Operationalizing Deception Technology in ICS/OT: A Control Mapping Framework for Critical Infrastructure Cybersecurity

Abstract

Deception technologies, including honeypots, decoy devices, honeytokens, and simulated industrial assets, are increasingly relevant to industrial control systems and operational technology (ICS/OT) security because they can generate high-confidence alerts when adversaries interact with assets that legitimate operators should not use. Prior dissertation research on deception technology adoption in U.S. manufacturing and critical infrastructure identified persistent barriers, including compatibility concerns, limited resources, inadequate professional knowledge, infrastructure constraints, and the absence of policy structures that enable practitioners to make deception technology actionable. This paper extends that work without collecting new human-subject data. Using design science and qualitative document analysis, the study maps ICS/OT deception technology use cases to recognized cybersecurity frameworks and control objectives, including the NIST Cybersecurity Framework 2.0, NIST SP 800-82 Revision 3, NIST SP 800-53 Revision 5, IEC 62443-2-1:2024 security program requirements, CISA Cross-Sector Cybersecurity Performance Goals, and MITRE ATT&CK for ICS. The result is the Deception Technology Integration Control Framework (DTICF). This practitioner-oriented artefact translates deception technology from a novel security tool into an auditable set of governance, architecture, monitoring, response, and continuous improvement practices. The framework provides a control crosswalk, an implementation model, a maturity model, and a set of metrics that organisations can use to evaluate deception readiness and plan low-risk deployment in safety-sensitive OT environments.