Business Process Management for IIoT Security

Cybersecurity in the Industrial Internet of Things (IIoT) is complicated by heterogeneous assets, long lifecycles, and evolving regulations. This dissertation proposes a lifecycle-oriented, process-centric approach that leverages Business Process Management (BPM) to embed cybersecurity requirements directly into industrial workflows and to sustain continuous compliance. Aligned with the BPM phases Design, Configuration, Monitoring, and Diagnosis, the work contributes methods, notations, and tooling that connect design-time models to runtime compliance. In Design, the dissertation introduces structured guidelines for manual process discovery tailored to industrial settings and presents SIREN, a security-aware Business Process Management and Notation (BPMN) extension that models IIoT controls and compliance requirements (e.g., IEC 62443). In Configuration, it defines a standard-agnostic formal syntax for annotating BPMN models and a transformation pipeline that operationalizes modeled controls as machine-readable rules for enforcement and monitoring systems. In Monitoring, it proposes a layered framework for continuous, process-aware compliance verification that links model annotations to network-level evidence. In Diagnosis, it demonstrates network-based process mining for IIoT by converting OPC UA network traffic into structured event logs to reveal undocumented participants, dependencies, and interactions. The approach is evaluated through industrial case studies (including an automotive end-of-line process), digital-twin experiments, expert assessments, and a practitioner survey. Results show improved process transparency, traceable design-to-runtime enforcement, and automated compliance checks, with identified challenges around scalability and tool support. Overall, the dissertation establishes BPM as an integrating backbone for IIoT cybersecurity, advancing security-by-design, continuous verification, and diagnostically informed improvement across the industrial process lifecycle.