Since the early 1960, industrial process control has been applied by electric systems. In the mid 1970's, the term SCADA emerged, describing the automated control and data acquisition. Since most industrial and automation networks were physically isolated, security was not an issue. This changed, when in the early 2000's industrial networks were opened to the public internet. The reasons were manifold. Increased interconnectivity led to more productivity, simplicity and ease of use. It decreased the configuration overhead and downtimes for system adjustments. However, it also led to an abundance of new attack vectors. In recent time, there has been a remarkable amount of attacks on industrial companies and infrastructures. In this paper, known attacks on industrial systems are analysed. This is done by investigating the exploits that are available on public sources. The different types of attacks and their points of entry are reviewed in this paper. Trends in exploitation as well as targeted attack campaigns against industrial enterprises are introduced.

The emergence of the Internet of Things and the interconnection of systems and machines enables the idea of Industry 4.0, a new industrial paradigm with a strong focus on interaction and communication between physical and digital entities, leading to the creation of cyber-physical systems. The digital twin and the standard for the Asset Administration Shell are concepts derived from Industry 4.0 that exploit the advantages of connecting the physical and virtual domains, improving the management and display of the collected data. Furthermore, the increasing availability of data has enabled the implementation of data-driven approaches, such as machine and deep learning models, for predictive maintenance in industrial and automotive applications. This paper provides a two-dimensional review of the Asset Administration Shell and data-driven methods for predictive maintenance, including fault diagnosis and prognostics. Additionally, a digital twin architecture combining the Asset Administration Shell, predictive maintenance and data-driven methods is proposed within the context of the WaVe project.

Operational Technology (OT) networks and devices, i.e., all components used in industrial environments, were not designed with security in mind. Efficiency and ease of use were the most important design characteristics. However, due to the digitization of industry, an increasing number of devices and industrial networks are opened up to public networks. This is beneficial for the administration and organization of the industrial environments. However, it also increases the attack surface, providing possible points of entry for an attacker. Originally, breaking into production networks meant to break an information technology (IT)-perimeter first, such as a public Website, and then to move laterally to industrial control systems (ICSs) to influence the production environment. However, many OT-devices are connected directly to the Internet, which drastically increases the threat of compromise, especially since OT-devices contain several vulnerabilities. In this work, the presence of OT-devices in the Internet is analyzed from an attacker’s perspective. Publicly available tools, such as the search engine Shodan and vulnerability databases, are employed to find commonly used OT-devices and map vulnerabilities to them. These findings are grouped according to the country of origin, manufacturer, and number as well as severity of vulnerability. More than 13000 devices were found, almost all contained at least one vulnerability. European and Northern American countries are by far the most affected ones.

Recently, advances in cyber-physical systems and IoT led to an increase in devices connected to the internet. This rise of functionality also comes with an increased attack surface for cyber criminals. A proven method for forensic investigations of trends and developments in crimes conducted in the virtual world are honeypots. We set up a medium interaction honeypot offering telnet and SSH services. With this honeypot we captured data from attack sessions. This data was used for statistical and behavioural analysis, such as distributions of attacks and different attacker IPs, originating countries, employed anonymisation services, skill level of an adversary and commonly targeted embedded devices. Furthermore, machine learning techniques that are capable of identifying unique types of sessions based on issued commands and provided credentials are presented in this work. There are strong indicators that most of the traffic captured during our research is caused by botnet activities, which corresponds to findings of different research activities.