organizational operations  Unknown attack vectors without detection capabilities enabled
(including mission, functions, image, or reputation), organizational by unknown vulnerabilities (or zero-day exploits);
assets, individuals, other organizations, or the Nation through an  Non-targeted malicious software which infects components and
information system via unauthorized access, destruction, disclo- impairs in their functionality;
sure, modification of information, and/or denial of service” [7].  Intrusion into neighbouring networks or network segments (for
Attacks to interconnected physical systems can be character- instance, the existing office network).
ized by three dimensions [41]:
In addition to this, Jansen [49] and Jansen and Jeschke [52] refer
1 The type of attacker to the system (i.e. insider or outsider); to a number of targeted attacks to automation systems, attacks via
2 Attacker’s aims and objectives (i.e., destruction at a larger scale internet on decentralized control systems, unauthorized accesses
or on a specific target); from office to production network, malicious (re-) configurations
3 The attack mode (i.e., active or passive). (via remote access), and disruption of machine-to-machine
communications.
Regarding the attack mode, active attacks aim at making Summarizing information from the selected papers, the
changes to system resources or affecting system operations (some following Table 4 provides a list of cyber threats, which can affect
examples are Distributed Denial of Service attacks and Compro- Industrial Control Systems and Cyber Physical Systems.
mised-Key attacks); while, the passive attacks goal is to learn or In the literature, the most mentioned cyber threat is Denial of
make use of information from a system rather than making any Service attack. This attack makes the systems not respond to
changes on the system (this category includes eavesdropping and legitimate command from the network [54]. In particular, the
sniffing attacks) [54]. attackers flood the controller to force the system and change its

Table 4
Cyber threats list.

Cyber threats Reference

Transfer data from and to unauthorized devices [46,38,51,48]
Denial of Service (DoS) attack using massive traffic [46,47,38,39,40,51,54,55,27,25,42]
Escalation of privilege [47,38,42]
Data tampering, spoofing or man-in-the-middle attacks [38,42]
Eavesdropping or data interface [38,41,24]
Repudiation attacks [38,42]
Jamming, Collision, Fake Location Injection, Sybil, Node Replication, Wormhole, Sinkhole, False Routing Information, and Selective [48]
Forwarding
Malware, worms and viruses infection (in accidentally or intentionally way) [17,41,27,25]
Abnormal operations induction by using abnormal Distributed Network Protocol (DNP3) function code [46]
Scan DNP3 data points through changing object qualifier [46]
Zero-day attacks [47,55]
Phishing attacks [54,55,27,25,29]
Physical destructions [41,24]
Insider attacks and unwitting behaviours [41,27]
Advanced Persistent Threat (APT) [55,27,25]
Social engineering attacks [27]
104 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

behaviour. A common variant of DoS attacks is the Distributed 3 Remote access, which is one of the most common ways to
Denial of Service (DDoS) attack where the incoming traffic flooding penetrate the perimeter firewall. In such case, the use of Virtual
the victim originates from many different sources (multiple Private Network is recommended to isolate remote users in a
compromised computer systems). separate demilitarized zone.
Generally, once a cyber threat succeeds, it may occur an
unauthorized access to information systems, as well as confiden- Moreover, with the aim to keep the protection up-to-date, it
tial data [35,40,36,46,15]. In particular, this can result in: is necessary to continuously update the implemented security
controls on device level (installing new security patches),
 Unauthorized use, disclosure, disruption, modification, or network level (updating firewall signatures of new threat) and
destruction of critical data and/or data interfaces plant/ factory level (monitoring and analysing the actual log
[37,14,21,51,41,45,28,54]; sources) [52].
 Denial of service of networks and computers (in the worst case, In particular, Cheminod et al. [39] underline that the counter-
this may result in a reduced availability of the entire system) measures play a key role in protecting from unwanted accesses
[37,14,21,17]. from/to the Internet, as well as in separating some (critical)
services, within the plant, between the different areas of the plant,
between the different subsystems in the same area, and inside the
5.3. Risks production/automation cell at the shop floor level.
The following list of countermeasures can be followed in order
According to NIST [7], risk is “the level of impact on to detect or prevent the cyber-attacks occurrence within Industry
organizational operations (including mission, functions, image, 4.0. Table 6 results from the analysis of all selected papers.
or reputation), organizational assets, or individuals resulting from In the literature, encryption seems to be the most adopted
the operation of an information system given the potential impact countermeasures. This technique converts plain-text data into
of a threat and the likelihood of that threat occurring”. cipher-text, which can be decoded only by authorized parties who
Security risks related to information systems depend on the loss have a key. There are different levels of encryption [42,38]:
of confidentiality, integrity, or availability (known as “CIA triad”) of encryption of the communication between entities in a networked
information or information systems [49]. In particular, confidenti- production to mitigate tampering, information disclosure, and
ality refers to the ability to keep information secret from denial of service threats; encryption of stored data and use of
unauthorized users; in this way, the lack of confidentiality may digital signatures to mitigate repudiation attack; encryption of the
result in data disclosure. Integrity, which means to protect the data streams to deal with tampering with data, repudiation,
trustworthiness of data or resources, might entail deception information disclosure and denial of service.
attacks if it is not preserved. In this case, the risk concerns the
corruption or modification of records and data and data loss. At the
6. Managing of cybersecurity issues
end, availability represents the ability of a system to be accessible
and usable on demand; for this reason, when system availability is
In this section, an overview of the guidelines and solutions
not guaranteed, denial of service may occur (this causes a lack of
proposed by the selected papers to manage cybersecurity issues
productivity at the physical system).
within Industry 4.0 contexts is provided.
At the business level, cyber threats may have a certain number
These guidelines and solutions reflect the existence of a certain
of negative impacts (see Table 5).
number of security standards and guidance documents, which
The sabotage to the entire critical infrastructure or specific
create a common understanding of industry specific security
machines and components is the most cited business impact
controls and methods for assessing the effectiveness of such
among the analysed papers. This impact is strictly correlated to
controls [53]. In particular, the analysed papers mainly refer to:
DoS attacks, which in turn are the most mentioned in the
literature.
 NIST 800-53, which provides a set of security control categories
In general, any of the impacts identified translate into a drop in
and families (i.e. access control, awareness and training, audit
the company productivity and competitiveness (in terms of
and accountability, security assessment and authorization,
degradation of the product quality, reduction of production rate,
configuration management, contingency planning, identifica-
increasing of maintenance efforts, and delays to fulfil demand)
tion and authentication, incident response, maintenance, media
[45,27,54,23]. In other words, the company incurs in higher costs
protection, physical and environmental protection, planning,
and loss of profitability.
personnel security, risk assessment, system and services
acquisition, system and communications protection, system
5.4. Countermeasures
and information integrity, program management);
 IEC 62443 series of standards, which evaluates the potential
Countermeasures stands for a set of actions, devices, proce-
weak points in the overall organization, component and system
dures, or techniques that meet or oppose a threat, a vulnerability,
development process for Industrial Control Systems, with the
or an attack by eliminating or preventing it, by minimizing the
aim to identify threats and manage cyber risks;
harm it can cause, or by discovering and reporting it so that
 UL 2900 series of standards, which contains foundational
corrective action can be taken [7].
security requirements and testing criteria for software and
Jansen [17] refers to the following three high level approaches
devices within products.
to guarantee security of Industrial Control Systems:

1 Harden the perimeter, which means to isolate the plant network

from the office network with the use of firewalls and 6.1. Guidelines
demilitarized zone (DMZ) if necessary;
2 Defence in depth, by applying several layers of defence The following Table 7 gives a general view of the main
throughout the network, in order to stop and contain those guidelines in the field of cybersecurity that have been collected
malware breaching the perimeter. from the literature and that are later described.
 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 105

Focusing on the manufacturing industry, Huxtablea and risks visually, instead, Kobara [47] presents an improved attack
Schaefera [13] suggest that a firm should offer support to its tree approach, where the problem is shown as root and its sources
connected products, in particular in the fields of: as leaves; moreover, the severity level of each stage (node), the
transferability from one stage to another and the countermeasures
 Cybersecurity consulting to give advice and guidance with regard and their effects are also depicted.
to cybersecurity strategy at a top level; According to Ren et al. [54], a number of risks evaluation
 Risk management to prevent cyber-attacks; methods, as well as quantitative and qualitative methods to
 Threat monitoring and detection to provide software and calculate the likelihood of attacks on certain components of the
hardware that allow cyber threats to be monitored and detected; systems if other parts are attacked have been developed for
 Cyber incident response to limit damage and prevent further manufacturing systems. For instance, a typical risk evaluation
cyber-attack; method is the hierarchical model, which identifies potential
 Training to limit the likelihood of attacks taking place; vulnerabilities of a system on six layers: control, communication,
 Cybersecurity packages in relation to the products being sold network, supervisory and management. Moreover, some examples
(basic subscriptions might include anti-malware software as a of quantitative methods are those based on statistics (i.e. Bayesian
service, by offering for instance monitoring, detection and probability and Leontief-based models); while qualitative methods
training). provide a holistic view of the risks based on conceptual diagrams
and graphs.
In general, any security approach should pay attention on On the other hand, Preuveneers and Ilie-Zudor [42] and
network, transport and application levels. In particular, the focus Preuveneers et al. [38] model the networked production workflow
on network level aims at providing a secure and trustworthy as a dataflow diagram with the aim to carry out a STRIDE security
connection; transport level wants to guarantee nobody can read analysis, which is a threat modelling method developed by
along and even authenticate both sides; finally, application level Microsoft focusing on Spoofing, Tampering, Repudiation, Informa-
goal is to ensure security on the transmitted information even if tion disclosure, Denial of service, and Elevation of privilege.
there is no encryption on transport level [16]. Furthermore, Flatt et al. [21] adopt the process model of VDI/
In order to guarantee information security at any level, Sergey VDE guideline 2182 to consider IT security along the whole life
and Nikolay [58] recommend to follow a set of actions. These cycle of industrial systems. The model includes eight consecutive
actions include ranging the sources of information, classifying the steps (carried out in an iterative way), that is: identify assets,
objects of protection, describing the threats arising in case of determine relevant security objectives, analyse threats, analyse
unauthorized access to information and in case of malicious and assess risks, identify measures and assess effectiveness, select
change of information, and describing the influence preventing overall solution, implement and use overall solution, perform
unauthorized access and change of information, as well as the audit.
influence correcting the unauthorized access taking place and In order to deal with security issues in Industrial Control
change of information. Systems, a methodology for assessing vulnerabilities is proposed
Regarding the implementation phase of industrial security by Januario et al. [48]. This methodology entails:
services, instead, Jansen [49] explores four steps. The first step
consists of designing the service on the knowledge of automation  For each component, a complete network representation;
systems and their intended operational environment. Then, it is  For each subsystem, the definition of component's functionali-
necessary to define the operations of managed security services ties and decomposition in each subsystem that implements
addressing the customers’ needs, and implement the DevOps them;
approach able to integrate operational experience in development  For each operation, the list of the used resources and operations
process. Finally, the fourth steps entails the introduction of some that can affect them.
control loops to the socio-technical and economic systems of
industrial companies in order to bring the system (in case of Another methodology is that of CYBEX (Structured Cyberse-
disturbances) back into a stable state. curity Exchange) [58], which aims at protecting data exchange
between customers. In particular, this methodology is based on
6.2. Solutions five-level block model of data exchange:

In addition to the above guidelines, useful to start approaching 1 Information Description Block that describes all information
the cybersecurity issues within Industry 4.0 contexts, different required to be transferred between consumers, including a
cybersecurity solutions are proposed in the analysed papers. These format and language of the description;
solutions are referred to with a high variety of terms, such as 2 Information Discovery Block, which is responsible for definition
framework, approach, method, model, methodology and architec- and research of information on a source;
ture. In particular, Babiceanu and Seker [37] speak of Software- 3 Information Query Block, representing specially developed
Defined Networks-based (SDN-based) cybersecurity-resilience programming language of the protected inquiries of CYBEX;
mechanisms for manufacturing applications and proposes a 4 Information Assurance Block, which is focused on three
framework including the areas of system identification, resilience standards for certification of the protected sources (i.e. X.evcert,
objective setting, vulnerability analysis, and stakeholder engage- X.eaa and ETSI TS 102042 V2.0);
ment. At the same way, the NIST proposes a framework to address 5 Information Transport Block, based on the protocols standard-
and manage cybersecurity risks associated with Industrial Control ized by X.cybex-tp.
Systems. The NIST framework is comprised of five core functions (i.e.
identification, protection, detection, response, and recovery), with At the end, in the work of Bordel et al. [18] a functional
each being implemented through a set of security controls [25]. architecture to support a protection system for Industry 4.0
In relation to the highlighted approach, the DevOps approach is applications is described. The architecture is composed of five
mentioned in [52] as enabler of new industrial security business, elements. In particular, the predictive model represents the
where, for instance, the log sources for security monitoring of system’s state in a certain moment and at some future instants;
comparable asset classes are identified. In order to express security while, the analysis module allow comparing data to the real state of
106 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

the components in the system (the results of the comparison  Provide a new and comprehensive definition for both concepts,
process are employed to infer if the system is under a cyber- combining together all the keywords identified;
physical attack). Furthermore, the architecture includes a template
repository, enabling the description of different cyber-physical Moreover, the analysis of the industry type mainly involved into
attacks (and the security and protection policies associated with cybersecurity issues has showed the centrality of the manufactur-
the attacks); a distance function, which determines the set of ing industry (see Table 3). Here, Industrial Control Systems and
templates closer to the observations (made about the system); and Cyber-Physical System result as the main vulnerable systems to be
a decision-making module to select the protection method to be protected from cyber-attack events.
applied. A core part of the study regarded the cybersecurity characteri-
A schematic view of the cybersecurity solutions here described zation within Industry 4.0 (or IIoT) context. In particular, the
is provided in Table 8. systemvulnerabilities, the potential cyber threats, as well as the
risks associated with the cyber threats and the countermeasures
7. A framework for cybersecurity in I-4.0 to take into consideration have been analysed in the current
literature. The analysis of vulnerabilities has shown that security
In the literature, the cybersecurity and Industry 4.0 terms is not a priority for many manufacturers; for instance, they fault
started to be strongly correlated since 2015. This was revealed by passwords and open ports, do not care of firmware updates, or
the electronic scientific databases adopted in this study, which forget to monitor the firmware once installed. Furthermore,
gave back papers where both terms could appear in the title, another problem is correlated to the use of industrial devices
within the abstract, or as key words. (such as the controllers in the ICS networks) which were designed
In fact, although the Industry 4.0 paradigm was used for the first in an era when cybersecurity was not a concern. In general, the
time in Germany in 2011 during the Hannover Fair [60], the study has allowed to put in evidence that the most common
awareness of the relevance of cybersecurity issues for the vulnerabilities are those unknown (even known as zero-day
industrial physical systems connected into the network (and for vulnerabilities), which can be potentially placed in every
the industrial information correlated to them) has spread only interfaces between different components where there is an
some years later. Still today, this topic needs to be better information exchange. With the aim to better know and manage
investigated, in order to provide a more systematic view of its the systems vulnerabilities, companies should undertake a
main elements, and support the industrial management environ- vulnerability assessment process, able to determine the adequacy
ment to face the cybersecurity challenges. of security measures, identify security deficiencies, provide data
In the following Table 9, a summary of the findings based on the from which to predict the effectiveness of proposed security
study carried out is provided. measures, and confirm the adequacy of such measures after
The findings are organized in the four main areas of analysis implementation.
introduced in Fig. 4: analysis of cybersecurity and Industry 4.0/IIoT From the analysis of the cyber threats, a list of attacks affecting
definitions; study of the industrial context; characterization of ICS and CPS has been defined (see Table 4), where the most
cybersecurity in Industry 4.0 scenario; and identification of mentioned one is Denial of Service attack. Cyber threats can
management attempts with regard to cybersecurity issues. The potentially act on three main layers: the aware execution layer
analysis of these areas has presented some peculiarities, used to (involving, for example, sensors and actuators), the data transport
carry out the study and to address relevant considerations for layer (affecting the network architecture), and the application
future research. control layer (that is, for instance, the user data storage). In general,
Firstly, the analysis of the most representative definitions of any attack to interconnected physical systems should be charac-
‘cybersecurity’ have made it possible to create a properly taxonomy terized by specifying the type of attacker to the system, the
at the base of the study. Therefore, the words “cyberspace”, “cyber attacker’s aims and objectives, and the attack mode. Whether a
threats” and “cyber-attacks” have become part of the searching cyber-attack succeeds, the unauthorized use, disclosure, disrup-
criteria for papers selection. Then, the identification of some tion, modification, or destruction of critical data and/or data
keywords associated with the different Industry 4.0 and IIoT interfaces, as well as denial of service of networks and computers
definitions (collected form the selected papers) has allowed to: may occur.
Regarding the security risks originated by the cyber threats, it is
 Identify the enabling technological conditions (i.e., Internet of possible to state that they depend on the loss of confidentiality
Things and Cyber-Physical Systems for Industry 4.0, and wireless (data disclosure risk), integrity (risk of corruption or modification
sensor networks and cloud technologies for IIoT), a target of records and data loss) and availability of information or
industrial context (the manufacturing industry) and a specific information systems (denial of service risk). Moreover, the study of
condition enabled by the technologies referred to above (in the literature has made it possible to identify a set of impacts at the
particular, data networking for Industry 4.0, and IoT devices business level generated by the cyber threats occurrence (see
networking for the IIoT). This is reported in Tables 1 and 2; Table 5). These impacts may regard the sabotage to the entire

Table 5
Business impacts.

Business impacts Reference

Sabotage to the entire critical infrastructure or target machines and components (e.g., loss of observability, controllability or [47,42,38,40,41,52,45,29,55,27,23,59]
eventually the loss of power in the physical system)
Denial of service of networks and computers [28,16,27]
Theft of industrial trade secrets and intellectual property [8,16,55,27]
Compliance violation in the fields of safety and pollution [41,52,23]
Life-threatening situations for the workers [59,52]
 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 107

Table 6
Countermeasures list.

Countermeasures Reference
Encryption [47,42,38,51,24,26,54,27,53,23]
Fuzzing to detect software safety errors [47,53]
Obfuscation to obscure the intended meaning of communication by making the message difficult to understand [47]
Patching to solve security vulnerabilities or bugs in the systems [47]
Vulnerability scan [47]
Firewall/zoning, gateway and proxy [47,40,25,23]
Access control (i.e. user authentication, multiple-terminal authorization) [47,54,27,25,53]
Quarantine to isolate infected files on a computer's hard disk [47]
Isolation of data, language, sandbox, Virtual Machine (VM) and Operating System (OS) [54]
Physical resource-based isolation, also known as air gap [54]
Software updates [20,53]
Machine Learning (ML) method on physical data, covering k-Nearest Neighbours (kNN) algorithm, random forest algorithm and [44]
anomaly detection algorithm to real-time detect the malicious attacks
Physical protection through shielded wires for physical links and utilizing separated racks or spaces [54]
Tamper proof hardware to prevent attackers from altering system operations and conducting falsification of data [54,27]
Keep data distributed instead of centralising them into one, more vulnerable central storage point [27]
Local storage and analytics so that the raw data do not leave the hardware, and any analytics can be run locally [27]
Intrusion Detection System (IDS) and Intrusion Prevention System [25]
Secure Communication (Virtual Private Network, Secure Sockets Layer, IP Security) [25,53,22]
Antivirus and antimalware [25,53]
Vulnerability assessment (process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications [25]
and network infrastructures)
Known vulnerability testing [53]
Static source code analysis to look for software weaknesses [53]
Penetration testing to evaluate and exploit vulnerabilities [53]

critical infrastructure or machines and components (this is the firewall and demilitarized zone; the application of several layers of
most mentioned impact in the literature), denial of service of defence (defence in depth) throughout the network to stop and
networks and computers, the theft of industrial trade secrets and contain those malware breaching the perimeter; and the isolation
intellectual property, as well as compliance violation in the fields of remote users in a separate demilitarized zone through the use of
of safety and pollution, and life-threatening situations for the Virtual Private Network. Obviously, it is required to keep the
workers. protection measures up-to-date; this means to continuously
Finally, the countermeasures result necessary to prevent or update the implemented security controls on device level
eliminate the cyber threats. The countermeasures may concern: (installing new security patches), network level (updating firewall
the isolation of the plant network (harden the perimeter) by using signatures of new threat) and plant/ factory level (monitoring and

Table 7
Cybersecurity guidelines.

Guideline Reference
Providing support to connected products in the field of: cybersecurity consulting, risk management, threat monitoring, cyber incident response, training, [13]
cybersecurity packages.
Defining a security approach focusing on network level, transport level, and application level. [16]
Appling a set of actions (focused on information to be protected, the type of threats and the influence necessary to prevent or correct unauthorized accesses) [58]
in order to guarantee information security.
Respecting four main steps (design the service, definition of operations, implementation of DevOps, and introduction of control loops) with the aim to [49]
implement industrial security services.

Table 8
Cybersecurity solutions.

Solution Reference

Framework Framework based on the areas of system identification, resilience objective setting, vulnerability analysis, and stakeholder engagement. [37]
NIST framework comprises of five core functions: identification, protection, detection, response, and recovery. [25]
Approach DevOps approach identifies the log sources for security monitoring of comparable asset classes. [52]
Attack tree approach, where the problem is shown as root and its sources as leaves. [47]
Method Collection of a set of risks evaluation methods and quantitative and qualitative methods to calculate the likelihood of attacks on certain [54]
components of the systems if other parts are attacked.
STRIDE security analysis of Microsoft as a threat modelling method. [42,38]
Model Process model of VDI/VDE guideline 2182 that considers IT security along the whole life cycle of industrial system. [21]
Methodology Methodology for assessing vulnerabilities in Industrial Control Systems, which entails actions at the level of component, subsystem and [48]
operation.
CYBEX methodology is based on five-level block model of data exchange (Information Description, Information Discovery, Information Query, [58]
Information Assurance, and Information Transport) to protect data exchange between customers.
Architecture Functional architecture (including a predictive model, an analysis module, a template repository, a distance function, a decision-making [18]
module) to support a protection system for Industry 4.0 applications.
108 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

Table 9
Framework of references for cybersecurity research in I-4.0.

Area of analysis Topic Features

Analysis of definitions Cybersecurity Strictly correlated words: cyberspace, cyber threats and cyber-attacks.
Industry 4.0 Enabling technological conditions: Internet of Things and Cyber-Physical Systems.
Target industry: manufacturing.
Condition enabled by the technology: data networking.
Industrial Internet of Enabling technological conditions: wireless sensor networks and cloud technologies.
Things (IIoT) Target industry: manufacturing.
Condition enabled by the technology: IoT devices networking.
Study of industrial context Industry types Most frequently mentioned industry: manufacturing.
Industrial assets Main vulnerable systems: Industrial Control Systems (ICS) and Cyber-Physical System (CPS)
Analysis of cybersecurity in Industry System security Most common vulnerabilities: zero-day vulnerabilities.
4.0 (or IIoT) contexts vulnerability Suggestion: undertake a vulnerability assessment process.
Cyber threats Levels of action: aware execution layer, data transport layer, application control layer.
Main points to focus on: type of attacker, attacker’s aims and objectives, and attack mode.
Most mentioned cyber threat: Denial of Service attack.
Main consequences: unauthorized use, disclosure, disruption, modification, or destruction of critical data
and/or data interfaces; denial of service of networks and computers.
A list of attacks affecting ICS and CPS.
Risks Cause: loss of confidentiality, integrity and availability of information or information systems.
Risk typologies: data disclosure (loss of confidentiality); corruption or modification of records and data loss
(loss of integrity); denial of service (loss of availability).
Impacts at business level: sabotage to the infrastructure or machines and components; denial of service of
networks and computers; theft of industrial trade secrets and intellectual property; compliance violation
in the fields of safety and pollution; life-threatening situations for the workers.
Most mentioned business impact: sabotage to the infrastructure or machines and components.
Countermeasures Main categories: isolation of the plant network; application of several layers of defence; isolation of remote
users.
Main action: update the security controls on device level, network level and plant/ factory level.
Most mentioned countermeasure: encryption techniques.
A list of countermeasures.
Identification of management Cybersecurity Security standards and guidance documents: NIST 800-53, IEC 62443 and UL 2900.
attempts guidelines A set of guidelines to deal with cybersecurity issues.
Cybersecurity Security standards and guidance documents: NIST 800-53, IEC 62443 and UL 2900.
solutions A set of solutions to deal with cybersecurity issues.

analysing the actual log sources). From the literature review, a list for each area of analysis and summarizes them for providing an
of countermeasures has been drawn up (see Table 6), where the immediate prospect of synthesis useful to lead future research but
encryption results to be the most mentioned. also the managerial actions.
The last section of the study focused on the guidelines and Although a number of different solutions for dealing with
solutions in the literature to manage cybersecurity issues. In cybersecurity issues within Industry 4.0 have been already
general, it was noticed that there are a number of security developed (see Section 6.2), none of them take into consideration,
standards and guidance documents, which create a common at the same time, the three exposure layers of Cyber Physical
understanding of industry specific security controls and methods Systems (physical, network and computation) that could be abused
for assessing the effectiveness of such controls (e.g. NIST 800-53, by cyber-attacks. For instance, in the research of Flatt et al. [21], the
IEC 62443 and UL 2900 series of standards). In line with these physical aspects are treated but without an integration with
security standards, some attempts to manage cybersecurity have networking and computation processes; while, in the studies of
been done. Some of them aim to provide a high-level guide (target Preuveneers and Ilie-Zudor [42] and Preuveneers et al. [38] the
to the management area) in facing the argument (see Table 7); aspects of networking is treated without an integration with the
some others, instead, propose more structured solutions (see others elements of the system.
Table 8) which need to be customized to the specific industrial Moreover, papers analysed do not face cybersecurity theme
scenario. with a purely management perspective, but they focus on IT side. A
management perspective should support companies in the correct
8. Conclusions implementation of new organizational practices and initiatives of
change management.
This study explored the cybersecurity issues within Industry 4.0 Future research can use this study as reference framework to
contexts, using a structured approach for the literature review address investigation in the industrial field and enlarge the current
through a qualitative analysis of the contents coming from the state of art. From the managerial point of view, instead, the study
selected papers. In particular, the papers’ assessment focused on provides a shortcut to a complete view about cybersecurity in I-4.0
four areas of analysis. These areas involve: (1) the analysis of that can be used as basis for supporting the decision making
cybersecurity and Industry 4.0/IIoT definitions; (2) the study of process about cybersecurity issues but also a reference material for
industry type and industrial assets mainly affected by cyberse- training in IT department.
curity issues; (3) definition of systems vulnerabilities, cyber
threats, risks and countermeasures to be taken, with regard to References
Industry 4.0 scenarios; (4) identification of guidelines and more
structured solutions to deal with cybersecurity issues. [1] A. Behrendt, N. Müller, P. Odenwälder, C. Schmitz, Industry 4.0 Demystified—
Lean’s Next Level [Online]. [Accessed 12 June 2018] Available:, McKinsey &
As a result, a reference framework of the main features for each Company, 2017. https://www.mckinsey.com/business-functions/operations/
area was defined. The framework collects the most cited evidences our-insights/industry-4-0-demystified-leans-next-level.
 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110 109

[2] Cisco, Cisco 2018 Annual Cybersecurity Report, (2018) . [33] D. Sullivan, E. Luiijf, E.J.M. Colbert, Components of industrial control systems,
[3] H. Bauer, G. Scherf, V. von der Tann, Six Ways CEOs Can Promote Cybersecurity Cyber-security of SCADA and Other Industrial Control Systems, Springer,
in the IoT Age [Online]. [Accessed 12 June 2018] Available:, Cham, 2016, pp. 15–28.
McKinsey&Company, 2017. https://www.mckinsey.com/featured-insights/ [34] T. Lu, X. Guo, Y. Li, Y. Peng, X. Zhang, F. Xie, Y. Gao, Cyberphysical security for
internet-of-things/our-insights/six-ways-ceos-can-promote-cybersecurity- industrial control systems based on wireless sensor networks, Int. J. Distrib.
in-the-iot-age. Sens. Netw. 10 (6) (2014) p.17.
[4] E.C.S. Organisation, State of the Art Syllabus – Overview of Existing [35] A. Humayed, J. Lin, F. Li, B. Luo, Cyber-physical systems security—a survey, IEEE
Cybersecurity Standards and Certification Schemes, ECSO, 2017. Internet Things J. 4 (6) (2017).
[5] I. E. Commission, IEC Webstore [Online]. [Accessed 6 September 2018] [36] Y. Ashibani, Q.H. Mahmoud, Cyber physical systems security: analysis,
Available:, (2018) . https://webstore.iec.ch/publication/62122. challenges and solutions, Comput. Secur. 68 (2017) 81–97.
[6] A. Bryman, E. Bell, Business Research Methods, Oxford University Press, [37] R.F. Babiceanu, R. Seker, Cybersecurity and resilience modelling for software-
Oxford, 2015. defined networks-based manufacturing application, Service Orientation in
[7] NIST, Glossary of Key Information Security Terms, NISTIR 7298r, 2nd ed., Holonic and Multi-Agent Manufacturing. Studies in Computational
Richard Kissel, Gaithersburg, 2013. Intelligence, Springer, Cham, 2017, pp. 167–176.
[8] I. 27032:2012, Information Technology – Security Techniques – Giudelines for [38] D. Preuveneers, W. Joosen, E. Ilie-Zudor, Trustworthy data-driven networked
Cybersecurity, (2012) . production for customer-centric plants, Ind. Manag. Data Syst. 117 (10) (2017)
[9] E.U.A.F.N.a. ENISA, ENISA Overview of Cybersecurity and Related Terminology, 2305–2324.
(2017) . [39] M. Cheminod, L. Durante, L. Seno, F. Valenza, A. Valenzano, C. Zunino,
[10] ISACA, Cybersecurity Fundamentals Glossary, (2016) . Leveraging SDN to improve security in industrial networks, IEEE International
[11] C.o.N.S.S. CNSS, Committee on National Security Systems (CNSS) Glossary, Workshop on Factory Communication Systems - Proceedings, (2017) .
(2015) . [40] G. Corbò, C. Foglietta, C. Palazzo, S. Panzieri, Smart behavioural filter for
[12] A. Gilchrist, Industry 4.0 - The Industrial Internte of Things, Apress, Bangken, industrial internet of things, Mobile Networks and Application, Springer, 2017,
Nonthaburi, Thailand, 2016. pp. 1–8.
[13] J. Huxtablea, D. Schaefera, On servitization of the manufacturing industry in [41] A. Khalid, P. Kirisci, Z. Zeashan Hameed Khan, Z. Ghrairi, K.-D. Thoben, J.
the UK, Procedia CIRP 52 (2016) 46–51. Pannek, Security framework for industrial collaborative robotic cyber-physical
[14] H. He, C. Maple, T. Watson, A. Tiwari, J. Mehnen, Y. Jin, B. Gabrys, The security systems, Comput. Ind. J. 97 (2018) 132–145.
challenges in the IoT enabled cyber-physical systems and opportunities for [42] D. Preuveneers, E. Ilie-Zudor, Identity management for cyber-physical
evolutionary computing & other computational intelligence, 2016 IEEE production workflows and individualized manufacturing in industry 4.0,
Congress on Evolutionary Computation, (2016) . Proceedings of the ACM Symposium on Applied Computing Part F128005,
[15] E. Pontarollo, Industry 4.0: a new approach to industrial policy, L’industria 37 (2017) .
(3) (2016) 375–381. [43] R. Roy, R. Stark, K. Tracht, S. Takata, M. Mori, Continuous maintenance and the
[16] J. Daniels, B. Amaba, A. Sargolzaei, Industrial control system applications go future – foundations and technological challenges, CIRP Ann. Manuf. Technol.
mobile in the cloud, IAMOT 2016 - 25th International Association for 65 (2) (2016) 667–688.
Management of Technology Conference, Proceedings: Technology - Future [44] J. Yang, Y. Chen, W. Huang, Y. Li, Survey on artificial intelligence for additive
Thinking, (2016) . manufacturing, ICAC 2017 - 2017 23rd IEEE International Conference on
[17] C. Jansen, A review on the readiness level and cyber-security challenges in Automation and Computing, (2017) .
Industry 4.0, ACM SEEDA-CECNSM Conference 2017, (2017) . [45] S. Tedeschi, D. Rodrigues, C. Emmanouilidis, J. Erkoyuncu, R. Roy, A. Starr, A cost
[18] B. Bordel, R. Alcarria, D. Sánchez-de-Rivera, T. Robles, Protecting Industry 4.0 estimation approach for IoT modular architectures implementation in legacy
systems against the malicious effects of cyber-physical attacks, Computer systems, Procedia Manuf. 19 (2017) 103–110.
Science Book Series, Springer, Cham, 2017, pp. 161–171. [46] S. Lee, S. Lee, H. Yoo, S. Kwon, T. Shon, Design and implementation of
[19] H. Gao, Y. Peng, Z. Wen, K. Jia, H. Li, Cyber-physical systems testbed based on cybersecurity testbed for industrial IoT systems, J. Supercomput. (2017) 1–15.
cloud computing and software defined, Proceedings - 2015 International [47] K. Kobara, Cyber physical security for industrial control systems and IoT, IEICE
Conference on Intelligent Information Hiding and Multimedia Signal Trans. Inf. Syst. E99D (4) (2016) 787–795.
Processing, (2015) . [48] F. Januario, C. Carvalho, A. Cardoso, P. Gil, Security challenges in SCADA systems
[20] I. Mugarza, J. Parra, E. Jacob, Software updates in safety and security co- over wireless sensor and actuator networks, International Congress on Ultra
engineering, Computer Safety, Reliability, and Security, Springer, Cham, 2017, Modern Telecommunications and Control Systems and Workshops 2016,
pp. 199–210. (2016) .
[21] H. Flatt, S. Schriegel, J. Jasperneite, H. Trsek, H. Adamczyk, Analysis of the [49] C. Jansen, Stabilizing the industrial system: managed security services’
cyber-security of industry 4.0 technologies based on RAMI 4.0 and contribution to cyber-peace, IFAC-PapersOnLine 50 (1) (2017) 5155–5160.
identification of requirements, IEEE International Conference on Emerging [50] T. Ahram, A. Sargolzaei, S. Sargolzaei, J. Daniels, B. Amaba, Blockchain
Technologies and Factory Automation (2016). technology innovations, 2017 IEEE Technology & Engineering Management
[22] A. Gurtov, M. Liyanage, D. Korzun, Secure communication and data processing Conference (TEMSCON), (2017) .
challenges in the industrial internet, Balt. J. Mod. Comput. 4 (4) (2016) 1058–1073. [51] B. Diebera, B. Breilinga, S. Taurera, S. Kaciankab, S. Rass, P. Schartner, Security
[23] C. Sandberg, B. Hunter, Cyber security primer for legacy process plant for the robot operating system, Rob. Auton. Syst. 98 (2017) 192–203.
operation, 2017 56TH Annual Conference of the Society of Instrument and [52] C. Jansen, S. Jeschke, Mitigating risks of digitalization through managed
Control Engineers of Japan (SICE), (2017) . industrial security services, AI Soc. J. (2018) 1–11.
[24] P. Xu, S. He, W. Wang, W. Susilo, H. Jin, Lightweight searchable public-key [53] R. Chaturvedi, UL testing standards to mitigate cybersecurity risk  UL’s
encryption for cloud-assisted wireless sensor networks, IEEE Trans. Ind. Inf. 14 approach with complement to the other standards for SICE 2017, 017 56TH
(8) (2018) 3712–3723. Annual Conference of the Society of Instrument and Control Engineers of Japan
[25] A. Hassanzadeh, S. Modi, S. Mulchandani, Towards effective security control (SICE), (2017) .
assignment in the industrial internet of things, IEEE World Forum on Internet [54] A. Ren, D. Wu, W. Zhang, J. Terpenny, P. Liu, Cyber security in smart
of Things, (2015) . manufacturing: survey and challenges, 67th Annual Conference and Expo of
[26] C.J. Smith, The industrial internet of things and cyber security. An ecological the Institute of Industrial Engineers, (2017) .
and systemic perspective on security in digital industrial ecosystems, [55] A. Ren, D. Wu, W. Zhang, J. Terpenny, P. Liu, Securing manufacturing data in the
Petroleum and Chemical Industry Conference Europe Conference, (2017) . cloud, Manuf. Eng. Mag. 157 (1) (2016) 69–77.
[27] L. Urquhart, D. McAuley, Avoiding the Internet of insecure industrial things, [56] C. Occhiuzzi, S. Amendola, S. Manzari, G. Marrocco, Industrial RFID sensing
Comput. Law Secur. Rev.: Int. J. Technol. Law Pract. 34 (3) (2018) 450–466. networks for critical infrastructure security, European Microwave Week 2016:
[28] G.J. Palavicini, J. Bryan, E. Sheets, M. Kline, J. San Miguel, Towards firmware "Microwaves Everywhere" (2016).
analysis of Industrial Internet of Things (IIoT) - applying symbolic analysis to [57] L. Urquhart, D. McAuley, Cybersecurity implications of the industrial internet
IIoT firmware vetting, 2nd International Conference on Internet of Things, Big of things, Conference TILTing Perspectives 2017: Regulating a Connected
Data and Security, (2017) . World (2017).
[29] B. Van Lier, The Industrial Internet of Things and Cyber Security. An ecological and [58] M. Sergey, S. Nikolay, Cyber security concept for internet of everything (IoE),
systemic perspective on security in digital industrial ecosystems, 2017 21st 2017 Systems of Signal Synchronization, Generating and Processing in
International Conference on System Theory, Control and Computing, (2017) . Telecommunications, (2017) .
[30] NIST - National Institute of Standards and Technology. Cybersecurity [59] T.H. Szymanski, Securing the industrial-tactile internet of things with
framework - Critical Infrastructure Resources, 13 February 2018. [Online]. deterministic silicon photonics switches, IEEE Access 4 (2016).
[Accessed 22 March 2018] Available: NIST https://www.nist.gov/ [60] S. Pfeiffer, The vision of “Industrie 4.0” in the making—a case of future told,
cyberframework/critical-infrastructure-resources tamed, and traded, NanoEthics 11 (1) (2017) 107–121.
[31] X. Fan, K. Fan, Y. Wang, R. Zhou, Overview of cyber-security of industrial control [61] European Commission. Critical Infrastructure, [Online]. [Accessed 22 March
system, 2015 International Conference on Cyber Security of Smart Cities, 2018]. Available: European Commission https://ec.europa.eu/home-affairs/
Industrial Control System and Communications (SSIC), (2015) . what-we-do/policies/crisis-and-terrorism/critical-infrastructure_en
[32] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, A. Hahn, Guide to Industrial
Control Systems (ICS) Security, NIST - National Institute of Standards and
Technology, 2015.
110 M. Lezzi et al. / Computers in Industry 103 (2018) 97–110

Marianna Lezzi is a PhD student in Complex System Angelo Corallo received the M.Sc. degree in physics from
Engineering at the University of Salento. Her research is the University of Lecce, Lecce, Italy, in 1999. He is an
about the management of cybersecurity risks within Associated Professor with the Department of Innovation
Industry 4.0 contexts. She has been involved in European Engineering, University of Salento, Lecce, and is respon-
research projects (such as PRACTICE and TOREADOR) sible of CORELab (Collaborative hOlistic Research Ap-
based on the development of models for the management proach Laboratory) in the same University. His main
of Big Data belonging to aeronautical companies. She has research interests include technologies and organization-
experience in the definition of innovative business al strategies in complex industries, knowledge manage-
management methodologies and secure collaborative ment, and collaborative working environments in project
processes within the aeronautical supply chain. and process-based organizations, with specific reference
to the aerospace industry and languages, methodologies,
and technologies for knowledge modelling. He is coordi-
nator or scientific responsible of several research projects
such as: X@Work, Open Philosophies for Associative Autopoietic Digital Ecosystems
Mariangela Lazoi, PhD, is Researcher in Department of (OPAALS), Distributed Information Systems for Co-ordinated Service Oriented
Innovation Engineering, University of Salento. She re- interoperability (DISCORSO), Multichannel Adaptive Information system (MAIS),
ceived the Ph.D. degree in eBusiness from the University Knowledge-based Innovation for the Web Infrastructure (KIWI), Towards Evolving
of Salento, Lecce, in 2009. She is scientific responsible of Knowledge-based internetworked Enterprise (TEKNE) Extended Net-Lab (X-Net-
national research projects about new technologies Lab), Digital Business Ecosystem (DBE), Privacy-Preserving Computation in the
implementation in manufacturing and creative industries Cloud (PRACTICE), Secure Supply Chain Management (SecureSCM), Collaborative &
and is involved in European research projects about big- Robust Engineering using Simulation Capability Enabling Next Design Optimisation
data management and product-service system imple- (CRESCENDO), and TrustwOrthy model-awaRE Analytics Data platfORm (TOREA-
mentation. She is responsible of the area IT4Industry in DOR).
the CORELab (Collaborative hOlistic Research Approach)
in the University of Salento and collaborates with
different companies addressing tecno-organizational
solutions. Her research interests are product design
methods and tools, product lifecycle management, business process management
and collaborative tools.