A Security, Privacy and Trust Methodology for IIoT
The implements of IoT and industrial IoT (IIoT) are increasingly becoming the consensus with Industry 4.0. Relevant data-driven methodologies are typically concentrated on the scoring systems of CVE prioritization schemes, the scoring formulas of CVSS metrics, and other vulnerability impact factors....
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Faculty of Mechanical Engineering in Slavonski Brod, Faculty of Electrical Engineering in Osijek, Faculty of Civil Engineering in Osijek
2021-01-01
|
| Series: | Tehnički Vjesnik |
| Subjects: | |
| Online Access: | https://hrcak.srce.hr/file/375488 |
| _version_ | 1827282320748445696 |
|---|---|
| author | Lifeng Chen Zhixiao Ye Shanyue Jin* |
| author_facet | Lifeng Chen Zhixiao Ye Shanyue Jin* |
| author_sort | Lifeng Chen |
| collection | DOAJ |
| description | The implements of IoT and industrial IoT (IIoT) are increasingly becoming the consensus with Industry 4.0. Relevant data-driven methodologies are typically concentrated on the scoring systems of CVE prioritization schemes, the scoring formulas of CVSS metrics, and other vulnerability impact factors. However, these prioritized lists such as the CWE/SANS Top 25 suffer from a critical weakness: they fail to consider empirical evidence of exploits. Considering the distinct properties and specific risks of SCADA systems in IIoT, this paper overcomes the inherent limitation of IIoT empirical research which is the sample size of exploits by collecting data manually. This study then developed an exploits factors-embedded regression model to statistically access the significant relationships between security, privacy, and trust-based vulnerability attributes. Through this data-driven empirical methodology, the study elucidated the interactions of security, privacy, and trust in IIoT with professional quantitative indicators, which would provide grounds for substantial further related work. In addition to the security privacy and trust regression analysis, this study further explores the impact of IoT and IIoT by difference-in-difference (DID) approach, applying bootstrap standard error with Kernel option and quantile DID test to evaluate the robustness of DID model. In general, the empirical results indicated that: 1) the CVSS score of vulnerability is irrelevant to the disclosure of exploits, but is positively correlated with CWEs by Density and CVE year, 2) among the exploits of SCADA-related authors, the more identical CWEs that exist in these exploits, the higher the CVSS score of the exploit CVE will be, and CVE year has a negative moderating effect within this relationship; 3) the CVSS scores of SCADA exploits have significantly decreased in comparison with non-SCADA after the promulgation of Industry 4.0. |
| first_indexed | 2024-04-24T09:16:11Z |
| format | Article |
| id | doaj.art-907c79082ce54216a508e14285b3451e |
| institution | Directory Open Access Journal |
| issn | 1330-3651 1848-6339 |
| language | English |
| last_indexed | 2024-04-24T09:16:11Z |
| publishDate | 2021-01-01 |
| publisher | Faculty of Mechanical Engineering in Slavonski Brod, Faculty of Electrical Engineering in Osijek, Faculty of Civil Engineering in Osijek |
| record_format | Article |
| series | Tehnički Vjesnik |
| spelling | doaj.art-907c79082ce54216a508e14285b3451e2024-04-15T16:57:16ZengFaculty of Mechanical Engineering in Slavonski Brod, Faculty of Electrical Engineering in Osijek, Faculty of Civil Engineering in OsijekTehnički Vjesnik1330-36511848-63392021-01-0128389890610.17559/TV-20210122095638A Security, Privacy and Trust Methodology for IIoTLifeng Chen0Zhixiao Ye1Shanyue Jin*2Department of Global Business Administration, Gachon University, Seongnam 13120, South KoreaCollege of Economics and Social Welfare, Zhejiang Shuren University, Hangzhou 310015, ChinaDepartment of Global Business Administration, Gachon University, Seongnam 13120, South KoreaThe implements of IoT and industrial IoT (IIoT) are increasingly becoming the consensus with Industry 4.0. Relevant data-driven methodologies are typically concentrated on the scoring systems of CVE prioritization schemes, the scoring formulas of CVSS metrics, and other vulnerability impact factors. However, these prioritized lists such as the CWE/SANS Top 25 suffer from a critical weakness: they fail to consider empirical evidence of exploits. Considering the distinct properties and specific risks of SCADA systems in IIoT, this paper overcomes the inherent limitation of IIoT empirical research which is the sample size of exploits by collecting data manually. This study then developed an exploits factors-embedded regression model to statistically access the significant relationships between security, privacy, and trust-based vulnerability attributes. Through this data-driven empirical methodology, the study elucidated the interactions of security, privacy, and trust in IIoT with professional quantitative indicators, which would provide grounds for substantial further related work. In addition to the security privacy and trust regression analysis, this study further explores the impact of IoT and IIoT by difference-in-difference (DID) approach, applying bootstrap standard error with Kernel option and quantile DID test to evaluate the robustness of DID model. In general, the empirical results indicated that: 1) the CVSS score of vulnerability is irrelevant to the disclosure of exploits, but is positively correlated with CWEs by Density and CVE year, 2) among the exploits of SCADA-related authors, the more identical CWEs that exist in these exploits, the higher the CVSS score of the exploit CVE will be, and CVE year has a negative moderating effect within this relationship; 3) the CVSS scores of SCADA exploits have significantly decreased in comparison with non-SCADA after the promulgation of Industry 4.0.https://hrcak.srce.hr/file/375488CVSS scoresSCADAindustrial IoT (IIoT)security privacy and trust |
| spellingShingle | Lifeng Chen Zhixiao Ye Shanyue Jin* A Security, Privacy and Trust Methodology for IIoT Tehnički Vjesnik CVSS scores SCADA industrial IoT (IIoT) security privacy and trust |
| title | A Security, Privacy and Trust Methodology for IIoT |
| title_full | A Security, Privacy and Trust Methodology for IIoT |
| title_fullStr | A Security, Privacy and Trust Methodology for IIoT |
| title_full_unstemmed | A Security, Privacy and Trust Methodology for IIoT |
| title_short | A Security, Privacy and Trust Methodology for IIoT |
| title_sort | security privacy and trust methodology for iiot |
| topic | CVSS scores SCADA industrial IoT (IIoT) security privacy and trust |
| url | https://hrcak.srce.hr/file/375488 |
| work_keys_str_mv | AT lifengchen asecurityprivacyandtrustmethodologyforiiot AT zhixiaoye asecurityprivacyandtrustmethodologyforiiot AT shanyuejin asecurityprivacyandtrustmethodologyforiiot AT lifengchen securityprivacyandtrustmethodologyforiiot AT zhixiaoye securityprivacyandtrustmethodologyforiiot AT shanyuejin securityprivacyandtrustmethodologyforiiot |