Internet of Things Meet Internet of Threats: New Concern Cyber Security Issues of Critical Cyber Infrastructure
Source abstract
Abstract
As a new area of technology, the Internet of Things (IoT) is a flagship and promising paradigm for innovating society. However, IoT-based critical infrastructures are an appealing target for cybercriminals. Such distinctive infrastructures are increasingly sensitive to cyber vulnerabilities and subject to many cyberattacks. Thus, protecting these infrastructures is a significant issue for organizations and nations. In this context, raising the cybersecurity posture of critical cyber infrastructures is an extremely urgent international issue. In addition, with the rapid development of adversarial techniques, current cyber threats have become more sophisticated, complicated, advanced and persistent. Thus, given these factors, prior to implementing efficient and resilient cybersecurity countermeasures, identification and in-depth mapping of cyber threats is an important step that is generally overlooked. Therefore, to solve cybersecurity challenges, this study presents a critical analysis of the most recent cybersecurity issues for IoT-based critical infrastructures. We then discuss potential cyber threats and cyber vulnerabilities and the main exploitation strategies adopted by cybercriminals. Further, we provide a taxonomy of cyberattacks that may affect critical cyber infrastructures. Finally, we present security requirements and some realistic recommendations to enhance cybersecurity solutions.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Misc Laboratory, College of New Technologies of Information and Communication, University of Constantine 2, Constantine 25000, Algeria
College of Information Technology, United Arab Emirates University, Al-Ain 15551, United Arab Emirates
References (94)
Show source-provided references
1. A survey on smart grid potential applications and communication requirements10.1109/TII.2012.2218253 ↗
2. A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications10.1109/JIOT.2017.2683200 ↗
3. Cloud computing applications for smart grid: A survey10.1109/TPDS.2014.2321378 ↗
4. IoT-based big data storage systems in cloud computing: Perspectives and challenges10.1109/JIOT.2016.2619369 ↗
5. Edge computing: Vision and challenges10.1109/JIOT.2016.2579198 ↗
6. Survey on fog computing: Architecture, key technologies, applications and open issues10.1016/j.jnca.2017.09.002 ↗
7. Hermann, M., Pentek, T., and Otto, B. (2016, January 5–8). Design principles for industries 4.0 scenarios. Proceedings of the IEEE 49th Hawaii International Conference on System Sciences (HICSS), Koloa, HI, USA.10.1109/HICSS.2016.488 ↗
8. A cyber-physical systems architecture for industry 4.0-based manufacturing systems10.1016/j.mfglet.2014.12.001 ↗
9. Internet of things in industries: A survey10.1109/TII.2014.2300753 ↗
10. Schneider, S., and Geng, H. (2017). The industrial internet of things (IIoT). Internet of Things and Data Analytics, John Wiley & Sons, Inc.10.1002/9781119173601.ch3 ↗
11. Industrial internet of things: Challenges, opportunities, and directions10.1109/TII.2018.2852491 ↗
12. Long-range communications in unlicensed bands: The rising stars in the IoT and smart city scenarios10.1109/MWC.2016.7721743 ↗
13. NIST Framework for Cyber-Physical Systems (2020, November 01). Release 1.0, NIST Cyber Physical Systems Public Working Group, Available online: http://www.nist.gov/.
14. Introduction to Industrial Control Networks10.1109/SURV.2012.071812.00124 ↗
15. Guide to industrial control systems (ICS) security
16. ENISA (2020, December 22). ICS SCADA. Available online: https://www.enisa.europa.eu/topics/critical-information-infrastructures-and-services/scada.
17. (2020, October 17). Cisco Visual Networking Index: Forecast and Trends. Available online: https://cloud.report/whitepapers/cisco-visual-networking-index-forecast-and-trends-2017-2022/9017.
18. (2020, October 17). Total Number of Device Connections by 2025. Available online: https://iotanalytics.com/state-of-the-iot-2020-12-billion-iot-connectionssurpassing-non-iot-for-the-first-time/.
19. The internet of things: A survey10.1016/j.comnet.2010.05.010 ↗
20. The internet of things for health care: A comprehensive survey10.1109/ACCESS.2015.2437951 ↗
21. Jimenez, J.I., Jahankhani, H., and Kendzierskyj, S. (2020). Health care in the cyberspace: Medical cyber-physical system and digital twin challenges. Digital Twin Technologies and Smart Cities, Springer.10.1007/978-3-030-18732-3_6 ↗
22. Smart grid technologies: Communication technologies and standards10.1109/TII.2011.2166794 ↗
23. Smart grid communication and information technologies in the perspective of Industry 4.0: Opportunities and challenges10.1016/j.cosrev.2018.08.001 ↗
24. Design techniques and applications of cyber physical systems: A survey10.1109/JSYST.2014.2322503 ↗
25. Logvinov, O., and Kim, S. IEEE Standards for an Architectural Framework for the Internet of Things (IoT), IEEE. Technical Report IEEE Std 2413-2019.
26. Machorro-Cano, I., Ramos-Deonati, U., Alor-Hernández, G., Sánchez-Cervantes, J.L., Sánchez-Ramírez, C., Rodríguez-Mazahua, L., and Segura-Ozuna, M.G. (2017, January 24–27). An IoT-based architecture to develop a healthcare smart platform. Proceedings of the International Conference on Technologies and Innovation, Guayaquil, Ecuador.10.1007/978-3-319-67283-0_10 ↗
27. Misra, S., Maheswaran, M., and Hashmi, S. (2017). Case studies of selected iot deployments. Security Challenges and Approaches in Internet of Things, Springer.10.1007/978-3-319-44230-3 ↗
28. Internet of things: A survey on enabling technologies, protocols, and applications10.1109/COMST.2015.2444095 ↗
29. A reliable IoT system for personal healthcare devices10.1016/j.future.2017.04.004 ↗
30. Singh, G. (2019). IoT for Healthcare: System Architectures, Predictive Analytics and Future Challenges. Handbook of Multimedia Information Security: Techniques and Applications, Springer.10.1007/978-3-030-15887-3_36 ↗
31. From smart objects to social objects: The next evolutionary step of the internet of things10.1109/MCOM.2014.6710070 ↗
32. Khan, R., Khan, S.U., Zaheer, R., and Khan, S. (2012, January 17–19). Future internet: The internet of things architecture, possible applications and key challenges. Proceedings of the IEEE 10th International Conference on Frontiers of Information Technology (FIT), Islamabad, Pakistan.10.1109/FIT.2012.53 ↗
33. Wu, M., Lu, T.J., Ling, F.Y., Sun, J., and Du, H.Y. (2010, January 20–22). Research on the architecture of Internet of Things. Proceedings of the IEEE 2010 3rd International Conference on Advanced Computer Theory and Engineering (ICACTE), Chengdu, China.
34. Internet of things: Architectural framework for ehealth security
35. A reference model for computer integrated manufacturing from the viewpoint of industrial automation10.1016/S1474-6670(17)51748-6 ↗
36. Knapp, E., and Langill, J. (2015). Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems. Industrial Network Protocols, Syngress. Available online: https://www.amazon.com/Industrial-Network-Security-Securing-Infrastructure/dp/1597496456.10.1016/B978-0-12-420114-9.00006-X ↗
37. Smart hospital based on internet of things10.4304/jnw.7.10.1654-1661 ↗
38. Middleware for internet of things: A survey10.1109/JIOT.2015.2498900 ↗
39. (2019, November 15). Kaspersky. Available online: https://www.kaspersky.com/about/pressreleases/2019_iot-under-fire-kaspersky-detects-more-than-100-million-attacks-on-smart-devices-in-h1-2019.
40. Kumar, M. (2014, January 22–24). Security issues and privacy concerns in the implementation of wireless body area network. Proceedings of the IEEE International Conference on Information Technology, Bhubaneswar, India.10.1109/ICIT.2014.73 ↗
41. Monitoring information security risks within health care10.1016/j.cose.2013.04.005 ↗
42. Andrea, I., Chrysostomou, C., and Hadjichristofi, G. (2015, January 6–9). Internet of Things: Security vulnerabilities and challenges. Proceedings of the IEEE Symposium on Computers and Communication (ISCC), Larnaca, Cyprus.10.1109/ISCC.2015.7405513 ↗
43. Internet of things security: A top-down survey10.1016/j.comnet.2018.03.012 ↗
44. Deogirikar, J., and Vidhate, A. (2017, January 10–11). Security attacks in IoT: A survey. Proceedings of the IEEE International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud, I-SMAC), Palladam, India.10.1109/I-SMAC.2017.8058363 ↗
45. Habib, K., and Leister, W. (2015, January 27–29). Threats identification for the smart internet of things in ehealth and adaptive security countermeasures. Proceedings of the IEEE 7th International Conference on New Technologies, Mobility and Security (NTMS), Paris, France.10.1109/NTMS.2015.7266525 ↗
46. A comprehensive study of security of internet-of-things10.1109/TETC.2016.2606384 ↗
47. Cyber security in the smart grid: Survey and challenges10.1016/j.comnet.2012.12.017 ↗
48. Cyber-Security Incidents: A Review Cases in Cyber-Physical Systems
49. Security of SCADA systems against cyber–physical attacks10.1109/MAES.2017.160047 ↗
50. A survey on security control and attack detection for industrial cyber-physical systems10.1016/j.neucom.2017.10.009 ↗
51. Coffey, K., Maglaras, L.A., Smith, R., Janicke, H., Ferrag, M.A., Derhab, A., and Yousaf, A. (2018). Vulnerability assessment of cyber security for SCADA systems. Guide to Vulnerability Analysis for Computer Networks and Systems, Springer.10.1007/978-3-319-92624-7_3 ↗
52. Threats, countermeasures and attribution of cyber attacks on critical infrastructures
53. Choraś, M., Kozik, R., Flizikowski, A., Hołubowicz, W., and Renk, R. (2016). Cyber threats impacting critical infrastructures. Managing the Complexity of Critical Infrastructures, Springer.10.1007/978-3-319-51043-9_7 ↗
54. Aikins, S.K. (2019). Managing Cybersecurity Risks of SCADA Networks of Critical Infrastructures in the IoT Environment. Security, Privacy and Trust in the IoT Environment, Springer.10.1007/978-3-030-18075-1_1 ↗
55. A Comprehensive Survey on Attacks, Security Issues and Blockchain Solutions for IoT and IIoT10.1016/j.jnca.2019.102481 ↗
56. Progressive researches on IoT security: An exhaustive analysis from the perspective of protocols, vulnerabilities, and preemptive architectonics10.1016/j.jnca.2020.102761 ↗
57. Industrial Control Systems Cyberattack trends and countermeasures10.1016/j.comcom.2020.03.007 ↗
58. Architecture and security of SCADA systems: A review10.1016/j.ijcip.2021.100433 ↗
59. A systematic review on Deep Learning approaches for IoT security10.1016/j.cosrev.2021.100389 ↗
60. A survey on IoT platforms: Communication, security, and privacy perspectives10.1016/j.comnet.2021.108040 ↗
61. Bécue, A., Praça, I., and Gama, J. (2021). Artificial intelligence, cyber-threats and Industry 4.0: Challenges and opportunities. Artif. Intell. Rev., 1–38.10.1007/s10462-020-09942-2 ↗
62. Anomaly events classification and detection system in critical industrial internet of things infrastructure using machine learning algorithms10.1007/s11042-020-10354-1 ↗
63. Cimpean, D., Cano Bernaldo de Quirós, P., and García Gutiérrez, F. (2012). Appropriate Security Measures for Smart Grids—Guidelines to Assess the Sophistication of Security Measures Implementation, European Union Agency for Network and Information Security. Available online: https://www.enisa.europa.eu/publications/appropriate-security-measures-for-smart-grids.
64. Pauna, A., and Moulinos, K. (2013). Window of Exposure... a Real Problem for SCADA Systems, European Union Agency for Network and Information Security. Available online: https://www.enisa.europa.eu/publications/window-of-exposure-a-real-problem-for-scada-systems.
65. Guide to industrial control systems (ICS) security
66. CPNI (2011). Good Practice Guide—Cyber Security Assessments of Industrial Control Systems, Centre for the Protection of National Infrastructure. Available online: https://www.ccn-cert.cni.es/publico/InfraestructurasCriticaspublico/CPNI-Guia-SCI.pdf.
67. Yastrebenetsky, M. (2014). IEC-62645 Nuclear power plant instrumentation and control systems for safety and security. International Electrotechnical Commission, IGI Global.
68. Bochtler, J., Quinn, E., and Bajramovic, E. (2017). Development of a New IEC Standard on Cybersecurity Controls for I&C in Nuclear Power Plants–IEC 63096, NPIC & HMIT. Available online: http://npic-hmit2017.org/wp-content/data/pdfs/158-20165.pdf.
69. American Gas Association (AGA) (2016). Cryptographic Protection of SCADA Communications, Background, Policies and Test Plan. AGA Report, American Gas Association. Available online: https://www.scadahacker.com/library/Documents/Standards/AGA.
70. Frankenberger, E. (2015). Cyber Security Forum Initiative (CSFI) (Air Traffic Control) (ATC), Cyber Security Project, Cyber Security Forum Initiative (CSFI). Available online: https://www.csfi.us/?p=projects.
71. (2016). Rail Cyber Security: Guidance to Industry. Rail Safety and Standards Board (RSSB), Crown. Available online: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/897091/rail-cyber-security-guidance-to-industry-document.pdf.
72. (2020, January 22). Global Business Fundamentals, Strategic Focus. Available online: https://www8.hp.com/us/en/hp-news/pressrelease.html?id=1744676#.YA0J36rdt0s.
73. (2020, July 30). Security Timelines and Statistics. Available online: https://www.hackmageddon.com/2020/09/24/july-2020-cyberattacks-statistics/.
74. (2020, July 30). Information Age, Topics Cybersecurity, 700 Million Attacks on Consumer Transactions Prevented in 2017. Available online: https://www.information-age.com/700-million-attacks-prevented-2017-123470383/.
75. (2020, July 30). Vectra Post-Intrusion Report. Available online: https://www.vectra.ai/press/vectra-networks-identifies-healthcare-as-the-industry-most-targeted-by-cyber-attacks.
76. Radcliffe, J. (August, January 30). Hacking medical devices for fun and insulin: Breaking the human SCADA system. Proceedings of the Black Hat Conference, Las Vegas, NV, USA.
77. Special issue on advanced persistent threat10.1016/j.future.2017.11.005 ↗
78. Assante, M. (2019). A data-driven analysis of vulnerabilities in our industrial and critical infrastructure. Global ICS IIoT Risk Report, CyberX-Labs. Available online: https://get.cyberx-labs.com/hubfs/Reports/CyberX.
79. (2021, January 22). Modicon Bus (Modbus), Modbus-Plus. Available online: http://www.modbus.org.
80. (2021, January 22). Distributed Network Protocol 3 (DNP3), DNP-Three. Available online: http://www.dnp3.org.
81. Berry, A., Homan, J., and Eitzman, R. (2020, November 25). WannaCry Malware Profile FireEye. Available online: https://www.fireeye.com/blog/threat-research/2017/05/wannacrymalware-profile.html.
82. A brief study of wannacry threat: Ransomware attack 2017
83. Kraszewski, K. (2019, January 28–31). SamSam and the Silent Battle of Atlanta. Proceedings of the IEEE 11th International Conference on Cyber Conflict (CyCon), Tallinn, Estonia.10.23919/CYCON.2019.8757090 ↗
84. Towards fourth industrial revolution impact: Smart product based on RFID technology10.1109/MIM.2017.7919135 ↗
85. Djenna, A., Saidouni, D., and Abada, W. (2020, January 20–22). A Pragmatic Cybersecurity Strategies for Combating IoT-Cyberattacks. Proceedings of the IEEE International Symposium on Networks, Computers and Communications (ISNCC), Montreal, QC, Canada.10.1109/ISNCC49221.2020.9297251 ↗
86. RSSI measurements for RFID tag classification in smart storage systems10.1109/TIM.2018.2791238 ↗
87. Kambourakis, G., Kolias, C., and Stavrou, A. (2017, January 23–25). The mirai botnet and the iot zombie armies. Proceedings of the IEEE Military Communications Conference (MILCOM), Baltimore, MD, USA.10.1109/MILCOM.2017.8170867 ↗
88. (2020, October 29). Mirai: What You Need to Know About the Botnet Behind Recent Major DDoS Attacks. Available online: https://www.symantec.com/connect/blogs/miraiwhat-you-needknow-about-botnet-behind-recent-major-ddos-attacks.
89. Herberger, C. (2020, October 29). The DNA of Modern IoT Attack Botnets, Radware 2019. Available online: https://www.cisco.com/c/dam/m/hr_hr/trainingevents/2019/ciscoconnect/pdf/radware_the_dna_of_mirai_modern_iot_attack_botnets_cisco.pdf.
90. Norbye, T. (2020, October 29). KV Engine Architectural Overview. Available online: https://github.com/couchbase/Memcached/blob/master/docs/Architecture.md.
91. Recognizing safety and liveness10.1007/BF01782772 ↗
92. (2020, October 29). IoT Devices Used in DDoS Attacks. Available online: https://www.ibm.com/blogs/internetof-things/ddos-iot-platformsecurity.
93. (2020, October 29). Kaspersky Labs—Global Research & Analysis Team Carbanak APT: The Great Bank Robbery. Available online: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf.
94. Schneier, B. (2021, March 13). Schneier on Security. Available online: https://www.schneier.com/books/secrets-and-lies-pref/.