Abstract The Industrial Internet of Things (IIoT) provides new opportunities to improve process and production efficiency, which enable new business models. At the same time, the high degree of cross-linking and decentralization increases the complexity of IIoT systems and creates new vulnerabilities. Hence, organizations are not only vulnerable to conventional IT threats, but also to a multitude of new, IIoT-specific attacks. Yet, a literature-based and empirically evaluated understanding of attacks on the IIoT is still lacking. Against this backdrop, we develop a multi-layer taxonomy that helps researchers and practitioners to identify similarities and differences between attacks on the IIoT. Based on the latest literature and a sample of about 50 attacks, we deductively and inductively determine attack characteristics and dimensions. We demonstrate the usefulness and practical relevance of our taxonomy by applying it to a real-world incident affecting a German steel facility. By combining IT security, IIoT, and risk management to form an interdisciplinary approach, we contribute to the descriptive knowledge in these fields. Industry experts confirm that our taxonomy enables a detailed classification of attacks, which supports the identification, documentation, and communication of incidents within organizations and their value-creation networks. With this, our taxonomy provides a profound basis for the further development of IT security management and the derivation of mitigation measures.

中文翻译：

---

对工业物联网的攻击——多层分类法的发展

摘要 工业物联网 (IIoT) 为提高流程和生产效率提供了新机遇，从而实现了新的商业模式。同时，高度的交叉链接和去中心化增加了 IIoT 系统的复杂性并产生了新的漏洞。因此，组织不仅容易受到传统 IT 威胁的影响，而且容易受到大量新的、特定于 IIoT 的攻击。然而，仍然缺乏对 IIoT 攻击的基于文献和经验评估的理解。在此背景下，我们开发了一个多层分类法，帮助研究人员和从业人员识别 IIoT 攻击之间的异同。基于最新的文献和大约 50 次攻击的样本，我们通过演绎和归纳确定攻击特征和维度。我们通过将其应用于影响德国钢铁设施的真实事件来证明我们的分类法的有用性和实际相关性。通过将 IT 安全、IIoT 和风险管理结合起来形成跨学科的方法，我们为这些领域的描述性知识做出了贡献。行业专家证实，我们的分类法可以对攻击进行详细分类，从而支持组织及其价值创造网络内事件的识别、记录和交流。这样，我们的分类法为 IT 安全管理的进一步发展和缓解措施的推导提供了深刻的基础。和风险管理以形成跨学科的方法，我们为这些领域的描述性知识做出贡献。行业专家证实，我们的分类法可以对攻击进行详细分类，从而支持组织及其价值创造网络内事件的识别、记录和交流。这样，我们的分类法为 IT 安全管理的进一步发展和缓解措施的推导提供了深刻的基础。和风险管理以形成跨学科的方法，我们为这些领域的描述性知识做出贡献。行业专家证实，我们的分类法可以对攻击进行详细分类，从而支持组织及其价值创造网络内事件的识别、记录和交流。这样，我们的分类法为 IT 安全管理的进一步发展和缓解措施的推导提供了深刻的基础。