Towards a SCADA Forensics Architecture

Abstract

With the increasing threat of sophisticated attacks on critical infrastructures, it is vital that forensic investigations take place immediately following a security incident. This paper presents an existing SCADA forensic process model and proposes a structured SCADA forensic process model to carry out a forensic investigations. A discussion on the limitations of using traditional forensic investigative processes and the challenges facing forensic investigators. Furthermore, flaws of existing research into providing forensic capability for SCADA systems are examined in detail. The study concludes with an experimentation of a proposed SCADA forensic capability architecture on the Siemens S7 PLC. Modifications to the memory addresses are monitored and recorded for forensic evidence. The collected forensic evidence will be used to aid the reconstruction of a timeline of events, in addition to other collected forensic evidence such as network packet captures.

Contributors

Tina Wu

Jules Ferdinand Pagna Disso

Kevin Jones

Adrian Campos

Conference

Publication date: September 2013

Publication date (Print): September 2013

Pages: 12-21

Affiliations

EADS Innovation Works Quadrant House Celtic Springs

Coedkernew, Newport NP10 8FZ UK

Article

DOI: 10.14236/ewic/ICSCSR2013.2

Copyright statement: © Tina Wu et al. Published by BCS Learning and Development Ltd. 1st International Symposium for ICS & SCADA Cyber Security Research 2013 (ICS-CSR 2013), Leicester, UK

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 1st International Symposium for ICS & SCADA Cyber Security Research 2013 (ICS-CSR 2013)

Conference acronym: ICSCSR

Conference number: 1

Conference location: Leicester, UK

Conference date: 16-17 September 2013

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: ICS & SCADA Cyber Security Research 2013

Product

Product Information: 1477-9358BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/ICSCSR2013.2

Self URI (journal page): https://ewic.bcs.org/

Categories

Series title: Electronic Workshops in Computing