## 2 Literature Review
### Cyber Defense Approach
#### 2.6.2 Latest Research for Risk Mitigation in SCADA  
A cybersecurity program needs the capacity to counter cyber risks at all levels, including those associated with people, processes, and technical systems [31]. At the human level, practices like user access management, regular security awareness training, and monitoring help reduce risks from intentional or careless insider behavior. Strong organizational processes are also critical implementations that are required to follow standardized methodologies, have defined change controls, and include planning for incidents and auditing adherence. Technically, defenses need depth across the network, endpoint, application, and data layers. Tools provide visibility into anomalous activity while security controls enforce policies. Continual monitoring and maintenance strengthen resilience over time. Through a balanced, comprehensive approach addressing people, processes, and technology, manufacturers can manage cybersecurity challenges in an integrated manner as widespread connectivity transforms the risk landscape. Table 1 summarizes the latest research outputs that can be applied at each layer of the DID model to mitigate risks introduced by Industry 4.0 integration and increased connectivity between IT and OT systems. The compilation highlights research focused on countering emerging vulnerabilities through comprehensive cybersecurity policies, processes, and technical controls.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Layer in DID** & \multirow{2}{*}{**New Cyber Risk in SCADA**} & \multirow{2}{*}{**Latest Research Direction for Risk Mitigation**} \\
**Security Model** & & & \\ \hline \multirow{4}{*}{**People**} & \(\bullet\) & Insider threats (intentional behavior) & \(\bullet\) & User access management \\  & \(\bullet\) & Human errors (careless behavior) & \(\bullet\) & Monitoring and activity logging \\  & \(\bullet\) & Lack of security awareness & \(\bullet\) & Regular security awareness training \\  & \(\bullet\) & Least privilege permissions & \\ \hline \multirow{4}{*}{**Policy**} & \(\bullet\) & New risks from increased OT-IT connectivity & \(\bullet\) & Define access control policies \\  & \(\bullet\) & Lack of defined strategic and tactical security & \(\bullet\) & Establish patch management best practices \\  & & policies & \(\bullet\) & Set backup and recovery policies \\  & & \(\bullet\) & Develop incident response plans \\ \hline \multirow{4}{*}{**Process**} & \(\bullet\) & Vulnerabilities in workflows & \(\bullet\) & Deploy firewalls for network security \\  & \(\bullet\) & Weak change control processes & \(\bullet\) & Implement intrusion detection systems \\  & \(\bullet\) & Traditional isolation of OT no longer sufficient & \(\bullet\) & Require multifactor authentication \\  & \(\bullet\) & Risks from unprotected interconnectivity & \(\bullet\) & Perform compliance auditing \\  & \(\bullet\) & Build in redundancy for critical systems \\ \hline \multirow{4}{*}{**Technology**} & \(\bullet\) & Unsecured networks & \(\bullet\) & Combined authentication and encryption \\  & \(\bullet\) & Vulnerable endpoints and devices & \(\bullet\) & Harden endpoints via OS configurations \\ \cline{1-1}  & \(\bullet\) & Unencrypted communications & \(\bullet\) & Enable VPN connections \\ \cline{1-1}  & \(\bullet\) & Poor application security & \(\bullet\) & Whitelist authorized applications \\ \cline{1-1}  & \(\bullet\) & Lack of data protections & \(\bullet\) & Deploy antivirus and malware protection \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of latest research direction for risk mitigation in 4 layers.