A framework for applying digital twins to support incident response

The convergence of information technology (IT) and operational technology (OT) has made manufacturing industries an attractive target for cyberattacks, ranging from industrial espionage to sabotage. Existing security tools, operating alone, are not capable enough to manage cybersecurity operations effectively. Digital twin (DT), as a security-enhancing enabler, can support complementary security measures alongside existing incident response (IR) solutions. DTs have been proposed in different IR phases; however, a comprehensive solution covering the IR lifecycle has yet to be addressed. This paper presents a DT-based IR solution to guide plant operators in modeling security-enhancing DTs for manufacturing industries. Moreover, the DT-based IR solution integrates existing security tools to ensure the effective safeguarding of critical assets and prompt response to cyber incidents. With an automotive assembly line as a cyber-physical production system (CPPS) use case, we examine the applicability of a DT-based IR solution.