journal article·2021-10-20Open access

Security Challenges in Industry 4.0 PLC Systems

Janusz Hajda, Ryszard Jakuszewski, Szymon Ogonowski

Applied Sciences· Volume 11· Issue 21

Abstract

The concept of the fourth industrial revolution assumes the integration of people and digitally controlled machines with the Internet and information technologies. At the end of 2015, more than 20 billion machines and devices were connected to the Internet, with an expected growth to half a trillion by 2030. The most important raw material for this digital revolution is data, which when properly stored, analyzed and secured, constitute the basis for the development of any business. In times of rapid industrial development, automation of production processes and systems integration via networks, the effective protection of the cyber-physical systems of a plant is particularly important. To minimize the risks associated with Internet access, one must define all the possible threats and determine their sources in the plant and block or minimize the possibility of sabotage or data loss. This article analyzes the security measures used in industrial systems. In particular, risk management and the study of the risk sources in terms of human, hardware and software aspects in networked PLC and SCADA systems are discussed. Methods of improving the architecture of industrial networks and their management are proposed in order to increase the level of security. Additionally, the safety of the communication protocols with PLCs in industrial control systems is discussed.
Source: crossref · Quality: baseline

Research context

OpenAlex topics: Digital Transformation in Industry · Smart Grid Security and Resilience · Blockchain Technology Applications and Security

SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.

Affiliations

Department of Measurements and Control Systems, Silesian University of Technology, Akademicka 16, 44-100 Gliwice, Poland

References (92)

Show source-provided references
1. Industry 4.0 and the current status as well as future prospects on logistics10.1016/j.compind.2017.04.002 ↗
2. Industry 4.0 Concept: Background and Overview10.3991/ijim.v11i5.7072 ↗
3. Industry 4.0 Impacts on Lean Production Systems10.1016/j.procir.2017.02.041 ↗
4. Industry 4.0: A survey on technologies, applications and open research issues
5. An Industry 4.0 Case Study in Fashion Manufacturing10.1016/j.promfg.2017.07.190 ↗
6. How will Change the Future Engineers’ Skills in the Industry 4.0 Framework? A Questionnaire Survey10.1016/j.promfg.2017.07.282 ↗
7. Towards Industry 4.0—Standardization as the crucial challenge for highly modular, multi-vendor production systems10.1016/j.ifacol.2015.06.143 ↗
8. Micklethwait, J., and Wooldridge, A. (2015). The Global Race to Reinvent the State, Penguin Press.
9. Berger, R. (2016). The Industrie 4.0 Transition Quantified. How the Fourth Industrial Revolution Is Reshuffling the Economic, Social and Industrial Model, Roland Berger.
10. Industry 4.0 as a Key Enabler toward Successful Implementation of Total Quality Management Practices10.3311/PPso.12675 ↗
11. How do industry 4.0 technologies influence organisational change? An empirical analysis of Italian SMEs10.1108/JMTM-04-2019-0135 ↗
12. Industry 4.0 and Society 5.0: Opportunities and Threats
13. Zengin, Y., Naktiyok, S., Kaygın, E., Kavak, O., and Topçuoğlu, E. (2021). An Investigation upon Industry 4.0 and Society 5.0 within the Context of Sustainable Development Goals. Sustainability, 13.10.3390/su13052682 ↗
14. Society 5.0 as a Result of the Technological Evolution: Historical Approach10.1007/978-3-030-25629-6_109 ↗
15. Benchmarking of Tools for User Experience Analysis in Industry 4.010.1016/j.promfg.2017.07.182 ↗
16. Jazdi, N. (2014, January 22–24). Cyber physical systems in the context of Industry 4.0. Proceedings of the 2014 IEEE International Conference on Automation, Quality and Testing, Robotics, Cluj-Napoca, Romania.10.1109/AQTR.2014.6857843 ↗
17. Production planning and scheduling in Cyber-Physical Production Systems: A review10.1080/0951192X.2019.1605199 ↗
18. A Cyber-Physical Systems architecture for Industry 4.0-based manufacturing systems10.1016/j.mfglet.2014.12.001 ↗
19. Learning Factory: The Path to Industry 4.010.1016/j.promfg.2017.04.022 ↗
20. Leyh, C., Martin, S., and Schäffer, T. (2017, January 3–6). Industry 4.0 and Lean Production—A Matching Relationship? An analysis of selected Industry 4.0 models. Proceedings of the 2017 Federated Conference on Computer Science and Information Systems, Prague, Czech Republic.10.15439/2017F365 ↗
21. Internet of Things (IoT): A vision, architectural elements, and future directions10.1016/j.future.2013.01.010 ↗
22. Internet of Things: A Survey on Enabling Technologies, Protocols, and Applications10.1109/COMST.2015.2444095 ↗
23. Internet of Things in Industries: A Survey10.1109/TII.2014.2300753 ↗
24. (2021, September 23). Industrial Internet of Things, A Quarterly Supplement of Automation World, August 2021. Available online: https://s3.amazonaws.com/public-files.cloud.pmmimediagroup.com/campaigns/34829/ads/86154/2108_IIOT_EBook_V2.pdf.
25. The Internet of Things for enterprises: An ecosystem, architecture, and IoT service business model10.1016/j.iot.2019.100078 ↗
26. Security risk management in IoT environment10.1080/09720529.2019.1642628 ↗
27. DVSMS: Dynamic value stream mapping solution by applying IIoT10.1007/s12046-019-1251-5 ↗
28. ETSI (2021, September 24). Cyber Security for Consumer Internet of Things. Available online: https://www.etsi.org/deliver/etsi_ts/103600_103699/103645/01.01.01_60/ts_103645v010101p.pdf.
29. Key Challenges in Cloud Computing: Enabling the Future Internet of Services
30. Cardoso, J., Barros, A., May, N., and Kylau, U. (2010, January 5–10). Towards a Unified Service Description Language for the Internet of Services: Requirements and First Developments. Proceedings of the 2010 IEEE International Conference on Services Computing, Miami, FL, USA.10.1109/SCC.2010.93 ↗
31. Beyond the hype: Big data concepts, methods, and analytics10.1016/j.ijinfomgt.2014.10.007 ↗
32. Big Data: A Survey10.1007/s11036-013-0489-0 ↗
33. Product Decision-Making Information Systems, Real-Time Big Data Analytics, and Deep Learning-enabled Smart Process Planning in Sustainable Industry 4.010.22381/JSME8320202 ↗
34. Edge Computing: Vision and Challenges10.1109/JIOT.2016.2579198 ↗
35. Bonomi, F., Milito, R., Zhu, J., and Addepalli, S. (2012, January 17). Fog computing and its role in the internet of things. Proceedings of the First Edition of the MCC Workshop on Mobile Cloud Computing, Helsinki, Finland.10.1145/2342509.2342513 ↗
36. A view of cloud computing10.1145/1721654.1721672 ↗
37. Muniswamaiah, M., Agerwala, T., and Tappert, C.C. (2021, January 26–28). Fog Computing and the Internet of Things (IoT): A Review. Proceedings of the 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2021 7th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom), Washington, DC, USA.10.1109/CSCloud-EdgeCom52276.2021.00012 ↗
38. A comparison between cluster, grid, and cloud computing
39. Privacy in cloud computing environments: A survey and research challenges10.1007/s11227-016-1953-y ↗
40. Cloud computing research: A review of research themes, frameworks, methods and future research directions10.1016/j.ijinfomgt.2017.07.007 ↗
41. Next generation cloud computing: New trends and research directions10.1016/j.future.2017.09.020 ↗
42. A cybersecurity framework to identify malicious edge device in fog computing and cloud-of-things environments10.1016/j.cose.2017.08.016 ↗
43. Security and Privacy for Cloud-Based IoT: Challenges10.1109/MCOM.2017.1600363CM ↗
44. Blockchain mechanisms for IoT security
45. Perspectives on emerging directions in using IoT devices in blockchain applications10.1016/j.iot.2019.100079 ↗
46. Narayanaswamy, T., Karthika, P., and Balasubramanian, K. (2021). Blockchain Enterprise: Use Cases on Multiple Industries. EAI/Springer Innovations in Communication and Computing, Springer.10.1007/978-3-030-76216-2_8 ↗
47. A literature review of blockchain technology applications in supply chains: A comprehensive analysis of themes, methodologies and industries10.1016/j.cie.2021.107133 ↗
48. A review of challenges and opportunities of blockchain adoption for operational excellence in the UK automotive industry
49. Avarciber: A framework for assessing cybersecurity risks10.1007/s10586-019-03034-9 ↗
50. A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.010.1109/ACCESS.2021.3056650 ↗
51. Cobot architecture10.1109/70.954751 ↗
52. Cobot programming for collaborative industrial tasks: An overview10.1016/j.robot.2019.03.003 ↗
53. Complexity-based task allocation in human-robot collaborative assembly10.1108/IR-11-2018-0231 ↗
54. Fernández-Caramés, T.M., and Fraga-Lamas, P. (2020). Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era. Appl. Sci., 10.10.3390/app10165607 ↗
55. Thames, L., and Schaefer, D. (2017). Industry 4.0: An Overview of Key Benefits, Technologies, and Challenges. Hybrid Manufacturing Processes, Springer.10.1007/978-3-319-50660-9_1 ↗
56. Ogonowski, S., Ogonowski, Z., and Pawełczyk, M. (2018). Multi-Objective and Multi-Rate Control of the Grinding and Classification Circuit with Electromagnetic Mill. Appl. Sci., 8.10.3390/app8040506 ↗
57. Langmann, R., and Rojas-Pena, L.F. (2016, January 24–26). A PLC as an Industry 4.0 component. Proceedings of the 2016 13th International Conference on Remote Engineering and Virtual Instrumentation (REV), Madrid, Spain.10.1109/REV.2016.7444433 ↗
58. Langmann, R., and Stiller, M. (2019). The PLC as a Smart Service in Industry 4.0 Production Systems. Appl. Sci., 9.10.3390/app9183815 ↗
59. Yamada, T., Nakano, T., Kaji, T., and Tano, S. (2020, January 23–26). Security Introduction Framework for Operational Technologies and Applying to Industrial Control System. Proceedings of the 2020 59th Annual Conference of the Society of Instrument and Control Engineers of Japan (SICE), Chiang Mai, Thailand.10.23919/SICE48898.2020.9240268 ↗
60. Wagner, P., Hansch, G., Konrad, C., John, K.-H., Bauer, J., and Franke, J. (2020, January 8–11). Applicability of Security Standards for Operational Technology by SMEs and Large Enterprises. Proceedings of the 2020 25th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA), Vienna, Austria.10.1109/ETFA46521.2020.9212126 ↗
61. Alshaikh, M., Maynard, S., Ahmad, A., and Chang, S. (June, January 1). An Exploratory Study of Current Information Security Training and Awareness Practices in Organizations. Proceedings of the 50th Hawaii International Conference on System Sciences (2017), Waikoloa Village, HI, USA.10.24251/HICSS.2018.635 ↗
62. Gundu, T. (March, January 28). Acknowledging and Reducing the Knowing and Doing gap in Employee Cybersecurity Compliance. Proceedings of the International Conference on Cyber Warfare and Security, Stellenbosch, South Africa.
63. Using Design-Science Based Gamification to Improve Organizational Security Training and Compliance10.1080/07421222.2019.1705512 ↗
64. Evaluation of Cybersecurity Management Controls and Metrics of Critical Infrastructures: A Literature Review Considering the NIST Cybersecurity Framework10.1007/978-3-030-03638-6_23 ↗
65. European Union (2021, September 23). General Data Protection Regulation GDPR. Available online: https://gdpr-info.eu.10.4000/aam.4098 ↗
66. Jayakrishnan, G.C., Sirigireddy, G.R., Vaddepalli, S., Banahatti, V., Lodha, S.P., and Pandit, S.S. (2020, January 10–11). Passworld: A serious game to promote password awareness and diversity in an enterprise. Proceedings of the 16th Symposium on Usable Privacy and Se-curity, Boston, MA, USA.
67. Kuypers, M., and Maillart, T. (2018, January 18–19). Designing Organizations for Cyber Security Resilience. Proceedings of the 2018 the Workshop on the Economics of Information Security (WEIS), Innsbruck, Austria.
68. Risk Assessment for Industrial Control Systems Quantifying Availability Using Mean Failure Cost (MFC)10.1515/jaiscr-2015-0029 ↗
69. Stouffer, K., Falco, J., and Scarfone, K. (2011). Guide to Industrial Control Systems (ICS) Security.
70. CyberX Labs (2021, September 05). 2019 Global ICS & IIoT Risk Report. Available online: https://cdn2.hubspot.net/hubfs/2479124/CyberX%20Global%20ICS%20%2F%20IIoT%20Risk%20Report.pdf.
71. Human aspects of cyber security: Behaviour or culture change?10.69554/KMOS3545 ↗
72. (2021, September 05). Verizon 2020 Data Breach Investigations Report. Available online: https://enterprise.verizon.com/resources/executivebriefs/2020-dbir-executive-brief.pdf.10.1016/S1361-3723(20)30059-2 ↗
73. Cj, G., Pandit, S., Vaddepalli, S., Tupsamudre, H., Banahatti, V., and Lodha, S. (2018, January 28–31). PHISHY—A Serious Game to Train Enterprise Users on Phishing Awareness. Proceedings of the 2018 Annual Symposium on Computer-Human Interaction in Play Companion Extended Abstracts, Melbourne, Australia.10.1145/3270316.3273042 ↗
74. Takata, T., and Ogura, K. (2019, January 23–25). Confront Phishing Attacks—From a Perspective of Security Education. Proceedings of the 2019 IEEE 10th International Conference on Awareness Science and Technology (iCAST), Morioka, Japan.10.1109/ICAwST.2019.8923444 ↗
75. Reinheimer, B., Aldag, L., Mayer, P., Mossano, M., and Duezguen, R. (2020, January 10–11). An investigation of phishing awareness and education over time: When and how to best remind users. Proceedings of the Sixteenth Symposium on Usable Privacy and Security, Michigan, MN, USA.
76. Liberati, F., Garone, E., and Di Giorgio, A. (2021). Review of Cyber-Physical Attacks in Smart Grids: A System-Theoretic Perspective. Electronics, 10.10.3390/electronics10101153 ↗
77. Cyber-attacks against cyber-physical power systems security: State estimation, attacks reconstruction and defense strategy
78. Event-triggered resilient control for cyber-physical systems under periodic DoS jamming attacks10.1016/j.ins.2021.07.002 ↗
79. Tan, J., Bauer, L., Christin, N., and Cranor, L.F. (2020, January 15–19). Practical Recommendations for Stronger, More Usable Passwords Combining Minimum-strength, Minimum-length, and Blocklist Requirements. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual, Korea.10.1145/3372297.3417882 ↗
80. Design and Evaluation of a Cybersecurity Awareness Training Game10.1007/978-3-319-66715-7_19 ↗
81. (2020, June 20). Sunshine Coast Daily. Available online: https://www.sunshinecoastdaily.com.au/news/some-of-our-history-of-hacking-is-known-the-world-/3126317.
82. (2020, June 18). SecurityFocus. Available online: https://www.securityfocus.com/news/6767.
83. Johnson, R.E. (2010, January 8–10). Survey of SCADA security challenges and potential attack vectors. Proceedings of the International Conference for Internet Technology and Secured Transactions, London, UK.
84. Beyah, R., Formby, D., and Durbha, S. (2021, September 01). Out of Control: Ransomware for Industrial Control Systems. Available online: https://pdfs.semanticscholar.org/5add/591abd9b773c8176df41fceb920a485eff79.pdf.
85. Schwartke, H., Spenneberg, R., and Brüggemann, M. (2021, September 08). PLC-Blaster: A Worm Living Solely in the PLC. Available online: https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf.
86. (2021, September 05). SANS 2019 State of OT/ICS Cybersecurity Survey. Available online: https://www.forescout.com/resources/2019-sans-state-of-ot-ics-cybersecurity-survey.
87. Murchu, L.O., Falliere, N., and Chien, E. (2021, September 08). W32.Stuxnet Dossier. 2010 Symantec Security Response. Available online: https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf.
88. F-Secure (2021, September 08). Threat Description Backdoor: W32/Havex. Available online: https://www.f-secure.com/v-descs/backdoor_w32_havex.shtml.
89. TrendMicro (2021, September 05). The State of SCADA HMI Vulnerabilities. Available online: https://www.trendmicro.com/vinfo/pl/security/news/vulnerabilities-and-exploits/the-state-of-scada-hmi-vulnerabilities.
90. SecureList (2021, September 08). The Flame: Questions and Answers. Available online: https://securelist.com/the-flame-questions-and-answers/34344.
91. F-Secure (2021, September 08). Threat Description Backdoor: W32/Duqu. Available online: https://www.f-secure.com/v-descs/backdoor_w32_duqu.shtml.
92. (2021, September 28). SIMATIC HMI WinCC Basic Options, System Manual. Available online: https://cache.industry.siemens.com/dl/files/233/109736233/att_879853/v1/WinCC_BasicOptions_en-US_en-US.pdf.