Why it matters
Digital twins can convert accepted data and software state into analysis, recommendations, or physical authority. A failure may therefore cross from information integrity into operational, safety, privacy, financial, or environmental consequences.
Affected components
decision services, operator consoles, controllers, actuators
Attack surface
Device identity, local interfaces, network paths, data ingestion, service APIs, storage, model pipelines, administrative tooling, and supplier-maintained connections.
Prerequisites
Some ability to influence a trusted source, credential, component, integration, update path, operator workflow, or assurance assumption. Exact prerequisites are implementation-dependent.
Conceptual attack sequence
- Establish influence over an accepted component or trust relationship.
- Introduce data, identity, model, or command state that appears acceptable.
- Allow ordinary synchronization or decision logic to propagate the state.
- Exploit delayed detection, incomplete provenance, or excessive authority.
This sequence supports threat modeling and detection. It intentionally omits exploit procedures, payloads, and real-target instructions.
Observable indicators
- Identity or certificate changes outside maintenance windows.
- Timing, sequence, calibration, or provenance anomalies.
- Mismatch among independent physical and digital observations.
- Unexpected model, parameter, API, or command changes.
- Operator views that disagree with process invariants or trusted local evidence.
Likely impact
- Incorrect state estimation or prediction
- Unsafe or inefficient decisions
- Loss of availability or confidence
- Damaged audit and incident evidence
- Potential physical, privacy, financial, or environmental harm
Defensive controls
Independent command authorization and safety
Separate recommendation from physical authority and enforce interlocks, limits, approvals, and fail-safe states.
Least privilege and policy enforcement
Authorize each telemetry, model, API, and command action by subject, resource, purpose, and context.
Segmentation and bounded pathways
Constrain communication among devices, twin services, enterprise systems, vendors, and control networks.
Cross-domain monitoring
Correlate cyber events, physical process behavior, data quality, model drift, identity use, and operator actions.
References
- NIST IR 8356: Security and Trust Considerations for Digital Twin TechnologyNIST · 2025 · Government research publication
Primary NIST treatment of digital-twin characteristics, cybersecurity, and trust considerations.
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) SecurityNIST · 2023 · Government guidance
Security guidance for OT while accounting for performance, reliability, and safety requirements.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and OrganizationsNIST · 2020 · Control catalog
A flexible catalog of security and privacy controls; not a digital-twin-specific baseline.