## 3 Key Findings
### RQ1: What Are the Security Challenges of IIoT?
#### 3.1.1 RQ1-1: Architectural Design Loopholes of IIoTsec  
According to [PERSON] et al. [47] and [PERSON] et al. [19], IIoT would remain insecure for operation until the architectural structure of the system is re-engineered. This is because the system is built with the main intention of functionality rather than the secure dynamicity of the system. Thus, the loophole remains persistent and becomes a backdoor access to the intended attacks. For instance, IIoT uses the SCADA system as a monitoring tool for all data collected from network-dependent multiple devices [47]. Meanwhile, Modbus technology, one of SCADA's most commonly used protocols, operates using serial communication on a master-slave-based configuration. However, it lacks the triads of security--confidentiality, integrity, and availability--plus authentication [48]. As a result of the identification deficiency of an unauthorized slave-master IP address within the SCADA network [11]. Furthermore, the pioneer cyberattacks on SCADA systems can be traced back to 1982, with a massive explosion occasioned by the trojan effect on the Trans-Siberian pipeline [49]. Since then, the weakness of SCADA has been continuously exploited by intruders. In 2010, Stuxnet targeted PLCs of Iran's gas pipeline (GP) and power plants, which eventually destroyed 984 centrifuges in a uranium enrichment plant. In 2014, a BlackEnergy trojan was created for the SCADA system. This worm traversed in a Microsoft Word document, which devastated several media and energy firms, mining industries, railways, and airports in Ukraine. In 2015, several hours of blackout were experienced when the Kyiv power distribution company was disconnected from its 30 substations for three hours through BlackEnergy 3. Also, in 2017, another malware, TRITON, intrusively recorded some uniquePLCs of the SCADA system into a failed state. This failure caused a sudden shutdown of a Saudi Arabian petrochemical processing plant. In addition, Kaspersky's products experienced a SCADA assault in 2016--an attack that relegated almost 39.2% of Kaspersky-secured industrial machines [50]. Eventually, the \"success\" record of vulnerable SCADA devices becomes accountable to the threats on the entirety of industrial processes [51]. As a result, the authors in [52] proposed an ensemble of deep belief networks (DBNs) algorithms and support vector machines (SVM) to checkmate architectural intrusions in SCADA networks to safeguard industrial control systems (ICSs). Considering the adverse consequences of architectural design loopholes, [PERSON] et al. [52] designed an automatic architecture of convolutional neural networks (CNNs) based on differential evolution for intrusion detection systems (IDS) in ICSs. The proposed DL-IDS was evaluated using two intrusion detection datasets for ICS. The findings depicted acceptable performance results for threat detection in the ICSs. Moreover, [PERSON] et al. [53] identified access control leakage of SCADA, therefore making supervisory control management, role engineering, and assignment propagation deficient. To, therefore, ensure privacy and users' access to resources in a SCADA-enabled IIoT ecosystem, a mapping framework of multilayer feedforward artificial neural network (ANN) and extreme learning machine (ELM) was proposed in [53]. The finding showed that MLP has better accuracy compared to the ELM mode, though the latter is more time-efficient in its deployment. Similarly, soft strict operational guidelines for the emerging \"smart\" deployments into the IIoT ecosystem are another factor for the security shortcomings in IIoT devices. IIoT devices become open to several assaults due to uncensored cyber data and devices [23; 54]. In addition, sensors' positioning in a perception layer is also identified as an architectural design loophole in an IIoT environment. In the work of [PERSON] et al. [36], the authors discovered a high level of signal attenuation in an IIoT environment due to the topological positioning of sensors and the resource-constraint of IIoT devices.