Security Issues and Software Updates Management in the Industrial Internet of Things (IIoT) Era
Open accessAbstract
New generation Industrial Automation and Control Systems (IACS) are providing advanced connectivity features, enabling new automation applications, services and business models in the Industrial Internet of Things (IIoT) era. Nevertheless, due to the extended attack surface and increasing number of cyber-attacks against industrial equipment, security concerns arise. Hence, these systems should provide enough protection and resiliency against cyber-attacks throughout their entire lifespan, which, in the case of industrial systems, may last several decades. A sound and complete management of security issues and software updates is fundamental to achieve such goal, since leading-edge security countermeasures implemented in the development phase may eventually become out-of-date. In this article, a review of the IEC 62443 industrial security standard concerning the security maintenance of IIoT systems and components is given, along with guidelines for the implementation of such processes. As concluded, the security issues and software updates management shall jointly be addressed by the asset owner, service providers and product suppliers. These security processes should also be compatible with the safety procedures established by safety standards.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Relying on outdated CPUs and inadequate technology may compromise security against cyber threats like ransomware, malware, data breaches, or server takeovers due to insufficient processing power.
“However, relying on outdated Central Processing Units (CPUs) and inadequate technology may compromise security against cyber threats like ransomware, malware, data breaches, or server takeovers due to insufficient processing power [14], [15].”
From A Critical Overview of Industrial Internet of Things Security and Privacy Issues Using a Layer-Based Hacking Scenario (2023) · cites this paper as [15]
The Introduction says security countermeasures in long-lived industrial systems can become obsolete, and §5.4 notes that outdated or legacy systems may be difficult to upgrade. Those passages support the general concern about aging technology and security, but they do not link outdated CPUs or insufficient processing power to ransomware, malware, data breaches, or server takeovers. Searches for CPU and ransomware found no such link. (LLM, conf=0.84)
Experimental — accuracy not yet measuredThe real challenge for establishing an overall cybersecurity management system based on IEC 62443 is that a large number of actors with different access rights and responsibilities are involved.
“The real challenge arises from the fact that a large number of actors with different access rights and responsibilities are involved.”
From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [49]
The Overview of IEC 62443 (section 2; page not provided) identifies the asset owner, service provider, and product supplier as stakeholders with different roles, and says security risk management must be addressed collaboratively. The Security Issues Management section (section 5; page not provided) likewise assigns joint responsibility for security maintenance. Neither passage says these actors have different access rights or identifies their involvement as the real challenge in establishing an overall cybersecurity management system. (LLM, conf=0.84)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Blockchains and smart contracts for the internet of things
Christidis, K., & Devetsikiotis, M. (2016) · IEEE Access · doi:10.1109/access.2016.2566339 · Cited by 4,552 · see citing works
Guide to Industrial Control Systems (ICS) Security
Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015) · doi:10.6028/nist.sp.800-82r2 · Cited by 1,377 · cited 5× · see citing works
“As claimed by NIST [25], the industrial control system security objectives usually follow as the next priorities: availability, integrity and confidentiality.”
BackgroundInfluentialBlockchain for internet of things: a survey
Dai, H.-N., Zheng, Z., & Zhang, Y. (2019) · IEEE Internet of Things Journal · doi:10.1109/jiot.2019.2920987 · Cited by 1,246 · see citing works
Secrets and lies: digital security in a networked world
Schneier, B. (2001) · Choice Reviews Online · doi:10.5860/choice.38-3941 · Cited by 1,162 · see citing works
Software development lifecycle models
Ruparelia, N. B. (2010) · SOEN · doi:10.1145/1764810.1764814 · Cited by 420 · see citing works
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344 · see citing works
ISO/IEC 27000, 27001 and 27002 for Information Security Management
Disterer, G. (2013) · Journal of Information Security · doi:10.4236/jis.2013.42011 · Cited by 239 · see citing works
A survey of information security incident handling in the cloud
Rahman, N. H. A., & Choo, K. R. (2014) · Computers & Security · doi:10.1016/j.cose.2014.11.006 · Cited by 201 · see citing works
Cyber Resilience of Systems and Networks
Kott, A., & Linkov, I. (2018) · Springer eBooks · doi:10.1007/978-3-319-77492-3 · Cited by 187 · see citing works
Fundamental Concepts of Cyber Resilience: Introduction and Overview
Linkov, I., & Kott, A. (2018) · Springer eBooks · doi:10.1007/978-3-319-77492-3_1 · Cited by 173 · see citing works
The SEMA referential framework: Avoiding ambiguities in the terms “security” and “safety”
Piètre-Cambacédès, L., & Chaudet, C. (2010) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2010.06.003 · Cited by 126 · see citing works
Cyber-Security Incidents: A Review Cases in Cyber-Physical Systems
Nasser, M., Ahmad, R., Yassin, W. M., Hassan, A., Abidin, Z. Z., Salih, N., & Hameed, K. (2018) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2018.090169 · Cited by 105 · see citing works
Information security incident management: Current practice as reported in the literature
Tøndel, I. A., Line, M. B., & Jaatun, M. G. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.003 · Cited by 102 · see citing works
Guide to Enterprise Patch Management Technologies
Souppaya, M., & Scarfone, K. A. (2013) · doi:10.6028/nist.sp.800-40r3 · Cited by 64 · see citing works
ISO 9001 Quality Management Systems
Natarajan, D. (2017) · Management and industrial engineering · doi:10.1007/978-3-319-54383-3 · Cited by 44 · see citing works
Resilient Self-Organizing Overlay Networks for Security Update Delivery
Li, J., Reiher, P. L., & Popek, G. J. (2004) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2003.818808 · Cited by 39 · see citing works
Recommended Practice for Patch Management of Control Systems
Tom, S., Christiansen, D., & Berrett, D. (2008) · doi:10.2172/944885 · Cited by 35 · see citing works
Optimal release and patching time of software with warranty
Kansal, Y., Singh, G., Kumar, U., et al. (2016) · International Journal of Systems Assurance Engineering and Management · doi:10.1007/s13198-016-0510-7 · Cited by 32 · see citing works
Pina, L., Andronidis, A., Hicks, M., et al. (2019) · International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) · doi:10.1145/3297858.3304063 · Cited by 31 · see citing works
Mixed Criticality in Control Systems
Crespo, A., Alonso, A., Marcos, M., et al. (2014) · IFAC Proceedings Volumes · doi:10.3182/20140824-6-za-1003.02004 · Cited by 29 · see citing works
eMaintenance in railways: Issues and challenges in cybersecurity
Kour, R., Aljumaili, M., Karim, R., et al. (2019) · Proceedings of the Institution of Mechanical Engineers Part F Journal of Rail and Rapid Transit · doi:10.1177/0954409718822915 · Cited by 29 · see citing works
Security management of cyber physical control systems using NIST SP 800-82r2
Jillepalli, A. A., Sheldon, F. T., de Leon, D. C., Haney, M., & Abercrombie, R. K. (2017) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2017.7986568 · Cited by 27 · see citing works
Update now or later? Effects of experience, cost, and risk preference on update decisions
Rajivan, P., Aharonov‐Majar, E., & González, C. (2020) · Journal of Cybersecurity · doi:10.1093/cybsec/tyaa002 · Cited by 27 · see citing works
Coole, M. P., Corkill, J., & Woodward, A. J. (2012) · Australasian Journal of Paramedicine · doi:10.4225/75/57a034ccac5cd · Cited by 25 · see citing works
Management of automotive software updates
Placho, T., Schmittner, C., Bonitz, A., et al. (2020) · Microprocessors and Microsystems · doi:10.1016/j.micpro.2020.103257 · Cited by 25 · see citing works
Understanding Security Requirements for Industrial Control System Supply Chains
Hou, Y., Such, J. M., & Rashid, A. (2019) · doi:10.1109/sescps.2019.00016 · Cited by 24 · see citing works
Cyber Crisis Management: A Decision-Support Framework for Disclosing Security Incident Information
Kulikova, O., Heil, R., van den Berg, J., & Pieters, W. (2012) · doi:10.1109/cybersecurity.2012.20 · Cited by 23 · see citing works
Characterizing and Modeling Patching Practices of Industrial Control Systems
Wang, B., Li, X., de Aguiar, L. P., et al. (2017) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/3078505.3078524 · Cited by 23 · see citing works
Bridging functional safety and cyber security of SIS/SCS
Kanamaru, H. (2017) · Annual Conference of the Society of Instrument and Control Engineers of Japan (SICE) · doi:10.23919/sice.2017.8105699 · Cited by 22 · see citing works
Mugarza, I., Amurrio, A., Azketa, E., & Jacob, E. (2019) · IEEE Access · doi:10.1109/access.2019.2905925 · Cited by 19 · see citing works
Self-citationSoftware Updates in Safety and Security Co-engineering
Mugarza, I., Parra, J., & Jacob, E. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66284-8_17 · Cited by 14 · see citing works
Self-citationCetratus: A framework for zero downtime secure software updates in safety‐critical systems
Mugarza, I., Parra, J., & Jacob, E. (2020) · Software Practice and Experience · doi:10.1002/spe.2820 · Cited by 14 · see citing works
Self-citationSafety vs. Security: Why do people die despite good safety?
Kuntze, N., Rudolph, C., Brisbois, B. R., et al. (2015) · Integrated Communication, Navigation and Surveillance Conference (ICNS) · doi:10.1109/icnsurv.2015.7121276 · Cited by 13 · see citing works
Optimizing Network Patching Policy Decisions
Beres, Y., & Griffin, J. (2012) · IFIP International Federation for Information Processing/IFIP · doi:10.1007/978-3-642-30436-1_35 · Cited by 11 · see citing works
Security vs. safety: Why do people die despite good safety?
Kuntze, N., Rudolph, C., Brisbois, G. B., et al. (2015) · Integrated Communication, Navigation and Surveillance Conference (ICNS) · doi:10.1109/icnsurv.2015.7121213 · Cited by 11 · see citing works
Cetratus: Towards a live patching supported runtime for mixed-criticality safe and secure systems
Mugarza, I., Parra, J., & Jacob, E. (2018) · IEEE International Symposium on Industrial Embedded Systems (SIES) · doi:10.1109/sies.2018.8442088 · Cited by 8 · see citing works
Self-citationTowards Fast-Convergence, Low-Delay and Low-Complexity Network Optimization
Wang, S., & Shroff, N. B. (2017) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3154492 · Cited by 7 · see citing works
A Framework to Support ICS Cyber Incident Response and Recovery
Staves, A., Balderstone, H., Green, B., et al. (2020) · Lancaster EPrints (Lancaster University) · Cited by 7 · see citing works
Osorno, M., Millar, T., & Rager, D. (2011) · Cited by 6 · see citing works
Disseminating Security Updates at Internet Scale
Li, J., Reiher, P. L., & Popek, G. J. (2003) · Advances in information security · doi:10.1007/978-1-4615-1021-5 · Cited by 5 · see citing works
Discrete-Time Framework for Determining Optimal Software Release and Patching Time
Tickoo, A., Kapur, P. K., Shrivastava, A. K., et al. (2017) · Springer proceedings in business and economics · doi:10.1007/978-981-10-5577-5_11 · Cited by 4 · see citing works
Quarantine-mode based live patching for zero downtime safety-critical systems
Inchausti, I. M. (2019) · Cited by 2 · see citing works
El Esquema Nacional de Seguridad, al servicio de la ciberseguridad del sector público
Gómez, M. Á. A. (2018) · Economía industrial · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 4
- [1]Andreeva O. Gordeychik S. Gritsai G. Kochetova O. Potseluevskaya E. Sidorov S.I. Timorin A.A. Industrial control systems vulnerabilities statistics Kaspersky Lab. Rep. 2016 10.13140/RG.2.2.15858.66241 · DOI
- [20]Tricker R. ISO 9001: 2000 In Brief Elsevier San Diego, CA, USA 2001
- [24]U.S. Homeland Security Cyber Resilience Review (CRR) U.S. Homeland Security Washington, DC, USA 2014
- [64]Pina L. Andronidis A. Hicks M. Cadar C. Mvedsua: Higher availability dynamic software updates via multi-version execution Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems Providence, RI, USA 13–17 April 2019 573 585
Cited by
Sorted by citations
A Survey on Cybersecurity Challenges, Detection, and Mitigation Techniques for the Smart Grid
Tufail, S., Parvez, I., Batool, S., & Sarwat, A. (2021) · Energies · doi:10.3390/en14185894 · Cited by 143 · see citing works
Eyeleko, A. H., & Feng, T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3308195 · Cited by 38 · see citing works
“Lack of patch management is one of the main causes of inherent IIoT security vulnerabilities [15].”
BackgroundMapping of Industrial IoT to IEC 62443 Standards
Cindrić, I., Jurčević, M., & Hadjina, T. (2025) · Sensors · doi:10.3390/s25030728 · Cited by 29 · see citing works
“Mugarza et al. [49] propose a structured patch lifecycle model for testing, approval, and installation that is compatible with IEC 62443.”
- Authors
- Mugarza, I., Flores, J. L., & Montero, J. L.
- Affiliations
- Ikerlan (ES)
- Industrial Cybersecurity, IKERLAN Technology Research Center, Basque Research and Technology Alliance (BRTA), P.J.M. Arizmendiarrieta 2, 20500 Arrasate/Mondragón, Spain
- Corresponding author
- Mugarza, Imanol
- Venue
- Sensors
- Publisher
- MDPI AG
- Published
- 2020-12-14
- Volume
- 20
- Issue
- 24
- Pages
- 7160
- ISSN
- 1424-8220 (ISSN-L)
- PMC
- PMC7764973
- OpenAlex
- W3110647387
- Cited by
- 65
- References
- 44
- Citations by year
- 2026: 11 · 2025: 11 · 2024: 14 · 2023: 18 · 2022: 7 · 2021: 4
- FWCI
- 1.05
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Sensors (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Centro para el Desarrollo Tecnológico Industrial (CER-20191012)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Physical Sciences › Engineering › Industrial and Manufacturing Engineering › Digital Transformation in Industry
- Keywords
- Industrial Internet of Things, industrial automation and control systems, security maintenance, IEC 62443, industrial cybersecurity, cyberattacks, attack surface, security lifecycle
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
