Cyber-Physical Security Vulnerabilities Identification and Classification in Smart Manufacturing: A Defense-in-Depth Driven Framework and Taxonomy
Md Habibor Rahman, Mohammed S. Shafae · Journal of Computing and Information Science in Engineering · 2025
Abstract The increasing cybersecurity threats to critical manufacturing infrastructure necessitate proactive strategies for vulnerability identification, classification, and assessment. Traditional approaches, which define vulnerabilities as weaknesses in computational logic or information systems, often overlook the physical and cyber-physical dimensions critical to manufacturing systems, comprising intertwined cyber, physical, and human elements. As a result, existing solutions fall short of addressing the complex, domain-specific vulnerabilities of manufacturing environments. To bridge this gap, this work redefines vulnerabilities in the manufacturing context by introducing a novel characterization based on the duality between vulnerabilities and defenses. Vulnerabilities are conceptualized as exploitable gaps within various defense layers, enabling a structured investigation of manufacturing systems. This article presents a manufacturing-specific cyber-physical defense-in-depth model, highlighting how security-aware personnel, postproduction inspection systems, and process monitoring approaches can complement traditional cyber defenses to enhance system resilience. By leveraging this model, we systematically identify and classify vulnerabilities across the manufacturing cyberspace, human element, postproduction inspection systems, production process monitoring, and organizational policies and procedures. This comprehensive classification introduces the first taxonomy of cyber-physical vulnerabilities in smart manufacturing systems, providing practitioners with a structured framework for addressing vulnerabilities at both the system and process levels. Finally, we demonstrate the application of the proposed framework through an illustrative smart manufacturing system, detailing its threat model, cyber-physical defense-in-depth strategy, vulnerability identification and mapping to the attack kill chain, empirical attack analysis, and potential mitigation strategies. This work equips manufacturers with actionable insights and a robust classification scheme to proactively address the cybersecurity challenges of modern manufacturing systems.