Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda
Internet of Things (IoT)-enabled devices are becoming integrated into a significant and increasing proportion of critical infrastructures, changing the cybersecurity-risk landscape. Risk is being introduced to industry sectors such as transport, energy and manufacturing, with new attack surfaces exp...
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Journal article |
| Language: | English |
| Published: |
Association for Computer Machinery
2022
|
| _version_ | 1797110212342054912 |
|---|---|
| author | Axon, L Fletcher, K Schuler scott, A Stolz, M Hannigan, R El Kaafarani, A Goldsmith, M Creese, S |
| author_facet | Axon, L Fletcher, K Schuler scott, A Stolz, M Hannigan, R El Kaafarani, A Goldsmith, M Creese, S |
| author_sort | Axon, L |
| collection | OXFORD |
| description | Internet of Things (IoT)-enabled devices are becoming integrated into a significant and increasing proportion of critical
infrastructures, changing the cybersecurity-risk landscape. Risk is being introduced to industry sectors such as transport,
energy and manufacturing, with new attack surfaces exposed and potential for increased harm. Furthermore, risk and harm
arising in the Industrial IoT (IIoT) could propagate across interconnected organisations and sectors, resulting in systemic risk.
Aspects of this changing risk landscape are not addressed by current cybersecurity approaches, leaving cybersecuritycapability gaps. In this paper, we show how current and emerging cybersecurity needs in the IIoT align with a key industry
cybersecurity standard, the NIST Cyber Security Framework. The key capability gaps emerging in the IIoT are identified
based on our findings from a series of workshops with over 100 expert participants. We present a comprehensive research
agenda to enable researchers to prioritise research focus to address these gaps; this research agenda covers the full lifecycle
of IIoT development (design, implementation, use and decommission). Further, we conclude that there is a significant gap in
understanding of the nature of systemic risk, which should be a key priority if we are to develop effective solutions for
cybersecurity and safety in IIoT environments. |
| first_indexed | 2024-03-07T07:52:04Z |
| format | Journal article |
| id | oxford-uuid:b8063e1f-0a1b-4601-b72d-2af77894d5ec |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-03-07T07:52:04Z |
| publishDate | 2022 |
| publisher | Association for Computer Machinery |
| record_format | dspace |
| spelling | oxford-uuid:b8063e1f-0a1b-4601-b72d-2af77894d5ec2023-07-19T08:48:42ZEmerging cybersecurity capability gaps in the industrial internet of things: overview and research agendaJournal articlehttp://purl.org/coar/resource_type/c_dcae04bcuuid:b8063e1f-0a1b-4601-b72d-2af77894d5ecEnglishSymplectic ElementsAssociation for Computer Machinery2022Axon, LFletcher, KSchuler scott, AStolz, MHannigan, REl Kaafarani, AGoldsmith, MCreese, SInternet of Things (IoT)-enabled devices are becoming integrated into a significant and increasing proportion of critical infrastructures, changing the cybersecurity-risk landscape. Risk is being introduced to industry sectors such as transport, energy and manufacturing, with new attack surfaces exposed and potential for increased harm. Furthermore, risk and harm arising in the Industrial IoT (IIoT) could propagate across interconnected organisations and sectors, resulting in systemic risk. Aspects of this changing risk landscape are not addressed by current cybersecurity approaches, leaving cybersecuritycapability gaps. In this paper, we show how current and emerging cybersecurity needs in the IIoT align with a key industry cybersecurity standard, the NIST Cyber Security Framework. The key capability gaps emerging in the IIoT are identified based on our findings from a series of workshops with over 100 expert participants. We present a comprehensive research agenda to enable researchers to prioritise research focus to address these gaps; this research agenda covers the full lifecycle of IIoT development (design, implementation, use and decommission). Further, we conclude that there is a significant gap in understanding of the nature of systemic risk, which should be a key priority if we are to develop effective solutions for cybersecurity and safety in IIoT environments. |
| spellingShingle | Axon, L Fletcher, K Schuler scott, A Stolz, M Hannigan, R El Kaafarani, A Goldsmith, M Creese, S Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title | Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title_full | Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title_fullStr | Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title_full_unstemmed | Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title_short | Emerging cybersecurity capability gaps in the industrial internet of things: overview and research agenda |
| title_sort | emerging cybersecurity capability gaps in the industrial internet of things overview and research agenda |
| work_keys_str_mv | AT axonl emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT fletcherk emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT schulerscotta emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT stolzm emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT hanniganr emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT elkaafarania emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT goldsmithm emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda AT creeses emergingcybersecuritycapabilitygapsintheindustrialinternetofthingsoverviewandresearchagenda |