# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 2 State of the Art
### IIoT and Industry 4.0 Cybersecurity Tools  
A typical cybersecurity audit/attack is composed by four phases:  
* Recon. In this first phase information on the target is collected. Such data can be obtained from diverse information sources (e.g., web sites, manufacturers, user manuals, datasheets) and usually involves scanning the target ports to look for potential open services, misconfigurations and vulnerabilities. * Audit/Attack planning. After analyzing the potential entry points of the target, the auditor/attacker needs to create an audit/attack plan. For such a purpose it is necessary to choose the right steps and tools. Regarding the latter, it is often necessary to develop software tools adapted to the audit/attack scenario so as to exploit the vulnerabilities detected in the previous phase. * Access. The designed plan is executed by making use of the selected tools in order to access the target system by exploiting the detected vulnerabilities. * Execution. After gaining access, the designed audit/attack plan will continue to take control of the system. In this phase it is usual to perform different actions to maintain the gained access for future intrusions (e.g., by creating a back door). Among the four previously described phases, the Recon phase is arguably the most tedious, since it involves dedicating a significant amount of time and resources. Luckily, there are tools that allow for shortening such a phase drastically. Some of the most relevant are compared in Table 2 in terms of their execution requirements, their scanning exposure (i.e., their ability for hiding the auditor/attacker IP/port when scanning a target), their ease of use, their pricing model and the APIs they provide. As it can be observed in Table 2, there are tools that require, besides an Internet connection, only a web browser, which is ideal for setting up cybersecurity labs fast and thus decreasing potential installation problems. Moreover, to prevent potential legal and network problems, students should not carry out indiscriminate scans on industrial devices over the Internet, so the port/vulnerability scanners provided by ZMap [55], Metasploit [56], Nmap [57] or Nessus [58] should be avoided. Among the rest of the compared tools, for the learning approach proposed in this article, Shodan was selected due to its low execution requirements (it only requires an Internet connection and a web browser, so students can use it remotely and even with a smartphone or a tablet), its ease of use (its basic interactions are similar to the ones required when using a web search engine), its available APIs (two developer APIs and an Exploit API are available) and its pricing policy for students and academia, which allows for using most Shodan features for free. Nonetheless, it is important to note that the methodology and use cases proposed in this article can be easily adapted to be used with other tools like Censys [59], ZoomEye [60], BinaryEdge [61] or Onyphe [62]. Shodan has been previously used to teach general IoT cybersecurity through practical use cases, but following a different teaching methodology and without considering the security implications of industrial scenarios [63]. Moreover, Shodan has also been used to assess the cybersecurity of devices that are part of the IT systems of an industrial company. For example, vulnerable webcams, routing devices and firewalls were analyzed by [PERSON] et al. [64] after detecting them with Shodan. Web cameras were also studied by [PERSON] et al. [65], who found that a significant number of them were weakly protected or not protected at all, which may allow attackers to use them for cyberattacks [66]. Finally, it is worth mentioning that there is a specific area on Shodan's webpage for detecting multiple ICSs [67]. In fact, different researchers have previously warned on the existence of numerous ICSs, Supervisory Control and Data Acquisition (SCADA) systems and PLCs exposed on the Internet and that can be easily discovered with Shodan [68; 69; 70; 71; 72].