Digital twins: secure design and development

A ‘digital twin’ is an emerging technology model that has the potential to revolutionise the way the cyber-physical infrastructure is built and operated. 

The UK government defines a digital twin as “a virtual model of an object, a system, or a process. It is connected to its real-world counterpart by a 2-way flow of right-time data, meaning it mimics it in all aspects”.

Digital twins represent a growing global marketplace (valued at over $8.6 billion in 2022 and forecasted to reach $138 billion by 2030) with emerging applications across many critical sectors including water, energy, health, and defence. The UK is developing a position of strength within this globally highly active field, by investing in underlying technologies such as artificial intelligence, sensors and computer science. 

While digital twins undoubtedly hold many benefits, such as speeding product development, increasing efficiency and reducing costs, there are also risks to be considered. Since digital twins can be built using a wide range of digital technologies, they are susceptible to a wide range of cyber attacks. For example:

• due to the constant connection with their physical counterpart, digital twins can hugely increase the attack surface on a piece of infrastructure
• the digital twin will consume data (which will be both stored within it and moving back and forth to the physical twin) which could be a potential goldmine for attackers seeking to understand how the physical twin operates
• the physical twin may need to be equipped with an array of smart sensors, all proving a further entry point
• there are opportunities to corrupt data and cause undesired operation, as digital twins will have the ability to cause effects in the real world

In addition, many researchers believe that the full benefits of digital twins cannot be unlocked without the use artificial intelligence, a field that brings its own unique cyber security challenges. All this means that, just like any other cyber-physical system, digital twins should be designed and built securely from the outset.

Although the NCSC has not published guidance on digital twins, we have published several collections that are directly relevant to their secure development and operation. The most relevant include:

• Data security (digital twins rely on large amounts of data)
• Cloud security guidance and, if applicable, cloud hosted SCADA (digital twins’ infrastructure may reside in the cloud)
• Guidelines for secure AI system development (digital twins may incorporate AI)
• Connected places cyber security principles (digital twins have many similarities with connected places deployments)
• Zero trust architecture design principles (digital twins rely on networking technologies)

Taken together, these documents can help you develop better and safer digital twins, with security underpinnings that allow you to realise these systems' benefits.

If you have any comments on this blog, please feel free to use the feedback form or the "Was this article helpful?" option on this page.

Adam A
Lead Researcher - Cyber Physical