Cybersecurity Threats, Vulnerabilities, Mitigation Measures in Industrial Control and Automation Systems: A Technical Review

Cyberattacks on Industrial Control and Automation Systems (ICAS) have significantly increased in recent years due to IT and OT convergence. Traditionally, ICAS were isolated systems running proprietary protocols on specialised software and hardware. However, to improve business processes and efficiency, ICAS vendors are adopting smart technologies such as Industrial Internet of Things (IIOT), Machine to Machine (M2M), Digital Twin, cloud computing, and Artificial Intelligence (AI). This integration presents new vulnerabilities in ICAS that can be exploited by threat actors. ICAS are utilised in critical infrastructure and widely used in power, nuclear plant, water, oil, natural gas, and manufacturing industries. Therefore, cyberattacks on these systems can pose a significant threat to humans and the environment, disrupt social services, cause financial losses, and threaten national security. Because of these threats, numerous mitigation measures are being implemented to protect ICAS from cyberattacks. However, security experience and expertise have demonstrated that we can never fully protect a system and one should never propose that their solution will fully protect. Rather one can claim that their solution/mitigation technique adds a layer to the defence in depth approach. This paper discusses the different cybersecurity standards and frameworks for ICAS, investigates the existing threats and vulnerabilities, and methods of securing ICAS