Forensic Readiness for SCADA/ICS Incident Response

The actions carried out following any cyber-attack are vital in limiting damage, regaining control and determining the cause and those responsible. Within SCADA and ICS environments there is certainly no exception. Critical National Infrastructure (CNI) relies heavily on SCADA systems to monitor and control critical processes. Many of these systems span huge geographical areas and contain thousands of individual devices, across an array of asset types. When an incident occurs, those assets contain forensic artefacts, which can be thought of as any data that provides explanation to the current state of the SCADA system. Knowing what devices exist within the network and the tools and methods to retrieve data from them are some of the biggest challenges for incident response within CNI. This paper aims to identify those assets and their forensic value whilst providing the tools needed to perform data acquisition in a forensically sound manner. It will also discuss the key stages in which the incident response process can be managed.

Content

Author and article information

Contributors

Peter Eden

Andrew Blyth

Pete Burnap

Yulia Cherdantseva

Kevin Jones

Hugh Soulsby

Kristan Stoddart

Conference

Publication date: August 2016

Publication date (Print): August 2016

Pages: 142-150

Affiliations

[0001]Information Security Research group

School of Computing and Mathematics

Department of Computing, Engineering and Science

University of South Wales

Pontypridd, CF371DL

UK

[0002]Computer Science and Informatics

Cardiff University, Queen’s Buildings

5 The Parade, Roath

Cardiff CF24 3AA, UK

[0003]Airbus Group Innovations

Quadrant House Celtic Springs

Coedkernew

Newport NP10 8FZ, UK

[0004]Department of International Politics

Aberystwyth University

Penglais, Aberystwyth

Ceredigion

SY23 3FE, UK

Article

DOI: 10.14236/ewic/ICS2016.16

SO-VID: 2fc2a504-1ac4-4abc-9aca-a7a82d61d7ab

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 4th International Symposium for ICS & SCADA Cyber Security Research 2016

Conference acronym: ICS-CSR

Conference number: 4

Conference location: Queen’s Belfast University, UK

Conference date: 23 - 25 August 2016

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Cyber Security Research

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/ICS2016.16

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

I. AhmedS. ObermeierM. NaedeleG. G. >Richard III 2012 2018 Scada systems: Challenges for forensic investigators’ Computer 45 12 44 51
CA 2015 Data acquisition: Best practices guide Technical report, CA Technologies
K. ChasonS. DinnageA. LeeJ. SearleD. WidgerWright 2014 Guide to vulnerability assessment for electric utility operations systems Technical report, NESCOR (National Electric Sector Cybersecurity Organization Resource
CPNI 2015 Security for industrial control systems - establish response capabilities: A good practice guide Technical report, CPNI
T. CruzJ. BarrigasJ. ProencaA. GrazianoS. PanzieriL. LevP. Simões 2015 Improving network security monitoring for industrial control systems,in ‘14th IFIP/IEEE Int Symposium on Integrated Management IM 2015
M. FabroE. Cornelius 2008 Recommended practice: Recommended practice: Creating cyber forensics plans for control systems Technical report, Department of Homeland Security
T. GreenR. VandenBrink 2012 Analyzing network traffic with basic linux tools Technical report, SANS Institute InfoSec Reading Room
E. Hjelmvik 2011 ‘Intercepting network traffic’ NETRESEC (Network Forensics and Network Security Monitoring) URL ext-link-type="uri" xlink: href="http://www">http://www.netresec.com/?page=Blogmonth =2011-03post=Sniffing- Tutorial-part-1— Intercepting-Network-Traffic
ICS-CERT 2009 Recommended practice: Developing an industrial control systems cybersecurity incident response capability Technical report U.S. Department of Homeland Security
H. JanickeA. NicholsonS. WebberA. Cau 2015 ‘Runtime-monitoring for industrial control systems’ Electronics 4 4 995 1017
v. d. R. M. Knijff 2014 ‘Control systems/scada forensics, what’s the difference? Digital Investigation 11 3 160 174
B. Muir 2015 Encase imager vs. ftk imager > ext-link-type="uri" xlink: href="http://bsmuir.kinja.com/encase-imager-vs-ftk-imager-1677906594">http://bsmuir.kinja.com/encase-imager-vs-ftk-imager-1677906594 Accessed 21st 06 2016
NERC 2013 Request for information north american electric reliability corporation response Technical report, National Institute of Standards and Technology
NIST 2011 Guide to industrial control systems (ics) security Technical report, National Institution of Standards and Technology
D. J. W. QPM 2012 Good practice guide for digital evidence Technical report, ACPO (Association of Chief Police Officers for England, Wales and Northern Ireland)
J. StirlandK. JonesH. JanickeT. Wu 2014 Developing cyber forensics for scada industrial control systems,in ‘Proceedings of the International Conference on Information Security and Cyber Forensics’ SDIWC Digital Library
A. TorresJ. Williams 2014 ‘Incident response: How to fight back’ SANS Institute InfoSec Reading Room
A. WedgburyK. Jones 2015 Automated asset discovery in industrial control systems -exploring the problem,in ‘Proceedings of the 3rd International Symposium for ICS SCADA Cyber Security Research 2015’ EWIC
T. WuJ. F. P. DissoK. JonesA. Campos 2013 Towards a scada forensics architecture,in ‘Proceedings of the 1st International Symposium for ICS & SCADA Cyber Security Research’ 12

Comments

Comment on this article

[1] I. AhmedS. ObermeierM. NaedeleG. G. >Richard III 2012 2018 Scada systems: Challenges for forensic investigators’ Computer 45 12 44 51

[2] CA 2015 Data acquisition: Best practices guide Technical report, CA Technologies

[3] K. ChasonS. DinnageA. LeeJ. SearleD. WidgerWright 2014 Guide to vulnerability assessment for electric utility operations systems Technical report, NESCOR (National Electric Sector Cybersecurity Organization Resource

[4] CPNI 2015 Security for industrial control systems - establish response capabilities: A good practice guide Technical report, CPNI

[5] T. CruzJ. BarrigasJ. ProencaA. GrazianoS. PanzieriL. LevP. Simões 2015 Improving network security monitoring for industrial control systems,in ‘14th IFIP/IEEE Int Symposium on Integrated Management IM 2015

[6] M. FabroE. Cornelius 2008 Recommended practice: Recommended practice: Creating cyber forensics plans for control systems Technical report, Department of Homeland Security

[7] T. GreenR. VandenBrink 2012 Analyzing network traffic with basic linux tools Technical report, SANS Institute InfoSec Reading Room

[8] E. Hjelmvik 2011 ‘Intercepting network traffic’ NETRESEC (Network Forensics and Network Security Monitoring) URL ext-link-type="uri" xlink: href="http://www">http://www.netresec.com/?page=Blogmonth =2011-03post=Sniffing- Tutorial-part-1— Intercepting-Network-Traffic

[9] ICS-CERT 2009 Recommended practice: Developing an industrial control systems cybersecurity incident response capability Technical report U.S. Department of Homeland Security

[10] H. JanickeA. NicholsonS. WebberA. Cau 2015 ‘Runtime-monitoring for industrial control systems’ Electronics 4 4 995 1017

[11] v. d. R. M. Knijff 2014 ‘Control systems/scada forensics, what’s the difference? Digital Investigation 11 3 160 174

[12] B. Muir 2015 Encase imager vs. ftk imager > ext-link-type="uri" xlink: href="http://bsmuir.kinja.com/encase-imager-vs-ftk-imager-1677906594">http://bsmuir.kinja.com/encase-imager-vs-ftk-imager-1677906594 Accessed 21st 06 2016

[13] NERC 2013 Request for information north american electric reliability corporation response Technical report, National Institute of Standards and Technology

[14] NIST 2011 Guide to industrial control systems (ics) security Technical report, National Institution of Standards and Technology

[15] D. J. W. QPM 2012 Good practice guide for digital evidence Technical report, ACPO (Association of Chief Police Officers for England, Wales and Northern Ireland)

[16] J. StirlandK. JonesH. JanickeT. Wu 2014 Developing cyber forensics for scada industrial control systems,in ‘Proceedings of the International Conference on Information Security and Cyber Forensics’ SDIWC Digital Library

[17] A. TorresJ. Williams 2014 ‘Incident response: How to fight back’ SANS Institute InfoSec Reading Room

[18] A. WedgburyK. Jones 2015 Automated asset discovery in industrial control systems -exploring the problem,in ‘Proceedings of the 3rd International Symposium for ICS SCADA Cyber Security Research 2015’ EWIC

[19] T. WuJ. F. P. DissoK. JonesA. Campos 2013 Towards a scada forensics architecture,in ‘Proceedings of the 1st International Symposium for ICS & SCADA Cyber Security Research’ 12

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65