IIoT-ARAS: IIoT/ICS Automated Risk Assessment System for Prediction and Prevention
Abstract
As IT/OT convergence continues to evolve, the traditionally isolated ICS/OT systems are increasingly exposed to a myriad of online and offline threats. Although IIoT enhances the reachability in ICS, improved data analytics, ensuring ease of access and decision making, it unwittingly opens the ICS environment to attackers. The design of IIoT introduces multiple entry points to an isolated system, which is used to protect itself via air-gapping and risk avoidance strategies. This study explores a comprehensive mapping of threats and risks for IT/OT convergence. Additionally, we propose IIoT-ARAS - an automated risk assessment system based on OCTAVE Allegro and ISO/IEC 27030 methodologies. The design of IIoT-ARAS is aimed to be agentless, with minimum interruptions to the OT environment. Furthermore, the system performs automated regular asset inventory checks, threshold optimization, probability computation, risk evaluations, and contingency plan configuration.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
With the introduction of the IIoT, the traditionally compartmentalized OT environment is now exposed to multiple points of attack.
“With the introduction of the IIoT, the traditionally compartmentalized OT environment is now exposed to multiple points of attack, as Zahran et al. [53] note.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [53]
Cites
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R. (2007) · doi:10.21236/ada470450 · Cited by 294 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Mapping of Industrial IoT to IEC 62443 Standards
Cindrić, I., Jurčević, M., & Hadjina, T. (2025) · Sensors · doi:10.3390/s25030728 · Cited by 29 · see citing works
“With the introduction of the IIoT, the traditionally compartmentalized OT environment is now exposed to multiple points of attack, as Zahran et al. [53] note.”
- Authors
- Zahran, B., Hussaini, A., & Ali-Gombe, A.
- Affiliations
- Towson University (US)
- Venue
- Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy
- Publisher
- ACM
- Published
- 2021-04-26
- Pages
- 305-307
- OpenAlex
- W3156773045
- Cited by
- 10
- References
- 1
- Citations by year
- 2026: 2 · 2025: 2 · 2024: 1 · 2023: 5
- FWCI
- 1.24
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Conference on Data and Application Security and Privacy (CODASPY) (publishedVersion)
- Funders
- National Science Foundation (1850054)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- Industrial Internet of Things, IT-OT convergence, industrial control systems, cyber threats, risk assessment, OCTAVE Allegro, asset inventory, threshold optimization, contingency planning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
