SOAR4IoT: Securing IoT Assets with Digital Twins

Empl, Philip; Schlette, Daniel; Zupfer, Daniel; Pernul, Günther

doi:10.1145/3538969.3538975

Cited by 9 publications

(4 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Papacharalampopoulos et al [30] specify a roadmap for designing and implementing DTs to add agility and resilience to manufacturing. In particular, Empl et al [31] developed a cybersecurity framework based on DTs to analyze the vulnerabilities of IoT systems applying the SOAR (security orchestration, automation, and response) paradigm. -Continuous improvement and optimization: DTs are specialized in continuous improvement methods such as kaizen and optimization.…”

Section: Dt Concept and Its Adoptionmentioning

confidence: 99%

Digital Twins in Software Engineering—A Systematic Literature Review and Vision

Guinea-Cabrera,

Holgado-Terriza

2024

Applied Sciences

View full text Add to dashboard Cite

Digital twins are a powerful consequence of digital transformation. In fact, they have been applied to many industries to enhance operations, predict needs, improve decision making, or optimize performance, even though the definition of digital twins is still evolving. However, their impact on the software industry is still limited. Thus, this work aims to analyze the current adoption of digital twins in the software industry as a potential path to integrate them into application lifecycle management. To achieve this objective, first, the significant characteristics of current digital twins are analyzed in their application to manufacturing to understand how the knowledge and the lessons learned can be transferred to the software industry. Second, a systematic literature review was conducted on Scopus, the Web of Science, and the ScienceDirect database. The literature review revealed 93 documents after data screening and cleaning 251 initial documents. Our main findings are that digital twins are already influencing and will significantly affect the software industry, revolutionizing various aspects of the software development lifecycle. This study tackles what identifies a digital twin in the software industry, the specific domains and areas where they can be applied in the software lifecycle, and the proposed approaches explored to build digital twins for developing, deploying, and maintaining software systems. Finally, this study proposes some guidelines for building digital twins in the context of application lifecycle management. Determining an appropriate roadmap shortly is essential to achieve a widespread applicability to building suitable digital twins and preparing organizations for the software industry.

show abstract

Section: Dt Concept and Its Adoptionmentioning

confidence: 99%

Digital Twins in Software Engineering—A Systematic Literature Review and Vision

Guinea-Cabrera,

Holgado-Terriza

2024

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…From a cybersecurity perspective, we map incident response activities to the functional domain because incident response orchestrates assets using predefined logic. For example, incident response is automated using playbooks to secure the IoT [12]. Digital twins provide an additional layer of security and orchestrate physical assets.…”

Section: Dt2sa Modelmentioning

confidence: 99%

“…These operation modes serve different use cases and enable various application scenarios, e.g., intrusion detection, security testing, security training, or penetration testing [8]. Digital twins are also considered an additional layer of security for the IoT that manages incident response [12]. Of course, digital twins present new cybersecurity challenges, but this has already been addressed by research [13].…”

mentioning

confidence: 99%

Digital-Twin-Based Security Analytics for the Internet of Things

Empl

Pernul

2023

Information

Self Cite

View full text Add to dashboard Cite

Although there are numerous advantages of the IoT in industrial use, there are also some security problems, such as insecure supply chains or vulnerabilities. These lead to a threatening security posture in organizations. Security analytics is a collection of capabilities and technologies systematically processing and analyzing data to detect or predict threats and imminent incidents. As digital twins improve knowledge generation and sharing, they are an ideal foundation for security analytics in the IoT. Digital twins map physical assets to their respective virtual counterparts along the lifecycle. They leverage the connection between the physical and virtual environments and manage semantics, i.e., ontologies, functional relationships, and behavioral models. This paper presents the DT2SA model that aligns security analytics with digital twins to generate shareable cybersecurity knowledge. The model relies on a formal model resulting from previously defined requirements. We validated the DT2SA model with a microservice architecture called Twinsight, which is publicly available, open-source, and based on a real industry project. The results highlight challenges and strategies for leveraging cybersecurity knowledge in IoT using digital twins.

show abstract

“…As different approaches and sharing use cases exist, integration and semantics of playbooks are investigated [29][30][31]. Against the backdrop of security orchestration and a plethora of commercial SOAR tools [1], specific use cases (e.g., an IoT context with digital twins) have been discussed [32,33]. It can be seen that playbook generation is crucial to leverage SOAR tools.…”

Section: Related Workmentioning

confidence: 99%

Generating ICS vulnerability playbooks with open standards

Empl,

Schlette,

Stöger

et al. 2023

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Organizations face attacks on industrial control systems (ICS) as vulnerabilities are pervasive. However, patching vulnerable systems by simply updating to the newest version is often not an option and shifts focus to workarounds. Beyond pure patching, workarounds specify other remediation measures (e.g., firewall or VPN configuration) that must be taken due to system availability requirements, complexity, or heterogeneous devices. In this paper, we introduce vulnerability playbooks based on open standards. Pushing the envelope of cybersecurity playbooks—steps organizations should follow when responding to cybersecurity incidents reactively—for ICS vulnerability management offers organizations a more transparent, repeatable process and faster, possibly automated actions. We have designed a process model to collect and transform security advisories in Common Security Advisory Framework (CSAF) format and generate Collaborative Automated Course of Action Operations (CACAO) playbooks based on listed remediation advice. With a proof of concept, we demonstrate that structured CSAF documents can be seamlessly transformed into CACAO playbooks. For our industrial use case, we must also use unstructured security advice highlighting quality differences (compared to CSAF). Our generated 79 standard conformant CACAO playbooks with 485 identified actions hint at imbalanced advice toward patching. Preferably, vendors should include detailed technical remediation advice, provide APIs, and go beyond patching recommendations in their security advisories. Subscribers should structure their assets and use machine learning to normalize, generate, and prioritize CACAO playbooks. With CSAF and CACAO, we see two open standards for handling vulnerabilities.

show abstract

SOAR4IoT: Securing IoT Assets with Digital Twins

Cited by 9 publications

References 17 publications

Digital Twins in Software Engineering—A Systematic Literature Review and Vision

Digital Twins in Software Engineering—A Systematic Literature Review and Vision

Digital-Twin-Based Security Analytics for the Internet of Things

Generating ICS vulnerability playbooks with open standards

Contact Info

Product

Resources

About