# A Review of Industry 4.0 Manufacturing Process Security Risks
## 2 A Complete Paradigm Shift
### Traditional Approach to Manufacturing Process Security
Although numerous well-established security measures for TCP/IP  
Figure 2: Illustration of the OT network at the Maroochy Shire sewage plant. SCADA: supervisory control and data acquisition  
communications are available today, such security measures were still in their infancy (if existent at all) when TCP/IP-compatible SCADA systems were introduced. However, these security measures are mostly applicable to IT systems networks, and are generally not compatible with OT systems networks--a topic that is discussed in more detail in Section 2.2. Such a lack of well-established security measures is more than enough of a vulnerability in process control security to allow any person with sufficient knowledge of the process control architecture to gain unauthorized access to the control network and to induce changes in the process control settings that are driven with malicious intent. This fact highlights another important security vulnerability of traditional OT systems, namely that control networks have little or no security that can protect the networks from unauthorized access. One of the general causes of these types of security vulnerabilities of traditional OT systems is a direct result of the technological platforms around which they are designed. For example, although many of the \"intelligent\" OT systems make use of embedded microcontroller platforms, these platforms generally do not possess the computational capacity required to implement proper security measures. Furthermore, these embedded platforms typically use standard (and somewhat primitive) peripherals such as RS-232, inter-integrated circuit or serial peripheral interface to communicate with each other. Although some of the protocols used between OT systems are typically proprietary, the simple nature of the communication peripherals makes them relatively easy to intercept [8]. Besides OT platforms in general, many manufacturing plants also contain a network of IT equipment that typically includes devices such as computers, printers, servers and routers. This type of equipment usually possesses a much higher computing capacity, so that advanced security measures can be implemented, such as antivirus software and firewalls. Information and data security in IT systems is characterized by three key aspects: confidentiality, integrity and availability (CIA) [8; 9]. These are known as the three CIA pillars of information and data security. Information of a confidential nature should be protected from parties that are unauthorized to view it. This may be, for example, in the form of documentation that contains sensitive information that could cause harm to a company should it be leaked into the wrong hands. The integrity of information is a very important aspect that concerns the validity of the data. Should information be maliciously manipulated without detection, it could be difficult to determine whether or not the information is actually legitimate. When information loses its integrity, it can hide important detail that, if not interpreted as it should be, could have detrimental consequences in a production environment. An example of such a case would be data containing the safety parameters of an industrial plant's processes that are manipulated, in order to represent a false indication of the actual states of the processes to which control systems could erroneously react. Of course, no data would be useful without being available to the parties that need the data. Therefore, data should always be available to the intended parties without landing in the hands of unauthorized individuals. It can thus be intuitively deduced that an effective IT security system requires a fine balance between these three key aspects (confidentiality, integrity and availability), which can very easily be in conflict with one another if not properly implemented.