The Internet of Medical Things (IoMT) couples IoT technologies with healthcare services in order to support real-time, remote patient monitoring and treatment. However, the interconnectivity of critical medical devices with other systems in various network layers creates new opportunities for remote adversaries. Since most of the communication protocols have not been specifically designed for the needs of connected medical devices, there is a need to classify the available IoT communication technologies in terms of security. In this paper we classify IoT communication protocols, with respect to their application in IoMT. Then we describe the main characteristics of IoT communication protocols used at the perception, network and application layer of medical devices. We examine the inherent security characteristics and limitations of IoMT-specific communication protocols. Based on realistic attacks we identify available mitigation controls that may be applied to secure IoMT communications, as well as existing research and implementation gaps.

During the past two decades, oil and gas operational and information technology systems have experienced constant digital growth, closely followed by an increasing number of cyber-attacks on the newly interconnected systems. Adversaries exploit vulnerable accessible device or malware attacks networked services, in an attempt to gain access to critical systems and machinery that are interconnected over networks. Given the importance of the oil and gas sector on the global economy and the diversity of critical systems often being controlled over remote locations, it is highly important to understand and mitigate such attacks. In this paper, we survey cyber-attacks on all three domains of the oil and gas sector (upstream, midstream, downstream) starting from the early 90s up until 2020. For each domain, we document and analyze verified attacks based on real-world reports and published demo attacks on systems. We map and catalogue the attack types used in each case, in order to understand common and subliminal attack paths against oil and gas critical operations. Our aim is threefold, i.e., first, to assess documented attacks using standardized impact assessment techniques and highlight potential consequences of cyber-attacks on this sector, second, to build a vulnerability taxonomy based on technical knowledge gathered by all such incidents and connect each vulnerability with oil and gas systems and respective attack paths, and third, to map the documented knowledge and taxonomies with MITRE’s international knowledge base of Adversary Tactics and Techniques, so as to provide a general guide for analyzing and protecting against cyber-attacks at oil and gas infrastructures.

This paper focuses on the security protocols enacted in banking transactions across the European Economic Area (EEA), as stipulated by the Second or Revised Payment Service Directive (commonly referred to as ‘PSD2’ or simply ‘the Directive’). The study aims to comprehensively analyse the implementation and efficacy of these security measures within the specified jurisdiction. The Directive incorporates fundamental rights and obligations that all stakeholders are compelled to adhere to and delineates specific security measures and standards that both traditional banking institutions and third-party providers (TPP) are mandated to implement. In particular, one of the cardinal mandates for banking and financial institutions under PSD2 is the obligation to facilitate third-party access to customer data via open application programming interfaces (API). While this open banking paradigm and the consequent proliferation of data sharing unquestionably bring about various advantages, such as enhanced consumer choice and market competition, they concurrently expose the financial ecosystem to a slew of potential security vulnerabilities and privacy risks. Upon conducting a comprehensive review of the security requirements and measures stipulated under PSD2 and a comparative analysis with essential cybersecurity frameworks and standards (NIS2, Cybersecurity Act, GDPR, ISO 27001:22 and PCI DSS), we have ascertained a discernible lack of harmonisation and clarity concerning the technical security specifications for its effective implementation. This lacuna substantiates the challenges banks face in fully grasping the extensive spectrum of compliance obligations mandated by PSD2. The aim of this research is to offer a valuable contribution to both the comprehension and the pragmatic deployment of security standards in the context of banking transactions, as regulated by the PSD2. The paper serves as a valuable resource for traditional banking institutions and relevant stakeholders by guiding them through the complexities of PSD2 implementation while also evaluating the effects of the security measures on transactional safeguards, data security, and the provision of payment services.

This paper presents a method that utilizes graph theory and state modelling algorithms to perform automatic complexity analysis of the architecture of cyber-physical systems (CPS). It describes cyber physical systems risk assessment (CPSRA), a tool to provide automatic decision support for enhancing the overall resilience of CPS architectures often used in critical infrastructures. CPRSA is built to enhance industrial risk assessment and improve the resilience of CPS architecture against malicious attacks on the cyber domain that can affect industrial processes, which is critical in a distributed cyber environment. Such attacks often compromise execution states on physical components and lead to hazards or even disasters through plant malfunction. CPSRA is tested against a real-world testbed model of a large SCADA system that is infused with real-world CVE vulnerabilities in some of its components. The tool creates an isomorphic graph of the CPS process model and uses graph algorithms and network analytics on the model to test cyber-attacks and evaluate attack resilience aspects. The tool’s output is then used to pinpoint high-complexity components in terms of influence on the overall CPS architecture and suggest mitigation points for security measure implementation while considering every potential subattack path and subliminal path on the model’s attack graph. The paper complements standardized assessment reports and contributes to automatic architecture assessment for critical infrastructure environments and can be used as the basis to model dependencies and threat propagation in larger digital twins, a need outlined in major NIST publications concerning the security of industrial systems that was previously done manually, without automatic insight into state and vulnerability influences.