Vulnerability and security risk assessment in a IIoT environment in compliance with standard IEC 62443
Open accessAbstract
Industrial networks based on the Internet of Things (IoT) have become the backbone of Industry 4.0. Indeed, these connected objects increase the efficiency, flexibility and autonomy of machines, thus improving the productivity and profitability of factories. However, the opening up of digitization technologies, especially in environments where failure is hardly tolerable, creates new challenges related to security. The number of vulnerabilities in industrial facilities is constantly increasing [1]. To implement a cyber defense framework for industrial systems, the cybersecurity standard IEC 62443 has been proposed. This standard mainly provides a set of instructions and measures to be put in place to ensure not only the security of the industrial system, but also operational safety. In this paper, we propose a new approach based on the standards IEC 62443-3-2 and IEC 62443-4-2 allowing us to verify, through an in-depth risk assessment, the conformity of the objects with the main security requirements.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Several risk analysis methods commonly used in regular IT systems have proven to be insufficient for IIoT environments.
“Several risk analysis methods commonly used in regular IT systems have proven to be insufficient for IIoT environments.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
The Introduction identifies EBIOS and MEHARI as risk-analysis methods designed for information systems and describes IEC 62443 as specific to industrial cybersecurity. It does not say that those methods have proven insufficient for IIoT environments; the Proposed Evaluation Model (§3.1) even adopts steps described as common to information-system risk methods. No page numbers are available in our copy. (LLM, conf=0.82)
Experimental — accuracy not yet measuredIoT devices have no or limited authentication capability.
“One of the biggest identified risks for this type of environment is the fact that IoT devices have no or limited authentication capability.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
Section 3.2 (Testbed; page unavailable) reports absent or weak authentication in several zones, and Table 5 rates unauthorized access as a very important risk in Zone 1. But these are findings about authentication implemented in this testbed, not evidence that IoT devices generally lack authentication capability; the same section describes hardened authentication in Zone 4. (LLM, conf=0.86)
Experimental — accuracy not yet measuredThe communication capabilities of IoT devices also have no or limited authentication capability.
“The same applies to the communication capabilities of these devices.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
Section 3.2 (Testbed; page unavailable) describes limited authentication in the studied IIoT setup: PLC programming requires no identification, and the Wi-Fi access point has no TACACS+ or RADIUS authentication. It does not establish that IoT devices generally lack communication authentication capability; the same section describes hardened authentication for the mobile monitoring interface and says the OPC-UA conduit can be reinforced with authentication. (LLM, conf=0.85)
Experimental — accuracy not yet measuredThe example in Hassani et al. [38] is shown using a testbed and is not general enough to be included as an addition to the standards that would make them more suitable for the IIoT.
“Furthermore, as the example is shown using a testbed, it is not general enough to be included as an addition to the standards that would make them more suitable for the IIoT.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
Hassani et al. [38] only focus on two parts of the IEC 62443 series, namely IEC 62443-3-2 and IEC 62443-4-2.
“Hassani et al. [38] only focus on two parts of the IEC 62443 series, namely IEC 62443-3-2 and IEC 62443-4-2.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
Insecure software in IIoT devices can be compromised.
“This type of insecure software can be compromised.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [38]
International standards ISA99 and IEC62443 refer to the hierarchical structure according to the ISA95 model.
“The international standards regarding industrial control systems, such as ISA99 and IEC62443, also refer to the hierarchical structure according to the ISA95 model [19,20].”
From Asset Management Method of Industrial IoT Systems for Cyber-Security Countermeasures (2021) · cites this paper as [20]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Security and privacy challenges in industrial internet of things
Sadeghi, A., Wachsmann, C., & Waidner, M. (2015) · Proceedings - ACM IEEE Design Automation Conference · doi:10.1145/2744769.2747942 · Cited by 920 · see citing works
Security analysis on consumer and industrial IoT devices
Wurm, J., Hoang, K., Arias, O., Sadeghi, A., & Jin, Y. (2016) · Asia and South Pacific Design Automation Conference (ASP-DAC) · doi:10.1109/aspdac.2016.7428064 · Cited by 269 · see citing works
Cyber security vulnerability assessment for Smart substations
Jiwen, C., & Shanmei, L. (2016) · IEEE PES Asia-Pacific Power and Energy Engineering Conference · doi:10.1109/appeec.2016.7779741 · Cited by 18 · see citing works
Application of IEC 62443 for IoT Components
Shaaban, A. M., Kristen, E., & Schmittner, C. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-99229-7_19 · Cited by 16 · see citing works
Cyber-Physical Security Risk Assessment for Train Control and Monitoring Systems
Rekik, M., Gransart, C., & Berbineau, M. (2018) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2018.8433201 · Cited by 15 · see citing works
Juárez, F. A. B. (2019) · International Conference on Software Process Improvement (CIMPS) · doi:10.1109/cimps49236.2019.9082437 · Cited by 12 · see citing works
Ozouf, V. (2009) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Mapping of Industrial IoT to IEC 62443 Standards
Cindrić, I., Jurčević, M., & Hadjina, T. (2025) · Sensors · doi:10.3390/s25030728 · Cited by 29 · see citing works
“Hassani et al. [38] only focus on two parts of the IEC 62443 series, namely IEC 62443-3-2 and IEC 62443-4-2.”
Asset Management Method of Industrial IoT Systems for Cyber-Security Countermeasures
Matsumoto, N., Fujita, J., Endoh, H., Yamada, T., Sawada, K., & Kaneko, O. (2021) · Information · doi:10.3390/info12110460 · Cited by 13 · see citing works
“The international standards regarding industrial control systems, such as ISA99 and IEC62443, also refer to the hierarchical structure according to the ISA95 model [19,20].”
Background
- Authors
- Hassani, H. L., Bahnasse, A., Martin, E., Roland, C., Bouattane, O., & Mehdi Diouri, M. E.
- Affiliations
- Université de Bretagne Sud (FR)
- École Normale Supérieure de l'Enseignement Technique de Mohammedia (MA)
- Corresponding author
- Hassani, Hicham Lalaoui
- Venue
- Procedia Computer Science
- Publisher
- Elsevier BV
- Published
- 2021
- Volume
- 191
- Pages
- 33-40
- ISSN
- 1877-0509 (ISSN-L)
- OpenAlex
- W3196618093
- Cited by
- 35
- References
- 7
- Citations by year
- 2026: 10 · 2025: 9 · 2024: 8 · 2023: 6 · 2022: 1 · 2021: 1
- FWCI
- 3.32
- Type
- conference paper
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- Locations
- Procedia Computer Science (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- Industrial Internet of Things, IEC 62443, security risk assessment, vulnerability assessment, industrial cybersecurity, industrial networks, Industry 4.0
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
