# Cyber Threat Actors for the Factory of the Future
## 4 Threat Actor Landscape for the Factory of the Future (FoF)
### Definition of the FoF  
A high degree of networking of the manufacturing landscape, data processing in real time across systems and the associated supply chains characterize advanced industrial landscapes today. The generic term Industry 4.0 encompasses all these developments as a concept for the networking of the industrial landscape. The term was coined in Germany in the early 2010s and since then has prompted many technical/scientific publications worldwide [50]. The integration of existing technologies and tools such as embedded systems, sensors, and other industrial hardware to enable real-time data processing reflects the Industry 4.0 ecosystem. Within this ecosystem, the CyberFactory No. 1 project (see: [[https://www.cyberfactory-1.org/en/home/](https://www.cyberfactory-1.org/en/home/)]([https://www.cyberfactory-1.org/en/home/](https://www.cyberfactory-1.org/en/home/))) aims to design, develop, integrate and demonstrate a number of key capabilities to enhance the optimization and resilience of the FoF.  
Additive manufacturing, autonomous machines, collaborative robotics, machine learning, augmented reality, big data analytics and many more technologies and digital methods/processes are connected to the environment of the FoF. A white paper from the World Economic Forum [51] found that factories that were able to push beyond just piloting these new technologies were those that embraced three key elements at scale: connectivity, intelligence and flexible automation. These elements bring with them cyber security challenges that have not been much discussed.  
The feature of high connectivity is especially interesting from a cyber security point of view. A FoF may be permanently connected to the internet at many points, cloud manufacturing (CMfg), industrial internet-of-things (IIoT) so that meshed networks may be utilized, and IT and operational technology (OT) systems may be interlocked. These connections create new opportunities for traditional attack patterns, and certainly new attack vectors to target the FoF.  
While widespread connectivity may include connections to other organizations, it is important to make a distinction in order to better understand different cyber threats for each aspect. To this aim, we separate network connectivity and collaboration from each other [52].  
One can look at the intelligence aspect of a FoF from two perspectives: On the one hand, machine learning or other AI techniques enable the use of autonomous robots or machines that can learn and work beside humans on the factory shop floor. On the other hand, big data decision making can help optimize processes along the whole value chain, from engineering to customer service.  
Flexible automation is enabled by the connectivity and intelligence of a FoF. It allows quick and aligned reactions to unusual situations, being able to customize products according to customer needs as well as reducing waste in time and materials. New ways to manufacture products in a flexible manner include, e.g., additive manufacturing (3D printing) and cloud manufacturing.  
This paper will use the network connectivity, collaboration, intelligence and flexible automation as the defining features of the FoF. While they are often dependent on each other (e.g., collaboration and flexible automation require a high degree of connectivity) they give better base to consider different threats to the system and to identify the most meaningful cyber threats and CTAs affecting the FoF environment. The authors do not hold the position that this division includes all aspects of all FoF environments or that all FoF environments have all of the listed aspects. The division is used more as a tool to identify the main aspects of FoF.