A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure

Peter Eden; Andrew Blyth; Pete Burnap; Yulia Cherdantseva; Kevin Jones; Hugh Soulsby; Kristan Stoddart

doi:10.1007/978-3-319-33331-1_3

A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure

Peter Eden, Andrew Blyth, Pete Burnap, Yulia Cherdantseva, Kevin Jones, Hugh Soulsby, Kristan Stoddart

Allbwn ymchwil: Pennod mewn Llyfr/Adroddiad/Trafodion Cynhadledd › Cyfraniad i bennod arall › adolygiad gan gymheiriaid

Crynodeb

SCADA systems are essential for the safe running of critical infrastructure but in recent years have increasingly become the target of advanced cyber-attacks through their convergence with public and corporate networks for easier monitoring and control. Cyber-events within critical infrastructure can have devastating consequences affecting human life, the environment and the economy. Therefore, it is vital that a forensic investigation takes place to provide remediation, understanding and to help in the design of more secure systems. This paper provides an overview of the SCADA forensic process, within critical infrastructure, and discusses the existing challenges of carrying out a SCADA forensic investigation. It also discusses ways in which the process may be improved together with a suggested SCADA incident response model. This paper is part of an ongoing research project that is working towards the creation of best practice guidelines for the forensic handling and incident response of SCADA systems.

Iaith wreiddiol	Saesneg
Teitl	Critical Information Infrastructures Security
Is-deitl	10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers
Golygyddion	Erich Rome, Marianthi Theocharidou, Stephen Wolthusen
Cyhoeddwr	Springer
Tudalennau	27-39
ISBN (Electronig)	978-3-319-33331-1
ISBN (Argraffiad)	978-3-319-33330-4
Dynodwyr Gwrthrych Digidol (DOIs)	https://doi.org/10.1007/978-3-319-33331-1_3
Statws	Cyhoeddwyd - 18 Mai 2016

Cyfres gyhoeddiadau

Enw	Lecture Notes in Computer Science
Cyhoeddwr	Springer
Cyfrol	9578
ISSN (Argraffiad)	0302-9743
ISSN (Electronig)	1611-3349

Mynediad at Ddogfen

10.1007/978-3-319-33331-1_3Trwydded: CC BY-NC-ND

The 10th International Conference on Critical Information Infrastructures Security
Peter Eden (Siaradwr)
5 Hyd 2015
Gweithgaredd: Sgwrs neu gyflwyniad › Sgwrs wadd

Dyfynnu hyn

Eden, P., Blyth, A., Burnap, P., Cherdantseva, Y., Jones, K., Soulsby, H., & Stoddart, K. (2016). A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure. Yn E. Rome, M. Theocharidou, & S. Wolthusen (Gol.), Critical Information Infrastructures Security: 10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers (tt. 27-39). erthygl Chapter 3 (Lecture Notes in Computer Science; Cyfrol 9578). Springer. https://doi.org/10.1007/978-3-319-33331-1_3

Eden, Peter ; Blyth, Andrew ; Burnap, Pete et al. / A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure. Critical Information Infrastructures Security: 10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers. Gol. / Erich Rome ; Marianthi Theocharidou ; Stephen Wolthusen. Springer, 2016. tt. 27-39 (Lecture Notes in Computer Science).

@inbook{47f1573fdbd7463c9e42638b61b8f494,

title = "A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure",

abstract = "SCADA systems are essential for the safe running of critical infrastructure but in recent years have increasingly become the target of advanced cyber-attacks through their convergence with public and corporate networks for easier monitoring and control. Cyber-events within critical infrastructure can have devastating consequences affecting human life, the environment and the economy. Therefore, it is vital that a forensic investigation takes place to provide remediation, understanding and to help in the design of more secure systems. This paper provides an overview of the SCADA forensic process, within critical infrastructure, and discusses the existing challenges of carrying out a SCADA forensic investigation. It also discusses ways in which the process may be improved together with a suggested SCADA incident response model. This paper is part of an ongoing research project that is working towards the creation of best practice guidelines for the forensic handling and incident response of SCADA systems.",

keywords = "SCADA, Critical infrastructure , Digital forensics, Incident response, Cyber security lifecycle, SCADA forensics",

author = "Peter Eden and Andrew Blyth and Pete Burnap and Yulia Cherdantseva and Kevin Jones and Hugh Soulsby and Kristan Stoddart",

year = "2016",

month = may,

day = "18",

doi = "10.1007/978-3-319-33331-1_3",

language = "English",

isbn = "978-3-319-33330-4",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "27--39",

editor = "Erich Rome and Theocharidou, {Marianthi } and Stephen Wolthusen",

booktitle = "Critical Information Infrastructures Security",

address = "Germany",

}

Eden, P, Blyth, A, Burnap, P, Cherdantseva, Y, Jones, K, Soulsby, H & Stoddart, K 2016, A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure. yn E Rome, M Theocharidou & S Wolthusen (gol.), Critical Information Infrastructures Security: 10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers., Chapter 3, Lecture Notes in Computer Science, cyfrol. 9578, Springer, tt. 27-39. https://doi.org/10.1007/978-3-319-33331-1_3

A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure. / Eden, Peter; Blyth, Andrew; Burnap, Pete et al.
Critical Information Infrastructures Security: 10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers. gol. / Erich Rome; Marianthi Theocharidou; Stephen Wolthusen. Springer, 2016. t. 27-39 Chapter 3 (Lecture Notes in Computer Science; Cyfrol 9578).

Allbwn ymchwil: Pennod mewn Llyfr/Adroddiad/Trafodion Cynhadledd › Cyfraniad i bennod arall › adolygiad gan gymheiriaid

TY - CHAP

T1 - A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure

AU - Eden, Peter

AU - Blyth, Andrew

AU - Burnap, Pete

AU - Cherdantseva, Yulia

AU - Jones, Kevin

AU - Soulsby, Hugh

AU - Stoddart, Kristan

PY - 2016/5/18

Y1 - 2016/5/18

N2 - SCADA systems are essential for the safe running of critical infrastructure but in recent years have increasingly become the target of advanced cyber-attacks through their convergence with public and corporate networks for easier monitoring and control. Cyber-events within critical infrastructure can have devastating consequences affecting human life, the environment and the economy. Therefore, it is vital that a forensic investigation takes place to provide remediation, understanding and to help in the design of more secure systems. This paper provides an overview of the SCADA forensic process, within critical infrastructure, and discusses the existing challenges of carrying out a SCADA forensic investigation. It also discusses ways in which the process may be improved together with a suggested SCADA incident response model. This paper is part of an ongoing research project that is working towards the creation of best practice guidelines for the forensic handling and incident response of SCADA systems.

AB - SCADA systems are essential for the safe running of critical infrastructure but in recent years have increasingly become the target of advanced cyber-attacks through their convergence with public and corporate networks for easier monitoring and control. Cyber-events within critical infrastructure can have devastating consequences affecting human life, the environment and the economy. Therefore, it is vital that a forensic investigation takes place to provide remediation, understanding and to help in the design of more secure systems. This paper provides an overview of the SCADA forensic process, within critical infrastructure, and discusses the existing challenges of carrying out a SCADA forensic investigation. It also discusses ways in which the process may be improved together with a suggested SCADA incident response model. This paper is part of an ongoing research project that is working towards the creation of best practice guidelines for the forensic handling and incident response of SCADA systems.

KW - SCADA

KW - Critical infrastructure

KW - Digital forensics

KW - Incident response

KW - Cyber security lifecycle

KW - SCADA forensics

U2 - 10.1007/978-3-319-33331-1_3

DO - 10.1007/978-3-319-33331-1_3

M3 - Other chapter contribution

SN - 978-3-319-33330-4

T3 - Lecture Notes in Computer Science

SP - 27

EP - 39

BT - Critical Information Infrastructures Security

A2 - Rome, Erich

A2 - Theocharidou, Marianthi

A2 - Wolthusen, Stephen

PB - Springer

ER -

Eden P, Blyth A, Burnap P, Cherdantseva Y, Jones K, Soulsby H et al. A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure. Yn Rome E, Theocharidou M, Wolthusen S, golygyddion, Critical Information Infrastructures Security: 10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers. Springer. 2016. t. 27-39. Chapter 3. (Lecture Notes in Computer Science). doi: 10.1007/978-3-319-33331-1_3

A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure

Crynodeb

Cyfres gyhoeddiadau

Mynediad at Ddogfen

Ôl bys

Gweithgareddau

The 10th International Conference on Critical Information Infrastructures Security

Dyfynnu hyn