












































Microsoft Word - Alan-pregledano_188


ISSN 2744-1741 
Defense and Security Studies  Review Article 
Vol. 3, August 2022, pp.32-49 
https://doi.org/10.37868/dss.v3.id188 

This work is licensed under a Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/) that allows others 
to share and adapt the material for any purpose (even commercially), in any medium with an acknowledgement of the work's 
authorship and initial publication in this journal. 
 32 

 
 
Cybersecurity challenges in Industry 4.0: A state of the art review 
 
Elmedina Avdibasic1, Amanzholova Saule Toksanovna2, Benjamin Durakovic1* 
1 International University of Sarajevo, Bosnia 
2 International Information Technology University, Kazakhstan 
 
 

*Corresponding author E-mail: bdurakovic@ius.edu.ba

Received Jul. 22, 2021 
Revised Aug. 27, 2022 
Accepted Aug. 13, 2022 

Abstract 
Cybersecurity is an important topic for Industry 4.0, which will face a lot of non-
traditional challenges before it can be fully implemented to help society. The 
objective of the study is to recognize recent cybersecurity trends, newly occurring 
threats and challenges as well as their potential solutions. The articles reviewed in 
the paper are found through science direct, Scopus, Semantic scholar and google 
scholar. After reviewing them, ideas from articles were grouped together to show 
how different articles had similar thoughts. Through the analysis of 70 articles, it 
was found that cybersecurity still needs a lot of improvement in order to 
efficiently implement Industrial Internet of Things (IIoT), especially since many 
articles underline the need for security-by-design approach, followed by regular 
updating. Key challenges are lack of awareness and security experts, increased 
cybercriminal and the fact that the chain is as only as strong as its weakest point. 
Some of the most important solutions include incorporating security into design, 
stronger encryption, regular updates to patch vulnerabilities and good prevention 
and detection mechanisms. Once cybersecurity challenges are overcome, Industry 
4.0 will be able to bloom to its full extent. 

© The Author 2022. 
Published by ARDA. 

Keywords: Cybersecurity, Industry 4.0, Internet of Things (IoT), Artificial 
intelligence 

1. Introduction  
As humanity progressed throughout the time, the focus was always on developing better technologies. 
Purpose of industry revolutions is to improve production. The first industrial revolution brought us 
mechanization, second one introduced mass production, and third one was about automatization. Next in line 
is fourth industrial revolution, or as some like to call it, Industry 4.0. Some of the concepts of industry 4.0 is to 
make the machines smarter by introducing machine learning, and then interconnecting those machines so that 
the data can be exchanged between them. Therefore, the following core components of Industry 4.0 can be 
recognized [1]: 

1. Cyber-physical systems.  
Purpose is to combine networks and computers-which are cyber part, with manufacturing- which is 
physical-systems part. The idea is to have manufacturing processes under the surveillance of 
computers. 

2. Smart factory. 
A background system that manages the virtual and physical systems, gives almost real time feedback 
about manufacturing. It’s basically a self-sustaining factory that does not need intervention of 
humans. 

3. Internet of things. 



 DSS Vol. 3, August 2022, pp.32-49 

33 

Cooperation and communication of devices that are part of one cyber-physical system is provided 
through internet of things. They can share the data and help each other with problem solving. 

4. Internet of services. 
All the services that are needed are accessible through the Internet. 

There are few questions that arise when it comes to the challenges of Industry 4.0. The articles that are written 
about the Industry 4.0 and its challenges discuss these questions and their possible answers, ways to overcome 
these challenges. Do the companies have enough competent staff needed to shift to this new technology? Do 
they have the right infrastructure needed to make this change? Another very important question is regarding 
the data privacy, whether the shared data is safe. How to protect the consumer and consumers’ data? How 
secure are the clouds where the data will be uploaded, and how exactly is the data going to be manipulated? 
Cybersecurity surely is one of the biggest challenges that 4.0 will face [1]. Figure 1 shows the context of 
cybersecurity in the big picture of Industry 4.0 and Industrial Internet of Things (IIoT). 

 
Figure 1. Industry 4.0, IIoT and cybersecurity context 

Security needs to be integrated into the design. After releasing the initial product, its software needs to be 
updated regularly to patch up new vulnerabilities. Data encryption will need to be improved in order to keep 
data safe, and employees will need to be trained to keep up with new security measures. Lack of awareness 
could be a problem, so both users and employees will need to be educated about the importance of 
cybersecurity.  

Since the cybersecurity represent one of the biggest Industry 4.0 challenges thus, the purpose of this paper is 
to provide most recent advancement in cybersecurity for Industry 4.0. Therefore, the paper is structured as 
follow: Section 1.2.2 Section 2 explains methods that were used to choose the articles to be reviewed for this 
paper. Section 3 Results and Discussion, contains literature review with tables and diagrams with the actual 
article analysis. Ideas from the articles are grouped and combined into following topics: general information 
about Industry 4.0, hyperphysical systems, smart manufacturing, Internet of Things and cybersecurity for 
health system in Industry 4.0. At the end in section 4 conclusion is made. 

2. Method applied in study 
First database that was used to obtain sources used in this paper was sciencedirect.com. The key terms for 
search were “cybersecurity industry 4.0”. The total number of results were 344. Among the article types that 
had these keywords were editorials, review articles, book chapters and research articles. After filtering the 
search results, two different diagrams were created in Excel to visually present the popularity of the topic and 
areas of research where the topic was present. To choose among the huge number of articles and decide which 
articles will be used in the paper, the relevancy “test” was performed. Relevancy was determined in the 
following way: the article had to have words “cybersecurity” and “industry 4.0” in its title, and it had to be 
written over the period of past few years.  

Second part of the articles was found through Google Scholar, by searching the keywords “cybersecurity 
industry 4.0” and alternative version “security industry 4.0”. Among many articles that passed relevancy test 
on google scholar, 16 of them were chosen.   

Third database that was used for finding articles was Semantic Scholar, and it has turned out to be the one 
with the largest number of relevant recent studies.  



 DSS Vol. 3, August 2022, pp.32-49 

34 

Another way of finding articles was through the references of already chosen articles – if the article chosen 
was of good quality, it probably cited reliable, quality sources, so those were taken into the consideration as 
well, as long as they were written from 2015 onward.  

Since the topic of the paper is focused on current literature, the spotlight was on the papers written in the 
period from 2015 to present, since the papers written before that period are most likely not relevant anymore, 
or not as relevant as the ones written in the past few years. 

The first part of the actual research was to read the abstracts of articles, as well as summary/conclusion part of 
the article if it was available, since in many cases it provided information that was helpful in deciding whether 
the article was relevant to the topic and if it contained information that was worth including. After choosing 
the articles that would be reviewed for this paper, second step was to read full articles to gain better 
understanding of the topic. After that, main ideas were compared between different articles and important 
points in the articles were summarized. Information from articles were then grouped by similar topics.  

3. Results and discussion 
As found in the literature, topic of Cybersecurity for Industry 4.0 has been discussed/mentioned in 332 articles 
available there.  Popularity of this topic has certainly increased over the years, as can be seen from Figure 2 
below. Results from the first initial search are included in the diagram. 

 
Figure 2. Topic popularity 

Referring to Figure 2, it is observed that this research field is pretty young. The first paper publish was in 
2002 but since 2016 the number of publications is gradually increasing from year to year.   

Referring to Figure 2, it is observed that this field of research is quite new and emerging. The first work was 
published in 2002, but until 2015 there was no noticeable increase in the number of publications. Since 2016, 
the number of publications has been increasing significantly from year to year. Which is an indicator that the 
topic attracts more and more researchers from all over the world. Second diagram in  

Figure 3 shows the research areas where this topic was mentioned/written about. As expected, Computer 
science, Engineering and Decision Science are most frequent scientific areas in which articles appeared. 

 

0
50

100
150
200
250
300
350
400

2002 2007 2011 2013 2014 2015 2016 2017 2018 2019 2020 2021

N
um

be
r o

f a
rt

ic
le

s 

Year 

0 50 100 150 200 250 300 350 400 450 500

Materials Science
Chemical Engineering

Environmental Science
Psychology

Energy
Social Sciences

Business Management and Accounting
Decision Sciences

Engineering
Computer Science

Number of articles 



 DSS Vol. 3, August 2022, pp.32-49 

35 

Figure 3. Areas of research 

Below are shown tables that contain categorized research papers used in this review. Table 1 shows articles 
sorted by topic they were used for. 

Table 1. Division by topic 

Industry 4.0 Cyber-physical 
systems 

Smart 
manufacturing 

Internet of 
Things 

Healthcare 

Published article [56] [32] [26] [17] [59] [58] [57] [50] 
[33] [27] [25] [24] 
[18] 

[65] [64] [63] 
[62] [61] [60] 
[37] [35] [34] 
[22] [21] [20] 
[19] [13] [12] 
[11] [9] [8] [6] 
[5] 

[36] [66] [67] [68] 
[69] [70] 

Results obtained from articles, threats that would cause problems and possible solutions are specified in the 
tables down below, together with the references where those were mentioned. 

Table 2. Threats mentioned in articles 

Table 3. Solutions mentioned in articles 

Threats and challenges References 

Lack of awareness [45] [46] [47] 

Lack of experts [48][58] 

Companies are unprepared [60] 

Large attack surface due to many entry points [12][27][30] [68] 

Vulnerable device connected to a network [6][16][27][22] 

Weak link in a supply chain [25][59] 

Unsafe data exchange [23][26][49] 

Stealing sensitive data for private benefit [5][16][31][69][50][53][66][40][68] [70] 

Blackmailing [5][24] 

DoS attacks [13] [23] [61][6]  

Harming safety of people [51][16] [36][67] [68] 

Financial harm [5][16][52][69] 

Default passwords [21][34]  

Unsafe updates, or lack of [63] [12][35]  

Interruption in providing services due to connection 
being lost 

[11] [8] 

Solutions References 

Training employees, educating people  [48] [58] [15] [7] [3] 

Security-by-design [24] [15] 

Security embedded in layers [2] [3] 

Identifying most vulnerable spots and putting extra protection there [54] [17] [65] [41] 

Prevention and detection techniques [24] [15] [25] 

Additional authorization and authentication [4] [18] 



 DSS Vol. 3, August 2022, pp.32-49 

36 

 

1.1 Article analysis 
It is worth noting that throughout the paper, terms “Industry 4.0”, “industrial internet of things (IIoT)” and 
“digital manufacturing” will be used interchangeably. “Industrial internet of things” is the same as “Industry 
4.0” or the term “Smart manufacturing”, but it needs to be stated that industry 4.0 is a broader term than smart 
manufacturing is [38]. Even though cybersecurity is widely used word, the universal, standard definition for it 
doesn’t exist. It’s definitions vary and they can be subjective [44]. With that in mind, a couple of definitions 
are provided down below. The purpose of that is to show what meaning cybersecurity has in the further 
sections of this paper.   

1. Definition by Public safety Canada: “The body of technologies, processes, practices and response and 
mitigation measures designed to protect networks, computers, programs and data from attack, damage 
or unauthorized access so as to ensure confidentiality, integrity and availability [10].”  

2. Definition by Kaspersky, which is one of the leading companies that are taking care of cybersecurity: 
“Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, 
networks, and data from malicious attacks. It's also known as information technology security or 
electronic information security [42].” 

3. Definition by US government: “Cybersecurity is the art of protecting networks, devices, and data 
from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and 
availability of information [43].”  

Since vulnerability is mentioned very often throughout this paper, the definition of vulnerability is quoted as 
well. Vulnerability is:  “Weakness in an information system, system security procedures, internal controls, or 
implementation that could be exploited or triggered by a threat source [71].” Defense Advanced Research 
Projects Agency has stated that “Security Shield for Internet of Things” is among the 4 programs that are 
predicted to have impact bigger than the Internet had. This is probably due to the fact that IIoT connectivity 
will bring cybersecurity to another level because of the many non-traditional challenges it will face [28]. 

Among all the other challenges that Industry 4.0 will be facing, cybersecurity is one of the most serious ones. 
Since 4.0 introduces a lot of new concepts, it will not only have to deal with usual security problems that 
occur when certain system is connected to the internet, but it will also have to deal with security and privacy 
issues that will be unique and characteristic for Industry 4.0. That is what may make it harder to troubleshoot 
these problems, and unless these issues are properly taken care of, Industry 4.0 may not achieve its full 
potential [14] 

In one of the surveys about digital manufacturing, companies were asked about largest challenge they are 
facing while implementing digital manufacturing. Only 18% stated they were concerned about data security 
[45]. Annual WEF report regarding global risks stated for year 2019 that unfortunately a lot of tech companies 
didn’t see “security by design” as their primary interest, but as something secondary-their main goal was, 
expectedly, to put their goods on the market. For 2019, cyber-attacks were listed as the 5th in the list of the 
"top 10 risks" by likelihood, and 7th by the impact it would have [46]. As for the 2020 report, cyber-attacks 
were ranked 8 by impact and 7 by likelihood [39]. 

Direct-to-machine data transfer [18] 

Computational and cyber threat intelligence [54] [24] 

Stronger encryption [3] [63] [26] 

Blockchain technology [55] 

High availability through redundancy [8] 

Controlled areas [53] [40] 

Ditching default passwords [3] [62] 

Encouraging reporting vulnerabilities [3] [62] 

Regular updates [3] [64] [62] 

Certifying cybersecurity technologies [64] 



 DSS Vol. 3, August 2022, pp.32-49 

37 

It is important to raise the awareness of the importance of cybersecurity. If the idea of Industry 4.0 is 
implemented  and the machines and different phases of the production are connected, then it is also necessary 
for all the workers who are involved in the process of production  to be trained to understand and practice 
security requirements [15]. Right now in, in some environments cybersecurity is underestimated and is seen 
only as a “technical” problem, and many companies see it only as an additional, maybe even unnecessary cost 
that they are not eager to pay [47]. 

In one of the articles, it was mentioned how the security had the image of being a “trouble-maker” in 
traditional manufacturing environments [29]. However, cybersecurity in the Industry 4.0 has the opportunity 
to be seen as an enabler, something that could provide additional valuable services. Another article mentioned 
the same idea- cybersecurity produced opportunity for providing “additional services” in following way: due 
to cyber threats that come with new technologies, companies that are able to provide protection, security and 
reliability within their products can profit from that through “selling” those three promised features. However, 
developing technologies that would ensure the highest percentage of security may be pretty expensive, and if 
the awareness of importance of cybersecurity is not present, then the question is whether the customers would 
be willing to pay for such product [47]. 

Raising awareness is something that comes up whenever cybersecurity is mentioned. People will have to be 
trained to think of the cybersecurity intuitively. Just like a person checks left and right before crossing the 
street, it needs to become intuitive to check if the IoT device is secure enough, and that paying more for a 
secure device is worth it [7]. Another roadblock for adopting the Industry 4.0 security procedures beside lack 
of awareness is lack of security experts. People who already work in OT or IT security are experts in that area, 
but for Industry 4.0 they will need to be trained to work in new environments that Industry 4.0 brings with 
itself. There will also be need to raise awareness about security issues of new technologies, that are unlike any 
traditional security issues that they may have been facing. An ENISA recommendation for this is to raise 
awareness through training the employees and helping them transition, as well as educating the students 
through their courses about the importance of security in Industry 4.0, which would help with raising 
awareness and understanding [48]. Interconnecting different objects comes with a certain risk. In one of the 
articles, they give an example of business partners who are exchanging sensitive data [23]. Industry 4.0 should 
provide them with a safe space for the data exchange, however this space can be reached and attacked by 
outsiders, via DoS attacks that can interrupt the data flow and cause integrity issues. 

Compared to systems that are not interconnected, systems in the IoT environment pose a bigger threat due to 
the larger surface for cyber-attacks [30]. Up to the recent days, number of entry points was rather restricted. 
This made cybersecurity a lot easier to deal with, but still there were a lot of cyber-attacks happening. With 
IIoT happening any time now, traditional security measures that were in practice until now will need to be 
changed and improved to correspond to the huge scale of IIoT. Companies will now be in need of security 
measures that cover the whole system and all of the many entry points they have, so security will need to be 
implemented among many layers [2]. Another article supports the layered security approach and gives its 
suggestions. The security measures for each layer  that the article is recommending are following [3]: 

• network layer: using firewalls, antiviruses, use more secured wireless network like WPA2 and not 
WEP, using encryption when transferring data to the cloud, using many SSID-s. 

• Application layer: checking for CSRF vulnerabilities, as well as vulnerabilities in the versions of 
open-source libraries and third parties that an application is using, changing default password if an 
app is a service provided by some other company; using https, encryption, setting normal behavior 
which will help to later identify any abnormalities. 

• Device layer: updating firmware on time, changing any default passwords and configurations, testing 
the device regularly. 

• Physical layer: limiting access to certain areas by using secure keys/badges, using security cameras. 
• Human layer: training employees regularly, educating users on how to secure their devices, encourage 

employees and users to report any vulnerabilities they may find, and reward them for doing so. 

Among “the top ten privacy risks” are Information transfers that aren’t secure enough, collecting information 
unrelated to the main function, and possibly forwarding that and other information to the third parties [49]. 
There are different types of sensitive data that could be stolen. One of the worst scenarios mentioned in one of 
the articles was attackers stealing the information that is crucial for product design- basically stealing ideas for 
new products, as well as the instructions for manufacturing that product. This could also lead to the emerging 



 DSS Vol. 3, August 2022, pp.32-49 

38 

of more counterfeit products [50]. A threat can come from the inside as well. Employees who have access to 
the sensitive data can steal it and sell it to the outsider with the highest bid [31]. 

Cybersecurity is especially important when it comes to the idea of smart cities and buildings. Each building 
needs to be designed with security in mind, since all the systems will be connected. Control systems, security 
cameras, fire detectors, elevators, even electricity, and many other services that are provided could be 
compromised. The damages that could be done is interrupt in providing these services, which could harm 
safety of people and safety of sensitive information in the banks or other organizations. A way into the smart 
building could be hacking the most vulnerable spot, like smart TV, which wouldn’t be hard since up to date 
there aren’t any anti-virus/malware software for smart TVs [16]. As for the attacks on cars, they won’t need to 
be physical- a connected vehicle will have connections to the cloud, wireless and Bluetooth connections that 
could be compromised, and through these connections an outsider could meddle with car controls. The center 
of attention for security and protection will need to be transitioned from the physical aspect to the cyber-
attacks [51].  

Cybersecurity attacks leave a mark on the financial state as well. Kaspersky lab conducted a worldwide survey 
in 2017, and  reported that among the companies that endured cyber-attacks, 20% of them stated that harm on 
their finances has increased due to these attacks, and that lead them to increase their fund for cyber security 
systems [52]. To achieve a healthy and strong system that has effective cybersecurity, it is important to have 
cyber-attack prevention tactics, as well as detection methods and response procedures [25]. One of the 
solutions for physical control and data protection that was mentioned in two different articles was “controlled 
areas”, also called protected areas [40] [53]. Rooms where sensitive information is spoken so it can be heard 
need to be protected so that no outsider could get access to the data. To prevent third partied from hearing 
sensitive data, sound insulation can be implemented for those rooms. To prevent radio and electromagnetic 
signals that contain sensitive data from getting beyond the walls of protected rooms, the electromagnetic 
shielding for the rooms could be implemented as well. 

In order for the company to be ready to deal with cybercrime and defend from it, there are a couple of things 
they can do to ensure effective cybersecurity. A company needs to analyze what their most important assets 
are and then invest in protecting them. Cyber threat intelligence helps to prepare by analyzing when and 
where the threats could occur. There needs to be a constant improvement of cybersecurity. Topic of security 
needs to be a recurring element, a regular part of meetings and discussions [54].  

General solution for protecting the system as whole would be to estimate in advance what are the most 
vulnerable and the most critical parts of the network that need to be protected [41]. They say that earlier 
systems did not give much thought to the cybersecurity during their design phase. And now a different 
approach is needed, where the security would be integrated in the design. Instead of focusing on responsive 
actions that would need to be taken after a cyber-attack, they propose focusing on preventive policies that 
would provide security from the start [15]. Some of the measures that can help with assuring security would 
be authorization of the  software on the connected devices, authenticating the device prior to the data transfer 
to/from the cloud, and using firewalls [4]. A new approach to cybersecurity is using blockchain technology. It 
is famous for being used in bitcoin, and with its help, the transactions are more secure and safe. Users on the 
different ends of transaction don’t have to trust each other, and after the transaction is confirmed, it isn’t 
possible to reverse it. Due to its decentralized nature, blockchain is basically impossible to hack, which makes 
it safe and perfect to use in cybersecurity for Industry 4.0 [55]. 

3.1. Cyber – physical systems 
Industrial Control Systems (ICS) is a part of cyber-physical systems. Well performing ICS present a solid 
foundation for the success of Industry 4.0. ICS are category of control systems that are used for handling and 
automatization of industrial processes. With bigger connectivity comes a bigger risk of cyber-attacks, which 
means that ICS will need better security. As one article noted, South-east Asia had the largest percentage of 
ICS infections in 2018-61% of their devices were attacked in H1 of 2018, and 57.8% in H2 of 2018 [56].  

Number of articles suggest using CAD (computer aided design) in the process of creating cyber-physical 
model [32]. Together with offering a lot of amazing features, CAD model also comes with its own 
cybersecurity risks. One of the inevitable things regarding industry 4.0 is collaboration via cloud when 
developing new products. However, it is going to be a challenge to protect sensitive data about the model of a 
new product, if it is shared via cloud. One of the articles suggested using customized encryption for cloud-
shared CAD models. There would be two different types of users, owner of the model and its collaborators. 



 DSS Vol. 3, August 2022, pp.32-49 

39 

The way that the encryption would work is the owner of the model would upload to the cloud CAD model in 
encrypted form, and then collaborators can download the encrypted model from the cloud and decrypt it [26]. 

Another article offers the steps for managing the cybersecurity risks. First thing is to identify those risks, by 
identifying weaknesses, as well as possible threats. Second is analyzing those risks, by determining how likely 
is it for such situation to happen, as well as determining the possible impact of the risk. Third would be 
evaluating risks. What would the magnitude of the risk be, is the risk acceptable? Last step are risk controls, 
and it would be performed by implementing controls  for the risk [17].  
 
3.2. Smart factory 
The idea behind smart factory is to get more from the manufacturing by transitioning from the traditional way 
to the industry 4.0 way – creating a network of suppliers and a connected system that uses real-time data and 
adjusts the manufacturing so that the new demands can be met. That results with a system that is overall more 
efficient and that could rank better than the other competitors in market [57]. 

Smart factory, just like other parts of industry 4.0, will face certain challenges. Types of jobs that people will 
have in factory will evolve into something more complex, as the automation takes over the repetitive and dull 
jobs. Some may argue that automation presents a threat to the current job positions in manufacturing. 
However, the jobs will still remain, but the tasks that workers will do will change. Companies will need 
workers who will operate on new technologies that industry 4.0 will bring. Right now, they say that it’s hard 
to start implementing new digital technologies because there aren’t enough workers that have skills that are 
required to be able to run those technologies. Companies will eventually have to invest in training their 
employees and equipping them with skills needed to operate the new technologies. Apart from this challenge, 
another one will be dealing with cybersecurity [58]. Table  presents summary of results on key cybersecurity 
challenges for cyber-physical system and smart factory. 

Table 4. Key cybersecurity challenges for cyber-physical system and smart factory 

Challenge Result Reference

Manufacturing processes as 
potential risk. 

• Multiple connected suppliers may not have the same security 
levels. Probably smaller suppliers, will have weaker 
cybersecurity which will cause a threat to the rest of the 
connected suppliers. 

•  An outside attacker could identify the weakest link and use it 
to get access to the rest of the suppliers. 

•  92% of overall cyber-attacks for a year happened in a smaller 
organization. This would be a scenario likely to happen with 
Smart manufacturing supply chains where outsiders would 
attack smaller companies because of their vulnerability, 

• interconnections come with a certain risk but solution maybe 
to limit the communication between the machines or separate 
the machines that are used for production from the personal 
computers that are on the same network. 

[18], [25], 
[33], [50], 
[59]. 

Industrial Control Systems 
(ICS). 

• South-east Asia had the largest percentage of ICS infections in 
2018-61% of their devices were attacked in H1 of 2018, and 
57.8% in H2 of 2018  

• Collaboration via cloud when developing new products is 
challenge to protect sensitive data about the model of a new 
product 

• There would be two different types of users, owner of the 
model and its collaborators and the encryption would work 
CAD files uploaded to the cloud, and then collaborators can 

[17], [26], 
[56]. 



 DSS Vol. 3, August 2022, pp.32-49 

40 

Challenge Result Reference
download the encrypted model from the cloud and decrypt it. 

• Risk identification, analysis, evaluation and control are 
necessarily phased of the risk management. 

Smart factory challenges. • Companies have to be prepared for cybersecurity challenges 
such as: detection of viruses and malware before they get into 
system, and using computational intelligence for spotting and 
tracing threats like viruses and hackers that could lead to data 
manipulation, cyber stalking, blackmailing, executing 
terroristic acts, and other actions that may harm the system or 
parts of the system. 

• Industry 4.0 depends on data that is transmitted from sensors in 
real-time, which puts security at risk due to number of entry 
points that each network has and increases the potential 
number of weaknesses in the system and vulnerabilities that 
hackers may use.  

• Types of jobs that people will have in factory will evolve into 
something more complex, the jobs will still remain, but the 
tasks that workers will do will change.  

• Companies will need new talents who will operate on new 
digital technologies that industry 4.0 will bring. 

• Companies have to invest in training their employees and 
equipping them with skills needed to operate the new 
technologies.  

[24], 
[27]., 
[58],  

One of the articles says that security-by-design is mandatory for securing smart factories. It includes detection 
of viruses and malware before they get into system, and using computational intelligence for spotting and 
tracing threats like viruses and hackers that could lead to data manipulation, cyber stalking, blackmailing, 
executing terroristic acts, and other actions that may harm the system or parts of the system [24]. Industry 4.0 
depends massively on data that is transmitted from sensors in real-time. That puts security at risk because of 
many entry points that each network has, and then all of those networks are interconnected as well. This 
increases the potential number of weaknesses in the system and vulnerabilities that hackers may want to take 
advantage of [27].  

An example of a possible risk would be the connection of suppliers and their manufacturing processes [25]. 
Multiple suppliers are connected in a supply chain, and they probably will not have the same security levels-
some of them, probably the smaller suppliers, will have weaker cybersecurity which will cause a threat to the 
rest of the suppliers that are connected to that chain. An outside attacker could identify the weakest link in the 
chain and use their weak security in order to get access to the rest of the suppliers. In one of the reports, it was 
stated that 92% of overall cyber-attacks for that year happened to the smaller organizations. This would be a 
scenario likely to happen with Smart manufacturing supply chains (unless the security is better taken care of 
than it is now), where outsiders would attack smaller companies because of their vulnerability, and since they 
represent the easiest entry into the chain, that would lead them to bigger companies that are their actual target.  

These small companies would represent a risk for the bigger organizations since they could be easily attacked 
through them, despite the cybersecurity measures that they have accomplished in their own company [59]. 
Since interconnections come with a certain risk, one of the articles suggested that a solution would be to limit 
the communication between the machines, and limit the machines that can communicate with each other. 
Additionally, they could also separate the machines that are used for production from the personal computers 
that are on the same network, that way limiting the access [50]. 



 DSS Vol. 3, August 2022, pp.32-49 

41 

Several solutions for protecting critical data are offered throughout these articles. One of the solutions 
discussed the situation when certain data would need to be transferred through different layers, until it finally 
reaches the machine that executes it. Solution would be to skip all the unnecessary carriers of that data, and 
transfer it directly to the machine, with help of authentication and authorization. It would also strip off any 
non-essential data – only the information that is required for the execution would be given to the machine 
[18]. Also it is important to remove the walls between information technology sector and operations 
technology sector, and have them share the information with each other, since these two are the sectors that 
will be crucial for effective defense of Industry 4.0. Focal point for IT is CIA-confidentiality, integrity and 
availability, and OT mostly puts focus on availability. Issue with OT is that they lack room for adding 
cybersecurity into the equation in a way that wouldn’t have disadvantageous impact on production [33]. 

3.3. Internet of things 
One of the articles argues that the security is the number one challenge of IIoT [19]. One of the surveys that 
was conducted among 400 experts from four countries UK, Germany, US and Japan, concluded the following:  

• Regarding the IoT security, 75% stated it was important, however just 16% stated that the company 
they were working for is ready for it. 

• Companies were generally not prepared for each part of the security ensuring action, which consists 
of predicting, preventing, detecting and reacting.  

• Regarding the strategies for cybersecurity that can be applied to IoT as well, less than two thirds 
stated that they have one ready [60].  

Another article notes that systems that are part of IoT should from the very beginning be designed with 
possibility of integrating it with the other systems [20]. Protection measures need to be taken regarding 
protecting 3 things: device security, data security and privacy of the user. To protect the security of device, it 
needs to be saved from engaging in Distributed Denial-of-Service (DDoS) attacks and harming devices that 
are connected to the same network as that device. Protecting data means taking care of Confidentiality, 
Integrity and Availability (CIA) of information on the IoT device, ensuring its security while its being 
transferred and analyzed. Protecting users’ privacy means protecting the personally identifiable information 
that could possibly impact the user, either directly or indirectly [61]. 

Accountability is important when implementing security procedures since it distributes responsibilities and 
holds objects accountable for their actions. Accountability isn’t enough to prevent cyber-attacks from 
happening on its own, but it does help to make sure that the rest of security methods, such as confidentiality or 
integrity are functioning well [9]. As availability is one of the key features that cybersecurity keeps safe, 
availability for the crucial devices needs to be as close to the 100% as possible. A very high percentage of 
availability at all times can be accomplished through redundancy, which in essence means that in case that one 
part fails to provide service, then there exists a backup of that same part that can provide service instead [8]. 
Possibility of losing connectivity could interfere with proper functioning of IoT device, and potentially reduce 
its security. Extreme case would be inability of the device to function without the connection to the Internet. 
Solution that BITAG proposes is to configure device in a way that it can still fulfill its main purpose even in 
case of losing the connectivity [11]. Table 5 shows summary of results related to IoT device cybersecurity. 

Table 5. Review of key IoT device cybersecurity results 

Challenge Result Reference

IoT devices mass 
production.  

• Cost of producing IoT devices will decrease but update feature 
may be costly / impossible due to limited resources. 

• Updates of IoT devices are one of the possible places for the 
outsiders to attack. Updates need to be secured especially since 
they are usually arranged for a specific time slot and executed 
throughout the downtime. 

• More IoT devices means more entry points that can be hacked. 

[12], [35], 
[37], [63], 
[65]. 



 DSS Vol. 3, August 2022, pp.32-49 

42 

Challenge Result Reference

Unpreparedness for IIoT 
security. 

 

• IIoT security is the number one challenge. 
• Protection measures have to include: device security, data 

security and privacy of the user. 
• Protecting data means taking care of Confidentiality, Integrity 

and Availability (CIA) of information on the IoT device, 

[19], [20], 
[61]. 

Unpreparedness for IIoT 
security. 

 

• 400 experts from UK, Germany, US and Japan concluded that 
75% stated it was important, 16% stated they were working on 
it. 

• Companies were generally not prepared for each part of the 
security ensuring action, which consists of predicting, 
preventing, detecting and reacting 

• Regarding the strategies for cybersecurity that can be applied 
to IoT as well, less than two thirds stated that they have one 
ready. 

[60]. 

Employees smart devices 
(shadow devices) 
connected to organization’s 
network, without knowing 
of IT department. 

• These shadow devices are a door for hackers for entering the 
organization’s network. 

• 46% of organizations found shadow devices connected to their 
corporate network.   

• Only 25% of organizations haven’t discovered any shadow 
devices connected to their network. 

• It will be possible to turn many IoT devices into botnets and 
use a massive army of modems, controllers, routers and other 
devices to execute a DDoS attack. 

[13], [21], 
[22]. 

Default passwords. • Default passwords for commercial IoT devices could usually 
be found online in less than half an hour. 

• Most users want to buy a new technology, but they are too lazy 
to read the user manual and check how to change password or 
restrict access. 

[21], [34]. 

Home automation 
controllers and remote 
controllers for garage 
doors. 

• Hackers use that data from these devices identify perfect 
timing for executing robberies. 

• Criminals from these data when the user is at home and when 
the garage doors are opened / closed. 

[5]. 

Healthcare IoT devices. • Healthcare infrastructure is among the most frequently targeted 
industries for cyber-attacks. 

• Hackers can attack IoT medical devices and send commands to 
the device and to stop them working. 

• These devices are vulnerable harming patient’s privacy and 
breaking physician-patient confidentiality, and harming 
patients and possibly causing more health problems. 

• Medical information is attractive to attackers to be used to get 

[36], [66], 
[67], [68], 
[69]. 



 DSS Vol. 3, August 2022, pp.32-49 

43 

Challenge Result Reference
prescription medication and drugs that can be sold on Darknet, 
or occasionally contains the data that can be used for opening 
new bank accounts or taking out loans. 

Insufficient law regulations 
regarding IoT devices.  

 

IoT devices rules in UK law: 

• IoT devices passwords cannot be rosetted to the default factory 
settings. 

• IoT device manufacturer must come up with an easy and 
accessible way to contact them so that any new-found 
vulnerabilities and weaknesses in their products can be 
reported, and they have to respond in an appropriate amount of 
time. 

• IoT device manufacturer must declare minimum time before 
the device software becomes outdated and needs to be updated. 

[62]. 

Certification of IoT 
technologies. 

 

• European cybersecurity organization came up with the idea to 
certificate 

• IoT devices are always changing and in need of regular 
updates that would fix new-found vulnerabilities.  

• A one-time security certificate is not sufficient thus it has to be 
adjusted to implement an agile procedure for certificating such 
systems, that would make sure that its cybersecurity is updated 
and suited for the system at each point throughout its lifespan. 

[64]. 

Veracode conducted a study where it inspected six new always-on household IoT devices, most of them being 
controller device for home automation, and remote controllers for switches, garage doors and outlets. They 
found many vulnerabilities in the devices. One of the results said that hacking the data from home automation 
controllers and remote controllers for garage doors, criminals could know the pattern of when the user is at 
home or when the garage doors are opened and closed, and they could use that data to find perfect timing for 
executing robberies. Hacking into a central control device would enable them to set the microphone on so they 
can hear sensitive information that they can steal, or information they can later use for blackmailing [5].  

One of the threats for the IoT, that is already happening at this time are shadow devices. Basically, employees 
of a company bring their smart watches or fitness trackers which are IoT devices with themselves to the work, 
and then connect them to the organization’s network, without IT department knowing about it. They are 
usually not aware that those products pose a threat by being unregistered IoT device connected to the network. 
These devices can be used by hackers as a door for entering the network and committing cyber-crimes. 
Infoblox reported that in the previous year 46% of organizations found these shadow devices connected to 
their corporate network.  Only 25% haven’t discovered any shadow devices to be connected to their network 
[22]. If one device has weak points in its security, then it could put the whole network that it is connected to at 
risk. If that device is hacked, it can be used for DDoS attacks. Since IoT will enable a lot of devices connected 
to a network, it would mean that hacker would get the opportunity to recruit a big number of targets from one 
network and use them for attacks [6]. Another article claims the same thing, it will be possible to turn many 
IoT devices into botnets and use the massive army of modems, controllers, routers and other devices to 
execute a DDoS attack [13].  

Another issue are passwords. Users are not aware of importance of the security of their devices. Most of them 
just want to buy and use the new technology, but are too lazy to read the user manual and check how to 



 DSS Vol. 3, August 2022, pp.32-49 

44 

change password or restrict access [21]. Researchers have found that default passwords for commercial IoT 
devices could usually be found online in less than half an hour. The intention behind that was probably to 
make it easier for the user to set up their device, however the issue here is that the hackers can easily find this 
password too, and since users aren’t too keen on changing the default password, hackers have even more 
chance to easily take advantage of this “password protected” device. Another problem that was found was that 
devices that were produced by same companies had the same default passwords. The worst scenario is if it is 
impossible to change the password, because then the whole idea of password doesn’t make any sense [34]. 
Law regulations in UK will make it mandatory for IoT devices sold in UK to oblige to these 3 rules: 

1. All of the devices will need to have one-of-a-kind passwords that cannot be rosetted to the default 
factory settings.  

2. Producers of these devices have to come up with an easy and accessible way to contact them so that 
any new-found vulnerabilities and weaknesses in their products can be reported, and they have to 
respond in an appropriate amount of time.  

3. Producers have to declare minimum time before the device’s software becomes outdated and needs to 
be updated [62].  

One article notes that cost of producing IoT devices will decrease, and huge number of the devices will be 
produced, and more IoT devices means more entry points that can be hacked. Since update feature can be costly, 
or impossible due to the resource restrictions, new-found vulnerabilities will not be possible to fix. And if update 
is obtainable, some companies do not seem to be using encryption when downloading them to the devices, and 
all of these things pose a serious threat to the security of these devices [12].   

Another article agrees that it would be a huge threat to the security of device if it cannot receive an update 
once a vulnerability is identified. Another threat is if the data is in the clear text form while being transferred 
across the cloud, apps and networks. There needs to be a secure encryption for the data transfer to eliminate 
the possible threats of data stealing and manipulation [63]. One more article agrees that updates for IoT 
devices are one of the possible places for the outsiders to attack, especially since they are very different from 
the traditional updates that we have now. These updates need to be secured especially since they are usually 
arranged for a specific time slot and executed throughout the downtime [35].   

European cybersecurity organization came up with the idea to certificate IoT cybersecurity technologies. IoT 
devices and systems are dynamic, always changing and in need of regular updates that would fix new-found 
vulnerabilities. Due to these characteristics, a one-time security certificate could be of short lifetime, so 
strategy would be to adjust the certification to these characteristics and implement an agile procedure for 
certificating such systems, that would make sure that its cybersecurity is updated and suited for the system at 
each point throughout its lifespan [64]. 

One of the researchers claims that many household devices will become IoT devices, even though they would 
not need to be. The cost of producing a smart device using a chip will be only a dime. Since the cost will be so 
low, manufacturers will try to turn as many of these devices into smart ones, not for the benefits of users, but 
so that they can collect data with those chips [37]. Some argue that certain types of IoT devices should have 
increased security. Such devices are high risk IoT devices like ones made for children. Vulnerable people like 
children would not know how to deal with compromised devices, and they probably would not realize that 
they should report it. Another example of high-risk devices would be ovens and thermostats. If attacked, these 
devices could make more harm than other devices that are not high-risk [65]. 

3.4. Healthcare 
IoT devices can do a lot of good in healthcare by providing a more efficient diagnosing of the patients and 
collecting accurate data on patients’ status. However, these devices are also vulnerable to potential cyber-
attacks which would lead to harming patient’s privacy and breaking physician-patient confidentiality [66]. 
One of the threats that healthcare faces are attacks on their medical devices, services they provide and their 
infrastructure, that could affect safety and well-being of their patients, indirectly harming them and possibly 
causing more health problems, and in worst case scenario, even death [67]. Reports have shown that 
healthcare infrastructure is among the most frequently targeted industries for cyber-attacks. Right now, each 



 DSS Vol. 3, August 2022, pp.32-49 

45 

bed in a hospital is connected to up to 15 different medical devices that can be furtherly interconnected, which 
is already a relatively big number of entry points. Hackers exploit these points to get access to the data, and 
potentially to harm the patients. When the IIoT time comes, the surface available for cyber-attacks will only 
grow bigger, so healthcare is one of the industries that are going to need cybersecurity the most [68]. One of 
the reasons why hackers may attack healthcare systems is for financial benefit. It may be generally unknown, 
but data from the healthcare has bigger worth than other type of data. These illegally obtained medical 
identities are later utilized to get prescription medication and drugs that can be sold on Darknet. Medical 
information occasionally contains the data that can be used for opening new bank accounts or taking out loans 
[69].     

One of the parts of Industry 4.0 will be Smart Connected Health. It would lower the price of medical 
treatments, help to identify any abnormal changes in the patient through analysis of collected data, and 
generally boost the efficiency of the whole system. However, using IoT medical devices can also be 
dangerous since it could be possible for hackers to attack them and send commands to the device to stop 
working. This can be very harmful since certain devices, like cardiac devices are crucial for keeping a patient 
alive [36]. One of the studies has shown that during the period of time 2013-2017, 1512 data breaches 
happened in the USA, which affected records of 154 415 257 patients. Even though the percentage of data 
breaches caused by hacking incidents was below 25%, it was found that hacking was accountable for almost 
85% of the records that were affected. And this happened in the time when IoT was not there yet. As 
healthcare gets to implement the IoT technologies in the future, the incidents may get worse, unless the 
healthcare implements very strong cybersecurity technologies [70]. 

4. Conclusions 
Development of new technologies is what led to the Industry 4.0. Through making machines smarter, 
interconnecting them and combining cyber and physical systems, industry 4.0 will soon face its blooming 
phase. It will also face some challenges like cybersecurity that will force it to furtherly improve. 

This paper reviewed selected articles that discuss the cyber threats that Industry 4.0 will most likely face, as 
well as the possible solutions. Some of the threats for cybersecurity include lack of awareness, security not 
being incorporated into the design, poor encryption, default passwords and over-the-air updates. Major 
problems that Industry 4.0 will probably face are lack of experts on cybersecurity areas, stealing and 
manipulation of sensitive data, vulnerable points in the network chain that put the whole network at risk, 
DDoS attacks, as well as other types of cyber-attacks.  

Healthcare may face one of the more serious problems, where the health and safety of the patients might be 
compromised, beside their data that may be stolen. Apart from these challenges, there are also some good 
news and solutions for some of these problems. Some of them are layered security approach, stronger 
encryption, more frequent authentication and authorization of devices, as well as prevention, detection and 
response mechanisms regarding cyber-attacks. Suggestions include analyzing the system and detecting its 
vulnerable points and adding extra security around those. Through creating cyber-attack scenarios, companies 
will be able to identify possible breaches and find a way to stop them before they happen. And lastly, 
implementing law regulations that would guard the satisfactory security levels in the devices and certificating 
the cybersecurity software.  

One of the possible directions for the future research would be investigating how blockchain technology can 
be used for implementing better cybersecurity. Hyper connectivity is a double-edged sword – it will put many 
things at hand and help with efficiency of manufacturing and living in general, but it will also increase safety 
risks. As the Industry 4.0 is a growing industry, many more problems will emerge and new solutions will need 
to be found.  
 
Declaration of competing interest 
The authors declare that they have no any known financial or non-financial competing interests in any 
material discussed in this paper. 

Funding information 
No funding was received from any financial organization to conduct this research. 

 



 DSS Vol. 3, August 2022, pp.32-49 

46 

References 
[1] D. Mukerji, “Industry 4.0 Defined: 4 Core Components,” 2018. [Online]. Available: 

https://kingstar.com/industry-4-0-defined-4-core-components/. [Accessed: 24-May-2020]. 
[2] “Industry Agenda In collaboration with Accenture Industrial Internet of Things: Unleashing the 

Potential of Connected Products and Services,” 2015. 
[3] B. Russell et al., “Security Guidance for Early Adopters of the Internet of Things (IoT),” Mob. Work. 

Gr. Peer Rev. Doc., no. April, pp. 1–54, 2015. 
[4] R. Mahmoud, T. Yousuf, F. Aloul, and I. Zualkernan, “Internet of things (IoT) security: Current status, 

challenges and prospective measures,” in 2015 10th International Conference for Internet Technology 
and Secured Transactions, ICITST 2015, 2016, pp. 336–341, doi: 10.1109/ICITST.2015.7412116. 

[5] O. Charlie, “Internet of Things devices lack fundamental security, study finds,” ZDNet, 2015. [Online]. 
Available: http://www.zdnet.com/article/internet-of-things-devices-lack-fundamental-security-study-
finds/. 

[6] “Privacy & Security in a Connected World FTC Staa Report,” 2015. 
[7] D. Palmer, “IoT security: Why it will get worse before it gets better,” ZDNet, 2018. [Online]. 

Available: https://www.zdnet.com/article/iot-security-why-it-will-get-worse-before-it-gets-better/. 
[8] J. P. Nzabahimana, “Analysis of security and privacy challenges in Internet of Things,” in Proceedings 

of 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies, 
DESSERT 2018, 2018, pp. 175–178, doi: 10.1109/DESSERT.2018.8409122. 

[9] S. Aouad, A. Maizate, and A. Zakari, “Cyber Security and the Internet of Things : vulnerabilities and 
Security requirements,” Aouad Cyber Secur. Internet Things 1 Mediterr. Telecommun. J., vol. 9, no. 2, 
2019. 

[10] “Security and Prosperity in the Digital Age: Consulting on Canada’s Approach to Cyber Security.” 
[Online]. Available: https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/2016-scrty-prsprty/index-en.aspx. 
[Accessed: 01-Jun-2020]. 

[11] “Internet of Things (IoT) Security and Privacy Recommendations,” 2016. 
[12] R. H. Weber and E. Studer, “Cybersecurity in the Internet of Things: Legal aspects,” Comput. Law 

Secur. Rev., vol. 32, no. 5, pp. 715–728, Oct. 2016, doi: 10.1016/j.clsr.2016.07.002. 
[13] D. Palmer, “History repeating: How the IoT is failing to learn the security lessons of the past,” ZDNet, 

2016. [Online]. Available: https://www.zdnet.com/article/history-repeating-how-the-internet-of-things-
failed-to-learn-the-security-lessons-of-the-past/. 

[14] L. Thames and D. Schaefer, “Cybersecurity for Industry 4.0,” no. May, pp. 1–33, Apr. 2017, doi: 
10.1007/978-3-319-50660-9. 

[15] T. Pereira, L. Barreto, and A. Amaral, “Network and information security challenges within Industry 
4.0 paradigm,” Procedia Manuf., vol. 13, pp. 1253–1260, 2017, doi: 10.1016/j.promfg.2017.09.047. 

[16] R. Khatoun and S. Zeadally, “Cybersecurity and privacy solutions in smart cities,” IEEE Commun. 
Mag., vol. 55, no. 3, pp. 51–59, Mar. 2017, doi: 10.1109/MCOM.2017.1600297CM. 

[17] D. Glavach, J. LaSalle-DeSantis, and S. Zimmerman, “Applying and Assessing Cybersecurity Controls 
for Direct Digital Manufacturing (DDM) Systems,” 2017, pp. 173–194. 

[18] A. Wegner, J. Graham, and E. Ribble, “A New Approach to Cyberphysical Security in Industry 4.0,” 
2017, pp. 59–72. 

[19] L. Thames and D. Schaefer, “Industry 4.0: An Overview of Key Benefits, Technologies, and 
Challenges,” 2017, pp. 1–33. 

[20] J. Mehnen et al., “Practical Security Aspects of the Internet of Things,” 2017, doi: 10.1007/978-3-319-
50660-9_9. 

[21] D. Palmer, “Internet of Things security: What happens when every device is smart and you don’t even 
know it?,” ZDNet, 2017. [Online]. Available: https://www.zdnet.com/article/internet-of-things-
security-what-happens-when-every-device-is-smart-and-you-dont-even-know-it/. 

[22] D. Palmer, “Rogue IoT devices are putting your network at risk from hackers | ZDNet,” ZDNet, 2020. 
[Online]. Available: https://www.zdnet.com/article/rogue-iot-devices-are-putting-your-network-at-
risk-from-hackers/. [Accessed: 06-Feb-2020]. 

[23] J. E. Rubio, R. Roman, and J. Lopez, “Analysis of cybersecurity threats in Industry 4.0: the case of 
intrusion detection,” 2018. 

[24] H. He et al., “The security challenges in the IoT enabled cyber-physical systems and opportunities for 
evolutionary computing & other computational intelligence,” in 2016 IEEE Congress on Evolutionary 



 DSS Vol. 3, August 2022, pp.32-49 

47 

Computation, CEC 2016, 2016, pp. 1015–1021, doi: 10.1109/CEC.2016.7743900. 
[25] L. Thames and D. Schaefer, Cybersecurity for Industry 4.0, no. May. Cham: Springer International 

Publishing, 2017. 
[26] X. T. Cai, S. Wang, X. Lu, and W. D. Li, “Customized Encryption of CAD Models for Cloud-Enabled 

Collaborative Product Development,” 2017, pp. 35–57. 
[27] P. Eden et al., “SCADA System Forensic Analysis Within IIoT,” 2017, pp. 73–101. 
[28] A. Riahi Sfar, E. Natalizio, Y. Challal, and Z. Chtourou, “A roadmap for security challenges in the 

Internet of Things,” Digit. Commun. Networks, vol. 4, no. 2, pp. 118–137, Apr. 2018, doi: 
10.1016/j.dcan.2017.04.003. 

[29] A. Becue et al., “CyberFactory#1 — Securing the industry 4.0 with cyber-ranges and digital twins,” in 
2018 14th IEEE International Workshop on Factory Communication Systems (WFCS), 2018, vol. 
2018-June, pp. 1–4, doi: 10.1109/WFCS.2018.8402377. 

[30] M. L, M. E, and M. A, “Cybersecurity Management for (Industrial) Internet of Things: Challenges and 
Opportunities,” J. Inf. Technol. Softw. Eng., vol. 08, no. 05, 2018, doi: 10.4172/2165-7866.1000250. 

[31] L. Urquhart and D. McAuley, “Avoiding the Internet of Insecure Industrial Things,” 2018, doi: 
10.1109/TII.2014.2300753. 

[32] J. Sini, M. Violante, and R. Dessi, “Computer-Aided Design of Multi-Agent Cyber-Physical Systems,” 
in IEEE International Conference on Emerging Technologies and Factory Automation, ETFA, 2018, 
vol. 2018-September, pp. 677–684, doi: 10.1109/ETFA.2018.8502448. 

[33] S. J. Shackelford, “Smart Factories, Dumb Policy?: Managing Cybersecurity and Data Privacy Risks in 
the Industrial Internet of Things,” SSRN Electron. J., Oct. 2018, doi: 10.2139/ssrn.3252498. 

[34] O. Shwartz, Y. Mathov, M. Bohadana, Y. Elovici, and Y. Oren, “Opening Pandora’s box: Effective 
techniques for reverse engineering IoT devices,” in Lecture Notes in Computer Science (including 
subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2018, vol. 
10728 LNCS, pp. 1–21, doi: 10.1007/978-3-319-75208-2_1. 

[35] European Union Agency for Network and Information Security, Good Practices for Security of 
Internet of Things in the context of Smart Manufacturing, no. November. 2018. 

[36] K. Sha, W. Wei, T. Andrew Yang, Z. Wang, and W. Shi, “On security challenges and open issues in 
Internet of Things,” Futur. Gener. Comput. Syst., vol. 83, pp. 326–337, Jun. 2018, doi: 
10.1016/j.future.2018.01.059. 

[37] Danny Palmer, “Internet of Things security: What happens when every device is smart and you don’t 
even know it? | ZDNet,” March 20, 2017, 2017. [Online]. Available: 
https://www.zdnet.com/article/internet-of-things-security-what-happens-when-every-device-is-smart-
and-you-dont-even-know-it/. 

[38] V. Sklyar and V. Kharchenko, “ENISA Documents in Cybersecurity Assurance for Industry 4.0: IIoT 
Threats and Attacks Scenarios,” in Proceedings of the 2019 10th IEEE International Conference on 
Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications, 
IDAACS 2019, 2019, vol. 2, pp. 1046–1049, doi: 10.1109/IDAACS.2019.8924452. 

[39] “The Global Risks Report 2020 Insight Report 15th Edition.” 
[40] G. Breda and M. Kiss, “Overview of Information Security Standards in the Field of Special Protected 

Industry 4.0 Areas &amp; Industrial Security,” Procedia Manuf., vol. 46, pp. 580–590, 2020, doi: 
10.1016/j.promfg.2020.03.084. 

[41] A. Corallo, M. Lazoi, and M. Lezzi, “Cybersecurity in the context of industry 4.0: A structured 
classification of critical assets and business impacts,” Computers in Industry, vol. 114. Elsevier B.V., 
p. 103165, 01-Jan-2020, doi: 10.1016/j.compind.2019.103165. 

[42] “What is Cyber Security? | Definition, Types, and User Protection | Kaspersky.” [Online]. Available: 
https://www.kaspersky.com/resource-center/definitions/what-is-cyber-security. [Accessed: 01-Jun-
2020]. 

[43] “What is Cybersecurity? | CISA,” 2019. [Online]. Available: https://www.us-cert.gov/ncas/tips/ST04-
001. [Accessed: 01-Jun-2020]. 

[44] R. Purse, D. Craigen, and N. Diakun-Thibault, “Defining Cybersecurity.” . 
[45] “How to achieve and sustain the impact of digital manufacturing at scale | McKinsey,” 2017. [Online]. 

Available: https://www.mckinsey.com/business-functions/operations/our-insights/how-to-achieve-and-
sustain-the-impact-of-digital-manufacturing-at-scale. [Accessed: 03-Jun-2020]. 

[46] The Global Risks Report 2019 14th Edition Insight Report. 2019. 
[47] G. Culot, F. Fattori, M. Podrecca, and M. Sartor, “Addressing Industry 4.0 Cybersecurity Challenges,” 



 DSS Vol. 3, August 2022, pp.32-49 

48 

IEEE Eng. Manag. Rev., vol. 47, no. 3, pp. 79–86, Sep. 2019, doi: 10.1109/EMR.2019.2927559. 
[48] ENISA, “Enisa Lists High-Level Recommendations To Different Stakeholder Groups in Order To 

Promote Industry 4.0 Cybersecurity and Facilitate Wider Take-Up of Relevant Innovations in a Secure 
Manner. 2 Industry 4.0 Cybersecurity: Challenges & Recommendations,” 2019. 

[49] “OWASP Top 10 Privacy Risks.” [Online]. Available: https://owasp.org/www-project-top-10-privacy-
risks/. [Accessed: 01-Jun-2020]. 

[50] I. Heritage, “Protecting Industry 4.0: challenges and solutions as IT, OT and IP converge,” Netw. 
Secur., vol. 2019, no. 10, pp. 6–9, Oct. 2019, doi: 10.1016/S1353-4858(19)30120-5. 

[51] H. He, “Security Challenges on the Way Towards Smart Manufacturing – IoT Security Foundation,” 
2015. [Online]. Available: https://www.iotsecurityfoundation.org/security-challenges-on-the-way-
towards-smart-manufacturing/. [Accessed: 01-Jun-2020]. 

[52] “Worried about IoT, but hit by malware: Kaspersky Lab reveals industrial organization pain points | 
Kaspersky,” 2018. [Online]. Available: https://www.kaspersky.com/about/press-releases/2018_ics-
cybersecurity. [Accessed: 01-Jun-2020]. 

[53] M. Kiss, G. Breda, and L. Muha, “Information security aspects of Industry 4.0,” Procedia Manuf., vol. 
32, pp. 848–855, 2019, doi: 10.1016/j.promfg.2019.02.293. 

[54] “EY Cybersecurity and the Internet of Things,” 2015. 
[55] D. E. Kouicem, A. Bouabdallah, and H. Lakhlef, “Internet of things security: A top-down survey,” pp. 

199–221, 2018, doi: 10.1016/j.comnet.2018.03.012ï. 
[56] Y. S. Tiong, “The Need For Better ICS Cybersecurity - IAA - Industrial Automation,” 2019. [Online]. 

Available: https://www.iaasiaonline.com/the-need-for-better-isc-cybersecurity-2/. [Accessed: 28-May-
2020]. 

[57] “The smart factory Responsive, adaptive, connected manufacturing A Deloitte series on Industry 4.0, 
digital manufacturing enterprises, and digital supply networks,” 2017. 

[58] “What is the Smart Factory and its Impact on Manufacturing?,” 2019. [Online]. Available: 
https://ottomotors.com/blog/what-is-the-smart-factory-manufacturing. [Accessed: 27-May-2020]. 

[59] T. White, “Cyber-security risks in the supply chain,” 2019. 
[60] “Six ways CEOs can promote cybersecurity in the IoT age | McKinsey,” 2017. [Online]. Available: 

https://www.mckinsey.com/featured-insights/internet-of-things/our-insights/six-ways-ceos-can-
promote-cybersecurity-in-the-iot-age#. [Accessed: 03-Jun-2020]. 

[61] K. Boeckl et al., “NISTIR 8228 Considerations for Managing Internet of Things (IoT) Cybersecurity 
and Privacy Risks,” 2019, doi: 10.6028/NIST.IR.8228. 

[62] D. Palmer, “IoT security: Your smart devices must have these three features to be secure,” ZDNet, 
2020. [Online]. Available: https://www.zdnet.com/article/iot-security-your-smart-devices-must-have-
these-three-features-to-be-secure/. 

[63] “Data Security Threats to the Internet of Things,” 2015. [Online]. Available: 
https://www.parksassociates.com/blog/article/data-security-threats-to-the-internet-of-things. 
[Accessed: 01-Jun-2020]. 

[64] S. N. Matheu, J. L. Hernandez-Ramos, and A. F. Skarmeta, “Toward a Cybersecurity Certification 
Framework for the Internet of Things,” IEEE Secur. Priv., vol. 17, no. 3, pp. 66–76, May 2019, doi: 
10.1109/MSEC.2019.2904475. 

[65] “(5) (PDF) Regulating the IoT: Discrimination, Privacy, and Cybersecurity in the Artificial 
Intelligence Age | Charlotte A Tschider - Academia.edu,” 2018. [Online]. Available: 
https://www.academia.edu/36014158/Regulating_the_IoT_Discrimination_Privacy_and_Cybersecurity
_in_the_Artificial_Intelligence_Age. [Accessed: 02-Jun-2020]. 

[66] A. Razaque et al., “Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical 
Domain,” IEEE Access, vol. 7, pp. 168774–168797, 2019, doi: 10.1109/ACCESS.2019.2950849. 

[67] Y. Ahmed, S. Naqvi, and M. Josephs, “Cybersecurity Metrics for Enhanced Protection of Healthcare 
IT Systems,” 2019. 

[68] A. Alsuwaidi, A. Hassan, F. Alkhatri, H. Ali, M. QbeaaH, and S. Alrabaee, “Security Vulnerabilities 
Detected in Medical Devices,” in 2020 12th Annual Undergraduate Research Conference on Applied 
Computing (URC), 2020, pp. 1–6, doi: 10.1109/URC49805.2020.9099192. 

[69] P. Lynne Coventry and D. Branley, “Cybersecurity in healthcare: a narrative review of trends, threats 
and ways forward,” doi: 10.1016/j.maturitas.2018.04.008. 

[70] J. G. Ronquillo et al., “Brief Communication Health IT, hacking, and cybersecurity: national trends in 
data breaches of protected health information,” doi: 10.1093/jamiaopen/ooy019. 



 DSS Vol. 3, August 2022, pp.32-49 

49 

[71] R. M. Blank et al., “Information Security Continuous Monitoring (ISCM) for federal information 
systems and organizations,” 2011. 

 
 


