## 2 Background
### Cybersecurity in IoUT
Cyberattacks are divided in two broad categories: (a) active and (b) passive. The typical cycle of a cyberattack has the following order: (a) reconnaissance (physical/social and Web/host), (b) scanning and enumeration, (c) gaining access (exploitation), (d) maintaining access, and (e) covering tracks. As a cyberattack defender or cyberattack analyst, the first two steps are the most crucial to prevent an attacker from enumerating and exploiting a network. Furthermore, accuracy in data recording and their analysis, have become challenging goals, mainly due to the data visibility challenges, which concerns the degree of ease by which data can be monitored and analyzed from numerous sources. It is very important to mention that almost every security mechanism an enterprise employs affects data visibility negatively. For example, the use of HTTPS (Hypertext Transfer Protocol Secure) protocol, which provides end-to-end secure connectivity, does not allow a security analyst to monitor data traffic. Nevertheless, several standards have been developed to tackle this issue, such as chain of custody (ISO standard 22095, [[https://www.iso.org/standard/72532.html](https://www.iso.org/standard/72532.html)]([https://www.iso.org/standard/72532.html](https://www.iso.org/standard/72532.html)), accessed on 20 November 2022), concerns \"the chronological documentation that recordsthe sequence of custody, control, transfer, analysis and disposition of materials, including physical or electronic evidence\", supporting the traceability of data. The use of digital systems is now essential for civil/military maritime activity. This digitalization to help the automation of tasks without human interaction, in combination with the cooperation of a swarm of underwater assets, increases complexity in early detection of attacks, results in various weaknesses [51] and raises vulnerabilities in an exponential manner. Furthermore, security assurance, which is defined as: \"the degree of confidence that the security requirements of an IT system are satisfied\" [52] is not ensured. Threat assessment, risk analysis and modeling techniques enable IT systems to map security, privacy, and safety requirements, to specific counter measures [52]. Numerous standardized methods for industrial cyber risk assessment exist, with the most remarkable being the Formal Safety Assessment (FSA) and Cyber Preliminary Hazard Analysis (CPHA). The first one concerns \"a structured and systematic methodology, aimed at enhancing maritime safety including protection of life, health, the marine environment and property, by using risk analysis and cost-benefit assessment\" [53]. On the other hand, CPHA [54] requires several steps to establish a Security Risk Assessment and document all possible hazardous scenarios [54]. It is a fact, that most of the attacks carried out on the surface are undoubtedly achieved in the underwater domain also. In IoUT, which incorporates various special characteristics, the risk of a cyberattack or exposure of sensitive information is increased, and the attack surface is expanded, namely the aggregation of vulnerabilities of a system. Due to the dynamic environment of IoUT, where uncertainty, heterogeneity, and big data generate potential vulnerabilities, there is an extremely high demand to establish real-time cybersecurity assessment. Moreover, slow bit-rate issues make the rapid alert evaluation unfeasible. Numerous methods are appropriate in achieving confidentiality, integrity, and availability in underwater communications, nevertheless, the priority should be the consolidation of security requirements considering the various components of this domain, the diversity of communication protocols and physical phenomena of water. Several cybersecurity frameworks have been developed to support and automate the process of protection from cyber adversaries and reduce cybersecurity risk. This process usually comprises standard steps such as detect, respond and recover.