ThreatGet: Ensuring the Implementation of Defense-in-Depth Strategy for IIoT Based on IEC 62443
Abstract
Security engineering is a major challenge in the distributed and heterogeneous nature of the Industrial Internet of Things (IIoT). While IEC 62443 is available as a security engineering standard for the industrial domain, the increased complexity and dynamic of combining IoT with industrial sys-tems challenges approaches without automation. Security analy-sis in the IIoT with a model-based engineering tool is essential to ensure the proper method is applied to protect the system model. This work follows the Defense-in-depth strategy presented by IEC 62443, then adapted for IIoT applications. We use ThreatGet threat modeling tool to show how this strategy could be implemented in the IIoT domain using threat modeling. The research findings demonstrate how the threat modeling approach ensures the implementation of a defense-in-depth strategy in the IIoT domain.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
IIoT devices have limited power, memory, disk space, and processing capabilities.
“They also note that IIoT devices have limited power, memory, disk space, and processing capabilities”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [39]
Schmittner et al. [39] do not address the applicability of the standards and do not provide suggestions on how to make the standards more applicable to the IIoT.
“Again, this paper does not address the applicability of the standards and does not provide suggestions on how to make the standards more applicable to the IIoT.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [39]
Physical security is an important factor in IIoT environments.
“Also emphasized is the fact that physical security is an important factor in IIoT environments.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [39]
Schmittner et al. [39] mainly focus on only two standards: IEC 62443-4-1 and IEC 62443-4-2.
“Similarly to the previous paper, Schmittner et al. [39] mainly focus on only two standards: IEC 62443-4-1 and IEC 62443-4-2.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [39]
The introduction of IIoT devices into a system increases the overall complexity of the system.
“and that their introduction into the system increases the overall complexity of the system.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [39]
Cites
Threat Modeling: Designing for Security
(2014) · Cited by 766 · see citing works
The Security Development Lifecycle
Howard, M. D., & Lipner, S. (2006) · Microsoft Press eBooks · Cited by 502 · see citing works
Securing IIoT using Defence-in-Depth: Towards an End-to-End secure Industry 4.0
Mosteiro-Sanchez, A., Barcelo, M., Astorga, J., & Urbieta, A. (2020) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2020.10.011 · Cited by 64 · see citing works
Threat Modeling for Automotive Security Analysis
Ma, Z., & Schmittner, C. (2016) · Advanced science and technology letters · doi:10.14257/astl.2016.139.68 · Cited by 31 · see citing works
Self-citationThreat Modeling in the Railway Domain
Schmittner, C., Tummeltshammer, P., Hofbauer, D., Shaaban, A. M., Meidlinger, M., Tauber, M., Bonitz, A., Hametner, R., & Brandstetter, M. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-18744-6_17 · Cited by 13 · see citing works
Self-citationToward Applying the IEC 62443 in the UAS for Secure Civil Applications
Shaaban, A. M., Jung, O., & Fas-Millán, M.-Á. (2022) · Springer eBooks · doi:10.1007/978-3-658-36295-9_7 · Cited by 5 · see citing works
Self-citationMarksteiner, S., Ramler, R., & Sochor, H. (2019) · doi:10.1145/3360664.3362698 · Cited by 4 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Mapping of Industrial IoT to IEC 62443 Standards
Cindrić, I., Jurčević, M., & Hadjina, T. (2025) · Sensors · doi:10.3390/s25030728 · Cited by 29 · see citing works
“Schmittner et al. [39] suggest using the modeling tool ThreatGet to automate the threat analysis process.”
Influential
- Authors
- Schmittner, C., Shaaban, A. M., & Macher, G.
- Affiliations
- AIT Austrian Institute of Technology GmbH (AT)
- Graz University of Technology (AT)
- Venue
- 2022 IEEE 5th International Conference on Industrial Cyber-Physical Systems (ICPS)
- Publisher
- IEEE
- Published
- 2022-05-24
- Pages
- 1-6
- OpenAlex
- W4285814160
- Cited by
- 7
- References
- 7
- Citations by year
- 2026: 3 · 2025: 1 · 2024: 2 · 2023: 1
- FWCI
- 0.89
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Industrial Cyber-Physical Systems (ICPS) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- Industrial Internet of Things, IEC 62443, defense-in-depth, threat modeling, industrial cybersecurity, security engineering
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
