Threat Modeling and Attack Surface Analysis of IoT-Enabled Controlled Environment Agriculture Systems
The first formal threat model for IoT-connected indoor farms finds 123 vulnerabilities across 10 unauthenticated protocols — with crop loss possible in minutes.
The Thesis
Controlled Environment Agriculture (CEA) — think large-scale indoor vertical farms and greenhouse operations managed by networked sensors, AI controllers, and robotics — runs on software that was never designed with security in mind. This paper is the first to apply rigorous, industrial-grade threat modeling to that stack, and what it finds is stark: 10 of 15 protocols in common use have zero authentication or encryption by design. The stakes are not just data theft; an attacker who manipulates CO2 injection or aeroponic (soil-free, mist-delivered nutrient) systems can destroy a crop in minutes and endanger workers. The catch is that this paper is a threat model and survey, not a deployed defense — it identifies the problem with unusual rigor but does not yet prove that its proposed countermeasures work at scale.
Catalyst
CEA has scaled from boutique pilots to 30-plus commercial facilities operating across eight U.S. climate zones, and AI-driven control loops — including reinforcement learning and federated learning across sites — have been introduced faster than any security audit followed. At the same time, CISA's designation of food and agriculture as critical infrastructure has not yet produced mandatory cybersecurity rules, creating a regulatory vacuum that this paper explicitly names as a gap. The convergence of scale, AI complexity, and zero regulatory floor makes this the moment the threat surface became large enough to matter.
What's New
Prior industrial-control-system (ICS) security work focused on sectors like power grids, water treatment, and oil pipelines, where frameworks such as MITRE ATT&CK for ICS and IEC 62443 (a standard for segmenting industrial networks into protected zones) were developed and tested. CEA was treated as a niche edge case with no published threat model. This paper applies those same frameworks to a production CEA platform for the first time, and — crucially — it identifies five entirely new attack classes that are unique to AI-managed agriculture, including the ability to slowly poison the baseline data an anomaly detector uses so that genuinely malicious behavior looks normal over time.
The Counter
This paper finds a security gap in a sector that is still relatively small — U.S. vertical farming revenue is a fraction of total food production, and most CEA facilities are not yet networked in ways that make them attractive targets for sophisticated adversaries. The attack scenarios, while technically plausible, require an attacker to gain initial network access to a facility-level OT network, which is a significant barrier compared to attacking internet-exposed enterprise software. More importantly, the paper proposes Security Level 2 under IEC 62443 as a minimum baseline — a standard that even many utilities and manufacturers have not achieved — which risks producing a compliance burden that small and mid-size CEA operators simply cannot afford, potentially concentrating the market among incumbents who can. The AI-specific attack classes are novel on paper, but none are demonstrated; the history of ICS security research is full of theorized attacks that proved impractical under real operating conditions. Finally, the one-CVE finding may reflect immaturity of security research attention to this sector as much as it reflects actual vulnerability density.
Longs
- CMGE (Claroty — ICS/OT network security, directly relevant to agricultural control networks)
- ITRI (IronNet — ICS threat detection, though note financial fragility)
Shorts
- Vertical farming platform vendors (the paper surveys 10 and finds one CVE ever issued, zero bug bounties, and zero IEC 62443 certifications — compliance costs will hit them hardest)
- Low-cost IoT sensor manufacturers who supply CEA facilities with devices running unauthenticated protocols like MQTT and Modbus with no upgrade path
Enablers (Picks & Shovels)
- MITRE ATT&CK for ICS framework (the threat taxonomy the paper maps its findings onto)
- IEC 62443 standard (the zone-and-conduit segmentation model proposed as the minimum baseline)
- Open-source MQTT and Modbus security tooling (the two most widely implicated unauthenticated protocols in CEA)
- CISA's critical infrastructure designation for food and agriculture (the regulatory hook that could mandate compliance)
Private Watchlist
- Claroty (OT/ICS security platform with agriculture-adjacent deployments)
- Dragos (ICS-specific threat intelligence; named in MITRE ATT&CK for ICS work)
- Nozomi Networks (OT and IoT anomaly detection applicable to CEA sensor networks)
- Phosphorus Cybersecurity (IoT device security, relevant to sensor-heavy CEA environments)
The Paper
The United States designates Food and Agriculture as one of sixteen critical infrastructure sectors, yet no mandatory cybersecurity requirements exist for agricultural operations and no formal threat model has been published for Controlled Environment Agriculture (CEA) systems. This paper presents the first comprehensive threat model for IoT-enabled CEA, applying STRIDE analysis, MITRE ATT&CK for ICS mapping, and IEC 62443 zone-and-conduit decomposition to a production platform deployed across 30+ commercial facilities in 8 U.S. climate zones. We enumerate 123 unique threats across 25 data-flow-diagram elements spanning 15 communication protocols, 10 of which operate with zero authentication or encryption by design. We identify five novel attack classes unique to AI-driven CEA: stealth destabilization of neural-network-tuned PID controllers, baseline drift poisoning of anomaly detectors, cross-facility propagation via federated transfer learning, adversarial agronomic schedules that exploit crop biology rather than computational models, and reward poisoning of reinforcement-learning energy optimizers. Physical impact analysis quantifies crop loss timelines from minutes (aeroponics) to days, including worker safety hazards from CO2 injection manipulation. A survey of 10 commercial CEA vendors reveals only one CVE ever issued, zero bug bounty programs, and zero IEC 62443 certifications. We propose a defense-in-depth countermeasure framework and recommend Security Level 2 as a minimum baseline.