The Cybersecurity Landscape in Industrial Control Systems
Abstract
Industrial control systems (ICSs) are transitioning from legacy-electromechanical-based systems to modern information and communication technology (ICT)-based systems creating a close coupling between cyber and physical components. In this paper, we explore the ICS cybersecurity landscape including: 1) the key principles and unique aspects of ICS operation; 2) a brief history of cyberattacks on ICS; 3) an overview of ICS security assessment; 4) a survey of “uniquely-ICS” testbeds that capture the interactions between the various layers of an ICS; and 5) current trends in ICS attacks and defenses.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The ICS network can be divided into three levels: Level 0 operative part with sensors/actuators, Level 1 control part with PLC/HMI, and Level 2 supervision with control room/SCADA.
“The ICS network can be divided into three levels [40], [41]:”
From A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0 (2021) · cites this paper as [41]
Cites
Guide to Industrial Control Systems (ICS) Security
Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015) · doi:10.6028/nist.sp.800-82r2 · Cited by 1,377 · cited 4× · see citing works
“4) Network Layer: Vulnerabilities can be introduced into the ICS network in different ways [1]: a) firewalls (that protect devices on a network by monitoring and controlling communication packets using filtering policies); b) modems (that convert between serial digital data and a signal suitable for transmission over…”
BackgroundInfluentialSecure Control Systems: A Quantitative Risk Management Approach
(2015) · IEEE Control Systems · doi:10.1109/mcs.2014.2364709 · Cited by 316 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics
Pliatsios, D., Sarigiannidis, P., Lagkas, T., & Sarigiannidis, A. G. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2987688 · Cited by 320 · see citing works
“The work in [9] review the SCADA security of each layer, without considering specific protocol threats and countermeasures.”
BackgroundSecurity and privacy in cyber-physical systems: A survey of surveys
Giraldo, J., Sarkar, E., Cardenas, A. A., Maniatakos, M., & Kantarcioglu, M. (2017) · IEEE Design & Test · doi:10.1109/mdat.2017.2709310 · Cited by 289 · see citing works
Cybersecurity of industrial cyber-physical systems: A review
Kayan, H., Nunes, M., Rana, O., Burnap, P., & Perera, C. (2022) · ACM Computing Surveys · doi:10.1145/3510410 · Cited by 261 · see citing works
State of the art of cyber-physical systems security: An automatic control perspective
Zacchia Lun, Y., D’Innocenzo, A., Smarra, F., Malavolta, I., & Di Benedetto, M. D. (2019) · Journal of Systems and Software · doi:10.1016/j.jss.2018.12.006 · Cited by 211 · see citing works
A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0
Mullet, V., Sondi, P., & Ramat, E. (2021) · IEEE Access · doi:10.1109/access.2021.3056650 · Cited by 161 · see citing works
“The ICS network can be divided into three levels [40], [41]: Level 0: Operative part with sensors/actuators; Level 1: Control part with PLC/HMI; Level 2: Supervision with control room/SCADA; IT solutions such as firewall/DMZ are usually used in the level 2 and higher to protect from DDoS attacks or…”
BackgroundAhmadi-Assalemi, G., Al-Khateeb, H., Epiphaniou, G., & Aggoun, A. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3144127 · Cited by 34 · see citing works
LICSTER – A Low-cost ICS Security Testbed for Education and Research
Sauer, F., Niedermaier, M., Kießling, S., & Merli, D. (2019) · Electronic Workshops in Computing · doi:10.14236/ewic/icscsr19.1 · Cited by 29 · see citing works
Kus, D., Wagner, E., Pennekamp, J., Wolsing, K., Fink, I. B., Dahlmanns, M., Wehrle, K., & Henze, M. (2022) · Proceedings of the 8th ACM on Cyber-Physical System Security Workshop · doi:10.1145/3494107.3522773 · Cited by 28 · see citing works
A Reference Architecture for IIoT and Industrial Control Systems Testbeds
Craggs, B., Rashid, A., Hankin, C., Antrobus, R., Serban, O., & Thapen, N. (2019) · Living in the Internet of Things (IoT 2019) · doi:10.1049/cp.2019.0169 · Cited by 23 · see citing works
Yang, T., Jiang, Z., Liu, P., Yang, Q., & Wang, W. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110949 · Cited by 21 · see citing works
Demilitarized network to secure the data stored in industrial networks
Nuñez Alvarez, J. R., Zamora, Y. P., Pina, I. B., & Angarita, E. N. (2021) · International Journal of Electrical and Computer Engineering (IJECE) · doi:10.11591/ijece.v11i1.pp611-619 · Cited by 10 · see citing works
Ahmadi‐Assalemi, G., Al‐Khateeb, H., Benson, V., Adamyk, B., & Ammi, M. (2025) · IET Cyber-Physical Systems: Theory & Applications · doi:10.1049/cps2.70004 · Cited by 10 · see citing works
Cao, Z., Liu, B., Gao, D., Zhou, D., Han, X., & Cao, J. (2025) · Electronics · doi:10.3390/electronics14091843 · Cited by 7 · see citing works
Systematic and Efficient Anomaly Detection Framework using Machine Learning on Public ICS Datasets
Baptiste, M., Julien, F., & Franck, S. (2021) · 2021 IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr51186.2021.9527911 · Cited by 8 · see citing works
- Authors
- McLaughlin, S., Konstantinou, C., Wang, X., Davi, L., Sadeghi, A.-R., Maniatakos, M., & Karri, R.
- Affiliations
- New York University (US)
- Technische Universität Darmstadt (DE)
- New York University Abu Dhabi (AE)
- ORCID
- Venue
- Proceedings of the IEEE
- Published
- 2016-05
- Volume
- 104
- Issue
- 5
- Pages
- 1039-1057
- ISSN
- 0018-9219 (ISSN-L)
- 1558-2256
- OpenAlex
- W2330650066
- Cited by
- 391
- References
- 2
- Citations by year
- 2026: 30 · 2025: 40 · 2024: 34 · 2023: 31 · 2022: 43 · 2021: 55 · 2020: 50 · 2019: 51 · 2018: 33 · 2017: 21 · 2016: 3
- FWCI
- 30.28
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- Proceedings of the IEEE (publishedVersion)
- TUbilio (Technical University of Darmstadt) (submittedVersion)
- Funders
- German Science Foundation
- European Union's Seventh Framework Programme (609611)
- Intel Collaborative Research Institute for Secure Computing (ICRI-SC)
- Consolidated Edison, Inc. (4265141)
- U.S. Office of Naval Research (N00014-15-1-2182)
- NYU Center for Cyber Security (New York and Abu Dhabi)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- industrial control systems, ICS cybersecurity, cyber-physical systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
