  The factories of the future require efficient interconnection of their
physical machines into the cyber space to cope with the emerging need of an
increased uptime of machines, higher performance rates, an improved level of
productivity and a collective collaboration along the supply chain. With the
rapid growth of the Internet of Things (IoT), and its application in industrial
areas, the so called Industrial Internet of Things (IIoT)/Industry 4.0 emerged.
However, further to the rapid growth of IoT/IIoT systems, cyber attacks are an
emerging threat and simple manual security testing can often not cope with the
scale of large IoT/IIoT networks. In this paper, we suggest to extract metadata
from commonly used diagrams and models in a typical software development
process, to automate the process of threat modelling, security analysis and
penetration testing, without detailed prior security knowledge. In that
context, we present requirements and recommendations for metadata in IoT/IIoT
models that are needed as necessary input parameters of security assurance
tools.
