CoChat
Sign Up
Cited by 24Smart Grid Security and ResilienceAccess Control and TrustInformation and Cyber Security

Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos

Open access
Køien, Geir M.·2021·Wireless Personal Communications
DOI 10.1007/s11277-021-09055-1
Open this paper in CoChat — free accountOpen PDF

Abstract

In this paper we briefly outline as set of rules for integration of legacy devices into a modern industrial control system. These rules are fairly simple, and are mostly derived from “Zero Trust” principles. These rules aim to be pragmatic, and cost-effectiveness trumps completeness.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper proposes 12 pragmatic rules, derived mainly from Zero Trust principles, for integrating legacy devices into modern industrial control systems. It presents a high-level legacy component architecture and argues that partial implementation can still improve security when replacement or updates are infeasible.

Key findings

  • The paper defines 12 rules for legacy-device security, including regular threat modeling, identifying/authenticating all device accesses, authorization, enforced channel separation, mandatory log capture/analytics, input data validation and fuzzing tests, data integrity and confidentiality protection, platform integrity, exhaustive security testing, and planning to replace legacy devices.
  • It proposes a Legacy Component Architecture with legacy devices (LDs), Legacy Interface Functions (LIFs), and Legacy Encapsulating Gateways (LEGs), connected by a protected A-interface and a generally unprotected B-interface.
  • It recommends LIF/LD encapsulation as the preferred solution, noting that a low-cost embedded platform such as a Raspberry PI Zero (W) could suffice for a LIF.
  • The rules are explicitly pragmatic rather than complete: the paper states that cost-effectiveness trumps completeness and that the 12 rules are not written in stone.

Methods

  • Conceptual/architectural paper: it derives rules from Zero Trust principles, especially NIST Zero Trust Architecture tenets, and applies them to legacy components in ICS.
  • No empirical dataset, sample, experiment, or deployment evaluation is reported; the paper uses a wastewater/spillwater handling scenario as an illustrative example.
  • Main analysis is normative and design-oriented, referencing threat modeling (e.g., STRIDE), fuzzing, and established security practices rather than testing a new system.

Limitations

  • The paper states that complete communications protection can only be achieved with LIF/LD encapsulation, that the B-interface remains an unprotected communications path, and that full compliance with all rules is likely infeasible; partial implementation is still advocated.
  • It states that only high-level aspects are covered and that it does not mandate specific data confidentiality algorithms or standards.
  • Evident from the text: the work provides no empirical validation, implementation results, or measured security outcomes for the proposed architecture or rules.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1007/s11277-021-09055-1

Cites

18 of 18 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 21 cited sources checked · 0 supported · 0 flagged

  • Interpretationreasoning

    For legacy devices, disclosure data-in-transit confidentiality cannot be assured.

    “-Disclosure data-in-transit confidentiality cannot be assured”
    Quote in the paperNot a substantial claim
  • Interpretationreasoning

    Legacy devices are potentially vulnerable to a whole range of security threats.

    “The Legacy Devices (LDs) are potentially vulnerable to a whole range of security threats.”
    Quote in the paperSubstantial claim
  • Premisecitation

    In ICS, legacy devices often have little or no security.

    “In ICS, the problem is that Legacy Devices (LDs) often have little or no security.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [1] Alexander, Otis, Belisle, Misha, & Steele, Jacob. (2020). MITRE ATT&CK® for industrial control systems: Design and philosophy (p. 03). MITRE: White paper.

      Not checked in the free run.

  • Interpretationreasoning

    For legacy devices, platform integrity cannot be guaranteed (including software, firmware, and configuration data).

    “-Platform integrity cannot be guaranteed (sw/fw, incl.configuration data)”
    Quote in the paperNot a substantial claim
  • Interpretationreasoning

    For legacy devices, authorization to verify legitimate device access is impossible.

    “-Authorization Inability to verify legitimate device access”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. 58
  • May combine two claims. 18

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    For legacy devices, tampering data-at-rest integrity cannot be assured.

    “-Tampering data-at-rest integrity cannot be assured”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    For legacy devices, disclosure data-at-rest confidentiality cannot be assured.

    “-Disclosure data-at-rest confidentiality cannot be assured”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    For legacy devices, tampering data-in-transit integrity cannot be assured.

    “-Tampering data-in-transit integrity cannot be assured”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Conventional perimeter defense assumes all those inside the perimeter can enjoy mutual trust in each other.

    “Furthermore, that all those inside the perimeter can enjoy mutual trust in each other.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisereasoning

    In Zero Trust, trustworthiness is no longer associated with location (inside a network perimeter or not).

    “The trustworthiness is no longer associated with location (inside a network perimeter or not).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation

    In Zero Trust, there should be no 'blind' or unspoken/assumed trust.

    “That is, there should be no”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The ZT paradigm is officially endorsed by NIST and the US National Security Agency (NSA).

    “The ZT paradigm is officially endorsed not only by NIST, but also by US National Security Agency (NSA).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [6] NSA. (2021). Embracing a zero trust security model (v1.0). Cybersecurity. Information, 02.

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation

    A Zero Trust architecture addresses the perimeter security problem by focusing on protecting resources, not network perimeters.

    “A ZT architecture addresses this problem by focusing on protecting resources, not network perimeters.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation

    The concept of Zero Trust is not about zero trust per se, but rather about unwarranted trust.

    “The concept is not about zero trust per se, but rather about unwarranted trust.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    Exposure of the B-interface will be a liability.

    “Exposure of the B-interface will be a liability.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    For legacy devices, authentication of entities (device access) is impossible.

    “-Authentication Inability to authenticate entities (device access)”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    In Zero Trust, all claims must be corroborated.

    “All claims must be corroborated.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Conventional network security has often focused solely on perimeter defenses.

    “Conventional network security has often focused solely on perimeter defenses.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    It should be economically feasible for many cases to have one LIF per LD.

    “It should be economically feasible for many cases to have one LIF per LD.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    The LIFs are not supposed to be expensive devices, and it could be realized on a fairly simple embedded ARM-based controller running an embedded Linux OS.

    “The LIFs are not supposed to be expensive devices, and it could be realized on a fairly simple embedded ARM-based controller running an embedded Linux OS.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given

    The communications over the B-interface may be protected, but generally it will be unprotected.

    “The communications over the B-interface may be protected, but generally it will be unprotected.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: No security protection can be assumed (unprotected).

  • Classified as probably not a substantial claim.

    Premisecitation

    In Zero Trust, there should be no trust assumed due to the location of a node or entity.

    “In particular, there should be no trust assumed due to the location of a node or entity.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The NIST-defined ZTA places a lot of significance on identifying work flows and data flows, including a focus on assets and threats to assets.

    “The NIST defined ZTA places a lot of significance on identifying work flows and data flows.This includes a focus on assets and on threats to the assets.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisenone given

    Conventional perimeter defense assumes all objects and components inside the perimeter have the same trust level.

    “There is an implied assumption that all the objects and components on the inside of the perimeter have the same trust level.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    Threat modeling as a method will not provide any guarantees or proofs, but it is a pragmatic and often efficient method of uncovering many future problems.

    “Threat modeling as a method will not provide any guarantees or proofs, but it is a pragmatic and often efficient method of uncovering many future problems.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    ZT designs are possible and practical in the real world.

    “But, it demonstrates that ZT designs are possible and practical in the real world.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisenone given

    To prevent masquerade (impersonation) is essential.

    “To prevent masquerade (impersonation) is essential.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    Threat modeling is predominantly a design-phase activity but is not restricted to design type and is suitable for designs dealing with integration of legacy system components.

    “Threat modeling, by it nature, is predominantly a design-phase activity.However, it is not restricted to what kind of design one is attempting, and it is therefore also suitable for designs that deal with integration of legacy system components.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    An important ZT concept is separation and segmentation.

    “An important ZT concept is that of separation and segmentation.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Defense-in-Depth assumes there will be attacks and that multiple/segmented defenses can afford extra protection.

    “The underlying assumption is that there will be attacks and that multiple/segmented defenses can afford extra protection.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [7] Industrial Control Systems Cyber Emergency Response Team (ICS-CERT. Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies. Department of Homeland. (2016). Security, 09,

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    Missing authentication is a significant hint that one needs to redesign this part of the system.

    “But, missing authentication is a significant hint that one needs to redesign this part of the system.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    The principles are simple enough that large-scale adoption should be possible for many organizations.

    “The principles are simple enough that large-scale adoption should be possible for many organizations.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Premisenone given

    Threat modeling is a cost-effective way of finding flaws, errors and omissions in the system design.

    “Threat modeling is a cost-effective way of finding flaws, errors and omissions in the system design.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisereasoning

    Threat awareness is essential for responsible deployment of legacy devices.

    “Threat awareness is essential for responsible deployment of legacy devices.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The US Department of Homeland Security has published recommendations concerning Defense-in-Depth for industrial control systems.

    “The US Department of Homeland Security has published recommendations concerning this principle for industrial control systems [7].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [7] Industrial Control Systems Cyber Emergency Response Team (ICS-CERT. Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies. Department of Homeland. (2016). Security, 09,

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisereasoning

    The ICS/OT environment and product update cycles found in modern ICT systems do not match well.

    “The Industrial Control System (ICS)/Operational Technology (OT) environment and the product update cycles found in modern ICT system do not match well.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Both BeyondCorp and LISA remove trust from the network location and perimeter, and replace it with trust in authenticated users and 'healthy' devices.

    “Both BeyondCorp and LISA removes trust from the network location and perimeter, and replaces it with trust in authenticated users and”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [8] Rory Ward and Betsy Beyer. (2014). BeyondCorp: a new approach to enterprise security. ; login: the magazine of USENIX & SAGE, 39(6), 6–11.

      Not checked in the free run.

    • cites [9] Zimmer, Bryan, & LISA: A practical zero trust architecture. In Enigma, . (2018). Enigma 2018 (p. 2018). CA: Santa Clara.

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    The Dragos 2020 ICS threat landscape report identifies lack of updating of software/firmware and remote access risk in ICS as major problems.

    “They published a threat landscape report for the ICS sector for 2020 [4].Among the major problems reported are the lack of updating of software/firmware and the”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [4] DRAGOS. ICS Cybersecurity; Year in review (2020). White paper, DRAGOS, (2020).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The Google and Netflix example networks are office networks rather than ICS networks.

    “Of course, the Google and Netflix example networks are office networks rather than ICS networks.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Premisenone given

    It is not sufficient for the LEG/LIF to have verified the identity of entities that want to communicate with the LDs; accesses must also be authorized.

    “It is not sufficient for the LEG/LIF to have verified the identity of the entities that wants to communicate with the LDs.The accesses must also be authorized.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The basics of NIST ZTA include entity identification, entity authentication, access control, separate and segment resources, and logging/log handling.

    “-Entity identification -Entity authentication -Access control (authorization) -Separate and segment the resources -Logging and log handling (monitoring)”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [2] Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207, NIST, 08 (2020). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Premisenone given

    The LEG and LIF may be new and modern, but the LDs are not.

    “The LEG and LIF may be new and modern, but the LDs are not.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Fuzzing remains a remarkably effective testing technique.

    “Fuzzing remains to be a remarkably effective testing technique.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [20] Miller, Barton, Zhang, Mengxiao, & Heymann, Elisa. (2020). The relevance of classic fuzz testing: Have we solved this one? IEEE Transactions on Software Engineering source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    There may be some measure of protection in effect for LIFs and LDs due to physical seclusion.

    “Thus, there may be some measure of protection in effect.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    The combined and encased LIF/LD will properly address the communications security problem.

    “The combined and encased LIF/LD will properly address the communications security problem.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Type-safety is a security measure.

    “The Eiffel design-by-contract has many more features, but suffice to say that type-safety is also a security measure.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15] Volpano Dennis, and Smith Geoffrey (1997) A type-based approach to program security. In Michel Bidoit and Max Dauchet, editors, TAPSOFT ’97: Theory and Practice of Software Development, pages 607–621, Berlin, Heidelberg. Springer Berlin Heidelberg. ISBN 978-3-540-68517-3. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisereasoning

    Input data handling has been a source of serious vulnerabilities, which have been exploited in attacks.

    “This has been a source of serious vulnerabilities, which have been exploited in attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    It is going to be difficult to implement the rules on many legacy systems.

    “For one, it is going to be difficult to implement the rules on many legacy systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    As we move towards increased digitalization in ICS systems, the repercussions of bad security are vulnerabilities in systems we crucially depend on.

    “The far reaching part has to do with the fact that as we move towards increased digitalization in ICS systems, the repercussions of bad security is vulnerabilities in systems we crucially depend on.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    A large class of errors and vulnerabilities in software is associated with input data handling.

    “A large class of errors and vulnerabilities in software is associated with input data handling.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    It is quite likely that one cannot always have LIF/LD encapsulation.

    “However, it is quite likely that one cannot always have this.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisenone given

    The ENISA report and other similar efforts do not quite capture the problems that ICS faces.

    “For our purpose, the ENISA report, and other similar efforts, does not quite capture the problems that ICS faces.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    To integrate the LDs into the proposed architecture will take considerable effort.

    “To integrate the LDs into our proposed architecture will therefore take considerable effort.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Designing cryptographic algorithms is exceptionally hard, and a sound design can only be hoped for after prolonged study and investigation by the best cryptanalysts.

    “It is exceptionally hard to design cryptographic algorithm, and only after the algorithm be subjected to prologued study and investigations by the best cryptanalysts can one entertain any hope of having a sound design.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [23] Doctorow, Cory. (2004). Microsoft research drm talk (p. 17). Microsoft Research Group, Redmond, WA: Transcript.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The LEG and LIFs will have no problem supporting data confidentiality for all connections.

    “For our purpose, the LEG and LIFs will have no problem supporting data confidentiality for all connections.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    The generic rules will apply to other configurations too, even if one may have to adapt the concrete aspects.

    “The generic rules will apply to other configurations too, even if one may have to adapt the concrete aspects.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Legacy devices will not improve over time; they will continually get older and more out-of-date.

    “Whatever else happens, the passage of time will mean that the legacy devices will continually be getting older and more out-of-date.”
    • Also stated in: § Rule 12 Plan to Replace the Legacy Devices. · plain
      “The LDs will not get better with time.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The LEG and LIF will have access to much more information that one may want to log.

    “The LEG and LIF will also have access to much more information that one may want to log.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The LIFs and LDs are likely to be located in a physically secluded location.

    “The LIFs and LDs are likely to be located in a physically secluded location.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    For modern cryptographic methods and security protocols, the additional cost of having data confidentiality together with data integrity is small.

    “We also note that for modern cryptographic methods and security protocols, the additional cost of having data confidentiality together with data integrity is small.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Inadequate data input validation is a persistent source of vulnerabilities in digital systems.

    “Inadequate data input validation is a persistent source of vulnerabilities in digital systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Complete communications protection can only be had if one has LIF/LD encapsulation.

    “As is evident from the architecture, see Fig. 1, complete communications protection can only be had if one has LIF/LD encapsulation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationreasoning

    It is also quite likely that one cannot implement all of the rules, and that one will have to have unprotected devices in the system.

    “It is also quite likely that one cannot implement all of the rules, and that one will have to have unprotected devices in the system.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    There may be problems with replacing broken equipment, and the cost of maintaining an old infrastructure could become quite significant.

    “There may be problems with replacing broken equipment, and the cost of maintaining an old infrastructure could become quite significant.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning

    Not all issues can be addressed, and every flaw may potentially be used by the intruder.

    “That is not attainable, but we have to make a serious effort to find as many flaws as possible, because every one of them may potentially be used by the intruder.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning

    Security testing will not totally prevent the intruder from finding a vulnerability, but it will improve the odds considerably in the defenders' favor.

    “This will not totally prevent the intruder from finding a vulnerability, but it will improve the odds considerably in the defenders favor.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    The intruder only needs to find one single vulnerability to be able to compromise the system.

    “The intruder has the advantage that he/she only needs to find one single vulnerability to be able to compromise our system.”
    Quote in the paperNot a substantial claim
62 of 62

  • The authors state this as an assumption.

    It is deemed infeasible to replace the LDs.

    “-Replacement It is deemed infeasible to replace the LDs”

  • The authors state this as an assumption.

    The LDs cannot be fixed by updates (will remain 'legacy').

    “-Updates The LDs cannot be fixed by updates (will remain”

  • The authors state this as an assumption.

    The LDs will communicate with an up-to-date core system.

    “-Connectivity The LDs will communicate with an up-to-date core system”

  • The authors state this as an assumption.

    The LDs will have modest bandwidth needs.

    “-Bandwidth needs The LDs will have modest bandwidth needs”

  • The authors state this as an assumption.

    The LD belongs to its own trust domain (untrusted).

    “-Trust-level The LD belongs to its own trust domain (untrusted)”

  • The authors state this as an assumption.

    No security protection can be assumed (unprotected).

    “-Protection No security protection can be assumed (unprotected)”

  • The paper relies on this without support.

    System compromise (breach) is an invariant property of an operational system.

    “That is, system compromise (breach) is seen as an invariant property of the system being operational.”

  • The authors state this as an assumption.

    In a Zero Trust system, all unprotected data will be manipulated at some stage.

    “In a ZT system, one must assume that all unprotected data will be manipulated (at some stage).”

  • The authors state this as an assumption.

    In a Zero Trust system, all unprotected data will be eavesdropped on at some stage.

    “In a ZT system, one must assume that all unprotected data will be eavesdropped on (at some stage).”

  • The authors state this as an assumption.

    The system will be breached.

    “-The System Will Be Breached”

  • The authors state this as an assumption.

    Never trust, always verify.

    “-Never Trust, Always Verify”

  • The authors state this as an assumption.

    No trust in location.

    “-No Trust in Location”
12 of 12

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The proposed solution architecture extends the solution presented in [35].

    “The proposed solution architecture is adequate for the protection of legacy equipment, extends the solution presented in [35], and implements good practices and guidelines as summarized therein.”

    From A Zero-Trust Architecture for Remote Access in Industrial IoT Infrastructures (2023) · cites this paper as [35]

  • The proposed solution architecture implements good practices and guidelines as summarized in [35].

    “The proposed solution architecture is adequate for the protection of legacy equipment, extends the solution presented in [35], and implements good practices and guidelines as summarized therein.”

    From A Zero-Trust Architecture for Remote Access in Industrial IoT Infrastructures (2023) · cites this paper as [35]

Cites

Flagged first, then by citations

Research works printed but not linked: 4

  1. Alexander, Otis, Belisle, Misha, & Steele, Jacob. (2020). MITRE ATT&CK® for industrial control systems: Design and philosophy (p. 03). MITRE: White paper.
  2. ENISA. (2020). Enisa threat landscape: The year in review. ENISA: ETL.
  3. DRAGOS. ICS Cybersecurity; Year in review (2020). White paper, DRAGOS, (2020).
  4. Doctorow, Cory. (2004). Microsoft research drm talk (p. 17). Microsoft Research Group, Redmond, WA: Transcript.

Cited by

Sorted by citations

Related

Authors
Køien, G. M.
Affiliations
University of South-Eastern Norway (NO)
Corresponding author
Køien, Geir M.
ORCID
Køien, Geir M.
Venue
Wireless Personal Communications
Publisher
Springer Science and Business Media LLC
Published
2021-09-03
Volume
121
Issue
2
Pages
1169-1186
ISSN
  • 0929-6212 (ISSN-L)
  • 1572-834X
DOI
10.1007/s11277-021-09055-1
OpenAlex
W3198438389
Semantic Scholar
d5b110040f537ce9023e4bae9366e8c3403a7a12
Cited by
24
References
18
Citations by year
2026: 2 · 2025: 6 · 2024: 7 · 2023: 5 · 2022: 4
FWCI
1.72
Type
journal article
Language
en
Open access
Licence
Locations
  • Wireless Personal Communications (publishedVersion, cc-by)
  • NORA - Norwegian Open Research Archives (submittedVersion, other-oa)
Funders
University Of South-Eastern Norway
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
legacy devices, industrial control systems, legacy system integration, industrial cybersecurity, cost-effectiveness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review