Abstract
Modern agriculture’s integration of Internet of Things (IoT), Industrial Control Systems (ICSs), and data analytics boosts productivity but introduces significant cybersecurity and data governance challenges. Existing scholarship is divided between policy-focused governance and technical attack analyses, hindering the development of comprehensive, enforceable defenses. This paper introduces an integrated framework that bridges normative data governance in smart farming (SF) with empirical, honeynet-derived threat intelligence. Drawing on the authors’ previous systematic review of SF data governance and a honeynet simulating agricultural IoT/ICS, the study maps governance challenges to quantitative attack indicators from honeynet logs, classifying each pairing as directly supported by telemetry, indirectly supported by telemetry, or not observable using the current methodology. The findings show that the services flagged as governance concerns face sustained attack pressure: the honeynet recorded brute-force attempts against SSH/Telnet on simulated irrigation controllers (149,000 events), connection and login attempts targeting SMB (Server Message Block) and MQTT (Message Queuing Telemetry Transport) on automated machinery (67,156), credential-guessing attempts against management services (14,937), and ICS protocol probes (11,532). Geographic and protocol distributions reveal that legacy industrial protocols and weakly authenticated management interfaces, both highlighted as governance concerns, constitute the primary attack surface. This evidence supports a tiered governance model integrating protocol-level controls, identity governance, and data-sharing policy, demonstrating that effective SF cybersecurity requires empirically calibrated rather than purely policy-driven frameworks. The proposed framework offers actionable guidance for aligning technical defenses with data governance obligations. This work contributes a new methodological protocol (cross-evidentiary mapping), an empirically calibrated tiered framework, and a coherent research agenda at the intersection of governance and measurement, serving as a template for similar analyses in other critical infrastructure sectors.
1. Introduction
Agriculture is undergoing a structural transformation commonly referred to as Agriculture 4.0 [1,2]. Driven by demographic and economic pressures, this transformation has reshaped farming through sensors, autonomous machinery, and artificial intelligence, yielding substantial gains in efficiency and productivity [3,4]. However, the convergence of operational and information technologies has introduced two interconnected challenges, a governance problem and a security problem, that existing literature typically addresses in isolation [5,6].
The governance problem centers on how data, from soil and crop metrics to machinery telemetry and livestock information, is owned, classified, shared, and protected within smart farming. A prior systematic review by the authors [5] revealed a critical lack of standardized governance frameworks. Key issues identified include ambiguity in data ownership, low farmer awareness of contractual terms, inconsistent adoption of privacy measures, and the absence of sector-specific regulations akin to the Health Insurance Portability and Accountability Act (HIPAA) [7]. These challenges were categorized under data security, privacy, and sharing [5,6,8,9].
The security problem explores adversarial behavior against Internet-exposed agricultural systems. A companion study [6] deployed a honeynet comprising four agriculturally themed honeypots (Conpot 0.6.0, Cowrie 3.0.1, Dionaea 0.11.1, and Heralding 1.0.7) together with Suricata, an Intrusion Detection System (IDS) sensor. This setup captured 242,625 attack events across the honeypots and 211,403 IDS events from 3058 unique source addresses, demonstrating that smart-farm-like infrastructure faces Internet-scale threats, including automated reconnaissance, brute-force credential attacks, and exploitation of legacy industrial and Windows-based services [10,11,12].
Crucially, these two studies, viewed separately, present different perspectives: one outlines normative governance needs (how governance is supposed to function), while the other details empirical attack patterns. Neither, on its own, answers the vital question for practitioners and policymakers: to what extent does the governance agenda align with the empirical threat surface? Governance focused on personal data consent [13,14], for example, does not directly address prevalent brute-force attacks on management protocols, the formal processes and technical guidelines that define how data, devices, and farm activities are monitored, managed, and improved through digital technologies. Conversely, a purely technical defense might overlook critical data ownership, sharing, and consent issues that erode farmer trust and impede digital adoption [14,15].
This paper addresses this gap by synthesizing our two earlier studies [5,6] into an integrated framework that explicitly connects governance constructs with measured adversarial behavior. This cross-analysis yields three novel contributions:
- A mapping: pairing each governance challenge from the literature review with empirical indicators from the honeynet, classifying each pairing as directly supported by telemetry, indirectly supported by telemetry, or not observable using the current methodology.
- A tiered governance model: organizing controls into protocol-level, identity-and-access, data-handling, and policy layers, each anchored to specific honeynet observations. Protocol-level controls secure the communication protocols themselves (e.g., SSH, Telnet, SMB, MQTT, and ICS protocols); identity-and-access controls address authentication and credential hygiene; data-handling controls cover collection, storage, sharing, and retention of agricultural data; and policy layers define the accountability and governance requirements that guide the technical layers above.
- A research agenda: highlighting new questions that become tractable only when governance and threat intelligence are studied in concert.
The model is not purely theoretical: it is tied to attack evidence observed in the honeynet, so each layer is justified by observed attack patterns rather than abstract best practice.
The remainder of the paper is structured as follows. Section 2 details the integrated methodology. Section 3 presents the results, including the cross-mapping, the tiered framework, and the cross-cutting arguments they support. Section 4 discusses implications for practice, enrichment with external threat intelligence, limitations, and future research. Section 5 concludes the paper.
2. Materials and Methods
The methodology of this paper is synthetic rather than primary. It does not generate new literature data or new honeynet captures; instead, it integrates the outputs of two completed studies through a structured mapping protocol, an inter-source consistency check, and an interpretive synthesis. This section describes the inputs, the mapping procedure, the analytic moves used to produce the integrated framework, and the limits of the approach.
2.1. Novelty
This research introduces a novel approach by deliberately integrating normative data-governance scholarship (policy, legal, and ethical) [5,8,9,16] with empirical honeynet-based threat intelligence (real attack evidence collected from a honeynet) [6] into a single analytic framework for smart-farming cybersecurity, a structured cross-mapping not previously performed. This work develops a protocol for pairing governance challenges with measurable empirical indicators, classifying the evidentiary strength of each pairing against attack telemetry [10,11,17]. It also proposes empirically calibrated governance tiers that reorder components based on observed attack pressure and explicitly retain unobservable governance concerns, such as data ownership, as a distinct yet material tier of concerns that telemetry cannot observe. Furthermore, the study anchors generic cybersecurity controls to specific, agriculturally relevant attack patterns [3,12,18], translating general best practice into sector-specific guidance. Collectively, this integration establishes a new methodological protocol, a conceptual framework, and a research agenda that becomes coherent only through the joint study of governance and measurement, positioning it as a methodological and conceptual bridge in the smart-farming cybersecurity literature. The empirical material itself is inherited from our two earlier studies [5,6]. What is new is the mapping protocol, the evidence-strength classification, and the reordering of governance priorities that only the joint analysis makes visible.
2.2. Source Studies
Two source studies are used. The first is a systematic literature review on SF data governance [5], which followed a five-step comprehensive literature review process and applied PRISMA-style screening across IEEE Xplore, ScienceDirect, and the ACM Digital Library. From an initial pool of 2684 records, 32 studies were retained and analyzed along three governance components: data security, data privacy, and data sharing [5,8,9]. The second is a fourteen-day honeynet deployment [6] that operated four agriculturally themed honeypots, following established honeypot practice for ICS and IoT environments [19,20]: Conpot, emulating ICS protocols such as Modbus, SNMP, IEC 60870-5-104, and Kamstrup; Cowrie, emulating SSH/Telnet access to irrigation controllers; Dionaea, emulating vulnerable services on automated machinery, including SMB, MS SQL, MongoDB, and MQTT; and Heralding, emulating login services across SSH, FTP, HTTP, SMTP, VNC, SOCKS5, and PostgreSQL supplemented by a Suricata IDS sensor monitoring SSH on a non-standard port, VNC, HTTPS, SMB, RDP, and DNS.
Both studies were conducted by the present authors. The literature review has been published [5]; the honeynet study [6] is currently under peer review. The present paper does not reuse text from either source; it reuses their analytic outputs, the governance taxonomy in the case of the review, and the aggregated attack metrics in the case of the honeynet. The dataset behind those metrics, including sanitized logs and sensor configurations, is described in the Data Availability Statement.
2.3. Mapping Protocol
The core analytic step is a structured mapping between governance constructs and honeynet observations [5,6]. The analysis links governance concerns with attack evidence in three steps, illustrated in Figure 1.
Figure 1.
The three-step cross-evidentiary mapping protocol, from source studies to synthesis outputs.
Throughout the analysis, we keep three levels of attacker activity distinct, following standard intrusion-stage models [21,22]. Probing covers connection attempts and scans that solicit a response from a service. Attempted exploitation covers credential guessing and protocol requests that seek access. Confirmed access covers sessions in which a honeypot accepted supplied credentials. None of these levels implies compromise of a production system, and honeypot-accepted logins in particular demonstrate credential weakness rather than a breached farm.
In Step 1 (Decomposition), the governance taxonomy from the review was decomposed into discrete, testable challenge statements. Instead of stating that a system is “insecure,” a decomposed statement asserts that a named agricultural protocol lacks authentication and becomes vulnerable when exposed to the Internet.
In Step 2 (Pairing), each challenge statement was paired with the most relevant empirical indicator from the honeynet study. Indicators were drawn from four classes: per-honeypot attack counts and source-IP diversity; port and protocol distributions; geographic distribution of source IPs; and qualitative descriptors of attacker behavior, such as post-authentication interaction in Cowrie sessions or concentrated bursts against SMB in Dionaea.
In Step 3 (Classification), each pairing was classified by the strength of its telemetric evidence, adapting the distinction between direct and indirect evidence used in structured evidence grading [23]. A pairing is directly supported by telemetry when the honeynet recorded the specific adversarial activity the governance challenge anticipates; for example, successful default-credential logins for the default-credential challenge. It is indirectly supported by telemetry when the honeynet recorded a closely related precursor, such as sustained scanning of database ports, without demonstrating the specific harm the literature anticipates, such as exfiltration. It is not observable using the current methodology when the risk lies outside what a honeynet can record; for example, contractual disputes about data ownership or third-party reuse of aggregated farm data. We deliberately avoid the word validated here. Scanning a database port demonstrates adversarial interest in that service, not that data has left it, and the labels are chosen to keep that distinction visible. The classification still serves its practical purpose: it separates concerns that technical controls can address now from concerns that require policy change or training.
The mapping was produced under a coding protocol fixed before classification began. The protocol stated the three evidence classes, one decision rule per class (direct: the challenged activity itself appears in the logs; indirect: only a precursor or adjacent activity appears; not observable: the sensors cannot record the risk in principle), and the pairing rule that each challenge is matched to its single most specific indicator, with further supporting observations noted in prose. The design is many-to-many. One governance challenge may draw on several indicators, and one observation, such as the Dionaea port distribution, may inform several challenges. Two of the authors applied the protocol to all eleven pairings independently. They agreed on 9 of 11 initial classifications (Cohen’s kappa = 0.69) [24,25], and the remaining cases were settled in discussion with a third author.
2.4. Synthesis and Framework Construction
The classified mapping was used to construct a tiered governance framework. The tiers were not pre-specified; they emerged from the clustering of validated pairings. Four tiers were identified: a protocol-and-device tier anchored to observed targeting of legacy industrial and Windows-based services [3,12,18]; an identity-and-access tier anchored to the volume and structure of brute-force activity against SSH, Telnet, and VNC [3,6]; a data-handling tier anchored to the indirectly supported concerns about exfiltration through compromised database services [5,13]; and a policy-and-stakeholder tier capturing the consequential governance concerns that lie outside the honeynet’s observational scope. Each tier is presented in Section 3.3 with its anchoring evidence and recommended controls [7,15].
2.5. Motivation
Smart-farming cybersecurity scholarship is bifurcated: governance work prescribes normatively sound policies disconnected from real attack data [5,8,9,14,16,26], while empirical threat studies [6,10,11,12] produce actionable indicators rarely mapped back to governance constructs. This split leaves operators and policymakers without an answer to which interventions actually address the threats they face; a costly gap, given agriculture’s status as critical infrastructure and recent incidents that have caused significant downtime during time-sensitive operations [18,27]. Four considerations motivate an integrated treatment. Governance prescriptions need empirical weighting, because adversarial effort is not evenly distributed across the security, privacy, and sharing pillars. Empirical observations need a governance frame, because technical mitigations remain unimplementable while ownership and contractual questions stay open. Stakeholders need a shared vocabulary that lowers cross-community coordination cost, and smallholder operators face a distinct risk profile that uniform recommendations cannot serve. Table 1 summarizes the motivations for this integrated framework.
Table 1.
Motivations for an integrated governance and threat-intelligence framework in smart farming.
3. Results
This section presents the integrated findings in seven parts. Section 3.1 summarizes the governance taxonomy and the honeynet metrics in compact form. Section 3.2 presents the cross-mapping. Section 3.3 introduces the tiered governance framework that the mapping supports. Section 3.4, Section 3.5, Section 3.6 and Section 3.7 then develop the cross-cutting arguments the synthesis makes possible and situate them against adjacent work.
3.1. Inputs to the Synthesis
The literature review [5] identified three governance components, each with a distinctive cluster of challenges. Data-security challenges included unstandardized cybersecurity practices [3,10], vulnerabilities in IoT-based systems [17,28], weak or absent encryption and authentication on field devices, and the absence of sector-specific federal regulation in jurisdictions such as the United States [7]. Data-privacy challenges included ambiguous ownership of farm-generated data, low farmer awareness of contractual terms with technology providers [14,29], inconsistent application of anonymization and privacy-preserving techniques [13,14,29], and the uneven applicability of regulations such as the General Data Protection Regulation (GDPR) outside the European Union [7,14]. Data-sharing challenges included asymmetric benefits between farmers and technology providers, socio-cultural variation in willingness to share, and the absence of standardized data-sharing agreements and interoperable platforms.
The honeynet deployment [6] produced quantitative evidence on attacker behavior against simulated agricultural infrastructure. Table 2 summarizes the per-honeypot metrics that anchor the subsequent mapping, and Figure 2 presents the same volumes graphically alongside source-IP diversity.
Table 2.
Summary of honeynet observations over the 14-day deployment [6].
Figure 2.
Attack events and unique source IPs by honeypot across the 14-day deployment.
Two cross-cutting observations support the mapping that follows. First, the bulk of activity concentrates on services that mediate either remote management (Cowrie and Heralding) or legacy machine-to-machine communication (Dionaea and Conpot); field-device emulation drew sustained probing but a smaller absolute volume than management-plane emulation, consistent with the hypothesis that attackers prioritize entry points with broad lateral-movement potential. Second, source-IP diversity scales with the number of attack events for the field- and machinery-oriented honeypots but is dramatically lower for Heralding, where a single host accounted for the majority of VNC attempts, indicating that even very small numbers of unique sources can produce operationally significant attack pressure on management interfaces, a finding relevant to the design of rate-limiting and lockout policies.
A caution applies to these volumes. The four honeypots expose different numbers and kinds of services, follow different logging rules, and count events at different granularities. Cowrie logs connections and per-session commands, Dionaea logs per-service connection attempts, Heralding logs individual login attempts, and Suricata raises signature alerts, so a Cowrie event and a Heralding event are not the same unit [19,30]. We did not normalize counts across sensors. We therefore read the volumes as descriptive indicators of attack pressure on each emulated role, and the tier ordering in Section 3.3 rests on the pattern across independent indicators rather than on ratios between counts.
3.2. Cross-Mapping of Governance Challenges and Empirical Threats
Table 3 presents the structured mapping. Each row links a governance challenge from the literature review [5] to the most relevant empirical indicator from the honeynet [6] and assigns a classification.
Table 3.
Mapping of governance challenges [5] to honeynet indicators [6]. Classifications follow the evidence rules in Section 2.3. Two of the authors classified all pairings independently (initial agreement 9 of 11, Cohen’s kappa = 0.69). Disagreements were resolved by consensus with a third author.
The mapping yields three substantive observations. First, the data-security pillar of the literature taxonomy [5] draws the most direct telemetric support: every major security concern identified in the review corresponds to an observed, high-volume attack pattern [6]. Second, the privacy pillar draws mixed support. Scanning of database and relay-capable services indirectly supports the exfiltration and repurposing concerns, while contractual and consent practices [7,14] lie outside the honeynet’s observational scope. Third, the data-sharing pillar draws the least direct support, although the probing of MQTT brokers and the heterogeneity of scanned services show that the sharing surface is under active reconnaissance [4,6]. The categories marked not observable are not refuted. They describe risks that require complementary observational methods such as surveys, contract audits, or supply-chain analyses [14,29].
3.3. A Tiered Governance Framework Anchored to Empirical Threats
The mapping in Table 3 supports a four-tier framework, shown schematically in Figure 3. Each tier is described below with its anchoring evidence and recommended controls; Table 4 summarizes the framework.
Figure 3.
Four-tier governance framework, anchored to empirical threat evidence and organized by increasing institutional scope.
Table 4.
Tiered governance framework for smart farming, anchored to empirical observations.
3.3.1. Tier 1: Protocol and Device Hardening
Tier 1 is anchored to the security challenges that telemetry supports directly. The honeynet data show that attackers actively probe legacy industrial protocols (Conpot) and Windows-era network services (Dionaea), at scale and across geographies. Controls at this tier address the protocols themselves: replacing or tunneling Modbus and similar fieldbus traffic through authenticated transports, disabling SNMP v1/v2c on Internet-reachable interfaces, applying patches to SMB-capable hosts on a defined cadence, and embedding TLS into MQTT deployments. The literature recommended these controls in principle [5]; the honeynet evidence specifies which protocols deserve the highest priority [6].
3.3.2. Tier 2: Identity and Access Governance
Tier 2 is anchored to the Cowrie and Heralding observations. The volume of brute-force attempts against SSH, Telnet, and VNC, and the persistence of small default-credential dictionaries (“123456,” “admin,” “root”), indicate that identity controls are the single highest-leverage intervention available to operators. Controls at this tier include enforced multi-factor authentication for management-plane access, mandatory removal of default credentials before commissioning, rate-limiting and account-lockout policies tuned to the observed cadence of attempts, and the elimination of Telnet from production environments. The cross-mapping further suggests that identity governance should not be treated as a purely technical control: contractual obligations placed on equipment vendors should require credential hygiene at the point of sale.
3.3.3. Tier 3: Data-Handling and Confidentiality Controls
Tier 3 addresses the privacy concerns about exfiltration through back-end services, which telemetry supports indirectly. The Dionaea data show that database ports are systematically scanned. The Heralding data show credential pressure against PostgreSQL specifically. Controls at this tier include network segmentation that prevents direct Internet exposure of database services, encryption of data at rest and in transit, anonymization or differential-privacy treatment before farm data leave the operator’s control, and explicit consent management for downstream sharing.
3.3.4. Tier 4: Policy and Stakeholder Governance
Tier 4 captures the governance concerns that the honeynet cannot observe but that the literature establishes as material: data ownership, contractual transparency, sharing agreements, farmer awareness, and regulatory alignment. These concerns are not less important because attack telemetry cannot see them. They describe the institutional substrate within which the lower three tiers operate. Recommended interventions at this tier include sector-specific regulation analogous to HIPAA, standardized data-sharing templates, mandatory plain-language summaries of contractual terms, and continuing-education requirements for vendor personnel who configure on-farm systems.
One caution bounds what the tier ordering claims. Attack frequency is a measure of exposure, not of risk. Standard assessment guidance treats risk as a function of likelihood and consequence, conditioned on vulnerability severity and asset criticality [31], and a handful of successful commands against a safety-critical ICS endpoint can matter more than a hundred thousand failed SSH guesses. The tiers therefore encode observed attack pressure, which tells operators where adversarial attention concentrates, and Section 3.4, Section 3.5 and Section 3.6 interpret that pressure against institutional stakes. Folding exploitability and consequence into a full risk weighting is set out as future work in Section 4.4.
The synthesis presented above supports several arguments that neither source study makes on its own. We develop four of them here, then situate the synthesis within the broader cybersecurity and agricultural-informatics literature.
3.4. Governance Without Telemetry Underweights the Management Plane
The literature on SF data governance gives substantial attention to data ownership, consent, and sharing, which are inherently institutional concerns. It gives proportionally less attention to the management-plane services through which attackers actually compromise farm infrastructure. The honeynet data make the disparity quantitative: the single largest source of attack volume (Cowrie, 149,000 events) targeted management-plane access and the second largest (Dionaea, 67,156 events) targeted services that bridge OT and IT environments. A governance program that treats security as one of three coequal pillars, without empirical weighting, risks under-resourcing the controls that face the largest observed share of attack events. The tiered framework in Section 3.3 corrects this by placing protocol-and-device and identity-and-access controls in Tiers 1 and 2 and tying them explicitly to observed event volumes.
3.5. Telemetry Without Governance Misses Institutional Failure Modes
The reverse argument is equally important. A purely technical response to the honeynet findings would yield recommendations such as “disable Telnet, enforce MFA, segment database tiers, and patch SMB.” These recommendations are necessary but insufficient: they do not address the contractual conditions under which farm data leaves the operator’s control, the asymmetric benefit distributions that reduce farmers’ willingness to share, or the absence of regulatory frameworks that would make protective contractual terms enforceable. The honeynet, by design, cannot see these failure modes because they are not adversarial; they are structural. The literature review documents them carefully, and the synthesis preserves them as Tier 4 rather than discarding them for lack of telemetric support, consistent with prior arguments [15] that cybersecurity in SF must be analyzed in its socio-cultural context.
3.6. Empirical Evidence Reweights Governance Priorities
The mapping makes one prioritization decision particularly visible. The literature describes MQTT as a sharing-layer concern, primarily because it is the dominant publish-subscribe substrate for IoT telemetry across organizational boundaries. The honeynet, however, observes MQTT scanning at Dionaea, alongside SMB and database scanning. This colocation suggests that, from an adversary’s perspective, MQTT is treated as part of a portfolio of weakly authenticated network services rather than as a distinct sharing technology. The governance implication is that MQTT controls (TLS, broker-level access-control lists, and client authentication) belong in Tier 1 alongside other protocol-level hardening, not solely in Tier 4 alongside sharing agreements, a finding the synthesis produces that neither source study made explicitly.
3.7. Comparison with Adjacent Literature
The integrated framework can be situated against three strands of adjacent work. With respect to general IoT security [11,17], the framework agrees that device-level hardening and network segmentation are foundational, but argues for prioritization based on the agricultural attack surface specifically rather than generic IoT enumeration. With respect to ICS security in critical infrastructure [18], the framework agrees that legacy protocol exposure is a dominant concern but adds empirical evidence specific to agriculture, including the targeting of IEC 60870-5-104 and Kamstrup variants observed by Conpot. With respect to data-governance scholarship in adjacent regulated sectors such as healthcare [7], the framework reinforces the call for HIPAA-analogous regulation but grounds it in measured attacker behavior rather than analogical argument alone.
4. Discussion
This section draws out what the synthesis means for practitioners, how external threat intelligence can extend it, and where its limits lie.
4.1. Implications for Practice
For farm operators, the synthesis offers a defensible prioritization: resources spent on default-credential removal, MFA enforcement, Telnet elimination, and SMB patch cadence will, on the evidence of this deployment, counter a larger share of the attempted attacks we observed than equivalent resources spent on consent management or sharing agreements. For technology providers, the synthesis reinforces existing calls for security-by-default in equipment and application programming interfaces (APIs) and adds the observation that vendor practices materially shape the Tier 2 attack surface. For policymakers, the synthesis supports the case for sector-specific regulation by demonstrating that the absence of mandated controls is associated with measurable, ongoing attack activity.
4.2. Enriching the Synthesis with External Threat Intelligence
The honeynet supplies first-party telemetry from a single vantage point, and the threats it records are not unique to agriculture. Comparable services attract comparable pressure across IoT deployments in other sectors, which is precisely why external threat-intelligence sources can extend the mapping. Source addresses and credential dictionaries can be checked against community sharing platforms such as MISP to separate known commodity scanners from unattributed actors [32]. Internet-wide measurement services such as Censys and Shodan can count how many real agricultural endpoints expose the ports our honeypots emulated, turning honeynet attack pressure into sector-level exposure estimates [33,34]. Practitioner-oriented reputation feeds such as AbuseIPDB and GreyNoise label source addresses observed scanning the wider Internet. We name them as entry points for operators, not as evaluated components of this study. Feeds of this kind also compensate for the structural blind spot of any single honeynet, because they aggregate observations across many vantage points and service mixes. We did not perform this enrichment here, since it needs data-sharing agreements and a stable indicator baseline, but the classification of Section 2.3 accommodates it directly: external corroboration moves a pairing from indirectly to directly supported only when the challenged activity itself, not a precursor, is observed. Section 4.4 places this step on the research agenda.
4.3. Limitations
The synthesis inherits the limitations of its sources. The honeynet observed Internet-scale opportunistic activity in a simulated environment. Targeted intrusions against specific farms, insider threats, and physical compromise are outside its scope. The literature review covered 2018–2024 and may not capture very recent regulatory developments. The mapping classification involves interpretive judgment, and the not observable category is a statement about method rather than importance. Event counts across honeypots reflect different logging granularities and were not normalized (Section 3.1), so the tier ordering should be read as pressure-ranked rather than risk-ranked [19,35]. Finally, the synthesis is anchored to two prior studies by the same authors, and independent replication with different honeynet topologies or review corpora would strengthen confidence in the tier weights.
A further limitation concerns how much of the recorded traffic is specific to agriculture. Honeypots on public address space attract Internet-wide background scanning regardless of the story their banners tell [35,36,37], and nothing in our logs separates an actor hunting irrigation controllers from a botnet guessing SSH credentials everywhere. The measurement literature calls this unsolicited baseline traffic Internet background radiation: any routable address receives it, independent of what the host claims to be [33]. Two readings follow. Read conservatively, the dataset measures the baseline pressure that any Internet-reachable service in a farm network inherits, which is the relevant exposure for the many operations that connect equipment without hardening it. Read more strongly, the sustained probing of ICS-specific ports such as IEC 60870-5-104 and Kamstrup, which have no consumer footprint, points to deliberate interest in industrial endpoints. We claim the conservative reading throughout this paper and treat the stronger one as a hypothesis for the vantage-point comparisons proposed in Section 4.4.
4.4. Future Research
This synthesis opens questions that neither source study could ask in isolation.
The first question concerns longitudinal coupling. The honeynet captured a fourteen-day window; the literature review covered six years. A multi-year honeynet deployment could test whether the tier weights drift over time, particularly as regulatory frameworks are introduced in jurisdictions that currently lack them. A natural experiment would emerge if a United States equivalent of the GDPR were enacted: Tier 4 changes could be observed against Tier 1 and Tier 2 telemetry.
A second question concerns scale and operator profile. The literature notes that smallholder and resource-constrained farms face distinctive governance challenges [29]. The honeynet did not stratify by operator profile; future deployments could co-locate honeypots with cooperating smallholder and large-operator infrastructures (with appropriate isolation) to test whether attack patterns differ by operator scale.
A third question concerns economic calibration. Brief disruptions in agricultural settings can cascade into crop stress and yield loss; a combined economic-and-empirical study could quantify the loss expectation associated with each tier, enabling cost-benefit analysis of governance interventions and addressing the small-farm scalability concern raised in the literature.
A fourth question concerns generalization. The framework is anchored to agriculture, but the analytic move, mapping governance challenges to honeynet evidence and classifying validation, is general. Similar syntheses could be carried out for adjacent critical infrastructures such as water and wastewater management, food processing, and rural telecommunications.
A fifth question concerns enrichment with external threat intelligence. Cross-referencing honeynet indicators against community sharing platforms [32] and Internet-wide exposure measurements [33,34] would test how much of the observed pressure is commodity scanning and how much is sector-aware targeting, and would sharpen the specificity question raised in Section 4.3.
5. Conclusions
This paper synthesized a prior systematic literature review of smart-farming data governance [5] with a prior empirical honeynet deployment in simulated agricultural infrastructure [6] into an integrated framework. The synthesis is not a summary of either source; it is a cross-analysis that pairs each governance challenge with measured adversarial behavior, classifies each pairing as directly supported by telemetry, indirectly supported by telemetry, or not observable using the current methodology, and uses the resulting structure to propose a four-tier governance framework spanning protocols and devices, identity and access, data handling, and policy and stakeholder relationships.
Three contributions distinguish this work. First, it provides an empirically calibrated prioritization of governance controls in SF, anchored to observed attack pressure and its distribution rather than to analytical taxonomies alone. Second, it identifies governance concerns that attack telemetry cannot observe and explains why those concerns nevertheless matter, preserving the institutional dimension of governance against a purely technical reading of the threat landscape. Third, it offers a research agenda that becomes tractable only when governance and threat intelligence are studied together, including longitudinal coupling to regulatory change, stratification by operator scale, sharing-fabric specifics, economic calibration, and generalization to adjacent infrastructures.
Smart farming will continue to expand in scale and social importance. The synthesis presented here argues that resilience in agriculture is best achieved when governance frameworks are calibrated against the empirical attack surface, and when threat intelligence is interpreted within an explicit governance structure. Neither perspective alone is sufficient; together, they constitute a defensible basis for action.
Author Contributions
Conceptualization, R.R. and A.S.; methodology, R.R.; validation, R.R., E.S.-B. and J.G.; formal analysis, R.R.; investigation, R.R.; data curation, R.R.; writing, original draft preparation, R.R.; writing, review and editing, A.S., E.S.-B., J.G., H.B.P. and G.G.; visualization, R.R.; supervision, A.S. and G.G.; project administration, G.G. All authors have read and agreed to the published version of the manuscript.
Funding
This research received no external funding.
Institutional Review Board Statement
Not applicable.
Informed Consent Statement
Not applicable.
Data Availability Statement
No new data were created for this synthesis. The corpus of the literature review is documented in [5]. The honeynet dataset behind the aggregated metrics in Table 2, comprising sanitized event logs, honeypot and Suricata configurations, and analysis scripts, was collected in the companion study [6] and is available from the corresponding author on reasonable request. The raw logs are not posted publicly because they contain source IP addresses.
Conflicts of Interest
The authors declare no conflicts of interest.
Abbreviations
The following abbreviations are used in this manuscript:
| Abbreviation | Definition |
| ACL | Access-Control List |
| ACM | Association for Computing Machinery |
| API/APIs | Application Programming Interface(s) |
| CGIAR | Consultative Group for International Agricultural Research |
| DNS | Domain Name System |
| DOI | Digital Object Identifier |
| FTP | File Transfer Protocol |
| GDPR | General Data Protection Regulation |
| HASSH | SSH client/server fingerprinting standard (used to fingerprint SSH implementations) |
| HIPAA | Health Insurance Portability and Accountability Act |
| HTTP | Hypertext Transfer Protocol |
| HTTPS | Hypertext Transfer Protocol Secure |
| ICS | Industrial Control Systems |
| IDS | Intrusion Detection System |
| IEC | International Electrotechnical Commission |
| IEEE | Institute of Electrical and Electronics Engineers |
| IoT | Internet of Things |
| IP/IPs | Internet Protocol (address[es]) |
| IT | Information Technology |
| MFA | Multi-Factor Authentication |
| MQTT | Message Queuing Telemetry Transport |
| MS SQL | Microsoft SQL Server |
| OT | Operational Technology |
| PRISMA | Preferred Reporting Items for Systematic Reviews and Meta-Analyses |
| RDP | Remote Desktop Protocol |
| SF | Smart Farming |
| SMB | Server Message Block |
| SMTP | Simple Mail Transfer Protocol |
| SNMP | Simple Network Management Protocol |
| SNMPv3 | Simple Network Management Protocol, version 3 |
| SOCKS5 | Socket Secure, version 5 |
| SQL | Structured Query Language |
| SSH | Secure Shell |
| TLS | Transport Layer Security |
| USA | United States of America |
| VNC | Virtual Network Computing |
References
- Ekka, B. A Critical Look at the Hype and Hope of Smart Technologies for Sustainability. EasyChair Preprint No. 11605, 2023. Available online: https://easychair.org/publications/preprint/Fvvj (accessed on 22 August 2026).
- Yadav, S.; Kaushik, A.; Sharma, M.; Sharma, S. Disruptive Technologies in Smart Farming: An Expanded View with Sentiment Analysis. AgriEngineering 2022, 4, 424–460. [Google Scholar] [CrossRef] [Scilit]
- Gupta, M.; Abdelsalam, M.; Khorsandroo, S.; Mittal, S. Security and Privacy in Smart Farming: Challenges and Opportunities. IEEE Access 2020, 8, 34564–34584. [Google Scholar] [CrossRef] [Scilit]
- Amiri-Zarandi, M.; Hazrati Fard, M.; Yousefinaghani, S.; Kaviani, M.; Dara, R. A Platform Approach to Smart Farm Information Processing. Agriculture 2022, 12, 838. [Google Scholar] [CrossRef] [Scilit]
- Rouzky, R.; Sarrafzadeh, A.; Sowells-Boone, E.; Pasandi, H.B.; Goins, G. Data Governance in Smart Farming: A Systematic Review of Challenges and Gaps. Inf. Process. Agric. 2025, in press. [Google Scholar] [CrossRef] [Scilit]
- Rouzky, R.; Green, J.; Sarrafzadeh, A.; Sowells-Boone, E.; Goins, G. Enhancing Agricultural Cybersecurity: Deploying Honeynets to Safeguard Smart Farming Infrastructure. Inf. Process. Agric. 2026; submitted for publication.
- Zwagerman, J. Agriculture & Data Privacy: I Want a HIPAA(potamus) for Christmas... Maybe. Tex. A M Law Rev. 2021, 8, 685–734. [Google Scholar] [CrossRef] [Scilit]
- Alhassan, I.; Sammon, D.; Daly, M. Data Governance Activities: An Analysis of the Literature. J. Decis. Syst. 2016, 25, 64–75. [Google Scholar] [CrossRef] [Scilit]
- McCaig, M.; Rezania, D. A Scoping Review on Data Governance. In Proceedings of the International Conference on IoT Based Control Networks & Intelligent Systems (ICICNIS), Kottayam, India, 28–29 June 2021. [Google Scholar] [CrossRef] [Scilit]
- Barreto, L.; Amaral, A. Smart Farming: Cyber Security Challenges. In Proceedings of the 2018 International Conference on Intelligent Systems (IS), Funchal, Portugal, 25–27 September 2018; pp. 870–876. [Google Scholar] [CrossRef] [Scilit]
- Demestichas, K.; Peppes, N.; Alexakis, T. Survey on Security Threats in Agricultural IoT and Smart Farming. Sensors 2020, 20, 6458. [Google Scholar] [CrossRef] [Scilit] [PubMed]
- Sontowski, S.; Gupta, M.; Chukkapalli, S.S.L.; Abdelsalam, M.; Mittal, S.; Joshi, A. Cyber Attacks on Smart Farming Infrastructure. In Proceedings of the 2020 IEEE 6th International Conference on Collaboration and Internet Computing (CIC), Atlanta, GA, USA, 1–3 December 2020; pp. 135–143. [Google Scholar] [CrossRef] [Scilit]
- Kotal, A.; Elluri, L.; Gupta, D.; Mandalapu, V.; Joshi, A. Privacy-Preserving Data Sharing in Agriculture: Enforcing Policy Rules for Secure and Confidential Data Synthesis. In Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy, 15–18 December 2023; pp. 5519–5528. [Google Scholar] [CrossRef] [Scilit]
- Wiseman, L.; Sanderson, J.; Zhang, A.; Jakku, E. Farmers and Their Data: An Examination of Farmers’ Reluctance to Share Their Data Through the Lens of the Laws Impacting Smart Farming. NJAS Wagening. J. Life Sci. 2019, 90–91, 100301. [Google Scholar] [CrossRef] [Scilit]
- Van Der Linden, D.; Michalec, O.A.; Zamansky, A. Cybersecurity for Smart Farming: Socio-Cultural Context Matters. IEEE Technol. Soc. Mag. 2020, 39, 28–35. [Google Scholar] [CrossRef] [Scilit]
- Anidu, A.; Dara, R. A Review of Data Governance Challenges in Smart Farming and Potential Solutions. In Proceedings of the 2021 IEEE International Symposium on Technology and Society (ISTAS), Waterloo, ON, Canada, 28–31 October 2021; pp. 1–8. [Google Scholar] [CrossRef] [Scilit]
- El-Shekeil, I.; Mullins, T.; Hassan, T.H.; Lao, J.; Yang, X. Challenges and Solutions in IoT Security: A Cross-Industry Perspective. In Proceedings of the Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization (CLOUD COMPUTING 2023); IARIA: Wilmington, DE, USA, 2023; pp. 67–72. Available online: https://www.thinkmind.org/library/CLOUD_COMPUTING/CLOUD_COMPUTING_2023/cloud_computing_2023_3_20_20011.html (accessed on 22 August 2026).
- Spaniel, D. (Ed.) Securing the Nation’s Critical Infrastructures: A Guide for the 2021–2025 Administration; CRC Press: Boca Raton, FL, USA, 2022. [Google Scholar] [CrossRef] [Scilit]
- Franco, J.; Aris, A.; Canberk, B.; Uluagac, A.S. A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems. IEEE Commun. Surv. Tutor. 2021, 23, 2351–2383. [Google Scholar] [CrossRef] [Scilit]
- López-Morales, E.; Rubio-Medrano, C.; Doupé, A.; Shoshitaishvili, Y.; Wang, R.; Bao, T.; Ahn, G.-J. HoneyPLC: A Next-Generation Honeypot for Industrial Control Systems. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS 2020), Virtual Event, 9–13 November 2020; pp. 279–291. [Google Scholar] [CrossRef] [Scilit]
- Hutchins, E.M.; Cloppert, M.J.; Amin, R.M. Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lead. Issues Inf. Warf. Secur. Res. 2011, 1, 80. [Google Scholar]
- Strom, B.E.; Applebaum, A.; Miller, D.; Nickels, K.; Pennington, A.; Thomas, C. MITRE ATT&CK: Design and Philosophy; Technical Report MP180360; The MITRE Corporation: McLean, VA, USA, 2018. [Google Scholar]
- Guyatt, G.H.; Oxman, A.D.; Kunz, R.; Woodcock, J.; Brozek, J.; Helfand, M.; Alonso-Coello, P.; Falck-Ytter, Y.; Jaeschke, R.; Vist, G.; et al. GRADE Guidelines: 8. Rating the Quality of Evidence, Indirectness. J. Clin. Epidemiol. 2011, 64, 1303–1310. [Google Scholar] [CrossRef] [Scilit] [PubMed]
- Cohen, J. A Coefficient of Agreement for Nominal Scales. Educ. Psychol. Meas. 1960, 20, 37–46. [Google Scholar] [CrossRef] [Scilit]
- McHugh, M.L. Interrater Reliability: The Kappa Statistic. Biochem. Medica 2012, 22, 276–282. [Google Scholar] [CrossRef] [Scilit]
- Khordadpour, P. The Security of Data Governance in the Digital World. Authorea Prepr. 2023. [Google Scholar] [CrossRef]
- Kulkarni, A.; Wang, Y.; Gopinath, M.; Sobien, D.; Rahman, A.; Batarseh, F.A. A Review of Cybersecurity Incidents in the Food and Agriculture Sector. J. Agric. Food Res. 2025, 23, 102245. [Google Scholar] [CrossRef] [Scilit]
- Doghudje, I.; Akande, O. Securing the Internet of Things: Cybersecurity Challenges for Smart Materials and Big Data. Int. J. Inf. Cybersecur. 2022, 6, 82–108. [Google Scholar]
- Wilgenbusch, J.; Lynch, B.; Hospodarsky, N.; Pardey, P. Dealing with Data Privacy and Security to Support Agricultural R&D: Technical Practices and Operating Procedures for Responsible Agroinformatics Data Management. In Platform for Big Data in Agriculture; CGIAR: Montpellier, France, 2020; Available online: https://hdl.handle.net/10568/108095 (accessed on 22 August 2026).
- Nawrocki, M.; Wählisch, M.; Schmidt, T.C.; Keil, C.; Schönfelder, J. A Survey on Honeypot Software and Data Analysis. arXiv 2016, arXiv:1608.06249. [Google Scholar] [CrossRef] [Scilit]
- Joint Task Force Transformation Initiative. Guide for Conducting Risk Assessments; NIST Special Publication 800-30, Revision 1; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2012. [CrossRef] [Scilit]
- Wagner, C.; Dulaunoy, A.; Wagener, G.; Iklody, A. MISP: The Design and Implementation of a Collaborative Threat Intelligence Sharing Platform. In Proceedings of the 2016 ACM Workshop on Information Sharing and Collaborative Security (WISCS 2016), Vienna, Austria, 24 October 2016; pp. 49–56. [Google Scholar] [CrossRef] [Scilit]
- Durumeric, Z.; Adrian, D.; Mirian, A.; Bailey, M.; Halderman, J.A. A Search Engine Backed by Internet-Wide Scanning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS 2015), Denver, CO, USA, 12–16 October 2015; pp. 542–553. [Google Scholar] [CrossRef] [Scilit]
- Bodenheim, R.; Butts, J.; Dunlap, S.; Mullins, B. Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices. Int. J. Crit. Infrastruct. Prot. 2014, 7, 114–123. [Google Scholar] [CrossRef] [Scilit]
- Antonakakis, M.; April, T.; Bailey, M.; Bernhard, M.; Bursztein, E.; Cochran, J.; Durumeric, Z.; Halderman, J.A.; Invernizzi, L.; Kallitsis, M.; et al. Understanding the Mirai Botnet. In Proceedings of the 26th USENIX Security Symposium, Vancouver, BC, Canada, 16–18 August 2017; pp. 1093–1110. [Google Scholar]
- Pang, R.; Yegneswaran, V.; Barford, P.; Paxson, V.; Peterson, L. Characteristics of Internet Background Radiation. In Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement (IMC 2004), Taormina, Italy, 25–27 October 2004; pp. 27–40. [Google Scholar] [CrossRef] [Scilit]
- Durumeric, Z.; Bailey, M.; Halderman, J.A. An Internet-Wide View of Internet-Wide Scanning. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, 20–22 August 2014; pp. 65–78. [Google Scholar]
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2026 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license.