SCADA System Forensic Analysis Within IIoT

Abstract

A new wave of industrial technology has emerged in the form of Industry 4.0, which has seen a progression from electronic devices and IT (Information Technology) systems that automate production advance to a new revolution of Cyber-Physical Production Systems used for Smart Manufacturing and Smart Factories via IIoT (Industrial Internet of Things). As more and more devices are becoming connected and networked to allow for Smart Manufacturing to take place the number of data sources significantly increases as a result. Real-time Information is then becoming increasingly interlinked across multiple industries for a more efficient productivity process and a reduction in cost. Aside from Smart manufacturing and factories, Industry 4.0 has already seen huge advances in infrastructure management, energy management, transportation and building and home automation. With such industries relying so heavily on real-time data from connected sensors the security of these systems are at risk due to the reliance on low-latency and reliable communication for critical processes. The increase of interconnected networks and devices across the Internet significantly increases the amount of entry points into these systems, increasing their vulnerability and allowing outsiders to take advantage of any weaknesses within them. This has already been highlighted by the events of Stuxnet, Havex, Black Energy and the German Steel Mill that targeted ICS (Industrial Control Systems) and SCADA (Supervisory Control and Data Acquisition) Systems causing catastrophic results. The use of SIEM (Security Information and Event Management) services, IDS (Intrusion Detection Systems), IPS (Intrusion Prevention Systems) and firewalls may be implemented within ICS but only operate on the perimeters of their networks or segmented networks and not at the lower operational level where critical processes rely on speed and availability simply because by doing so could introduce latency between critical processes. When events do occur, regardless of whether an incident is accidental or deliberate, an immediate incident response should take place. This chapter focusses on the forensic challenges and analysis of the physical infrastructure that underpins the systems operating within IIoT. It discusses the development of SCADA system architecture over the past few decades and how it has arrived at IIoT, creating the new generation of SCADA systems. The chapter then discusses the current available tools that exist that can help carry out a forensic investigation of a SCADA system operating within IIoT space before closing with a suggested SCADA Incident Response Model

Cybersecurity challenges in Industry 4.0: A state of the art review

“…That puts security at risk because of many entry points that each network has, and then all of those networks are interconnected as well. This increases the potential number of weaknesses in the system and vulnerabilities that hackers may want to take advantage of [27].…”

Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap

“…Cyberattacks at the operational technology (OT) level have grown considerably recently, as it involves integrating new interfaces (i.e., IT systems, cloud, etc.) [ 14 , 15 ] providing flexibility and remote access to both new/old OT (i.e., SCADA, PLCs, etc.) systems.…”

“…As per [ 36 , 78 , 79 ] different wireless communication standards can co-exist and be deployed to attain agility and flexibility on the production floor. Authors in [ 50 ] point out limitations in existing standards, whereas [ 5 , 15 , 74 ] underline IT/OT convergence and interoperability issues [ 28 , 41 ]. The use-case examples presented in [ 6 , 11 , 77 ] bring attention to wireless communication security and performance metrics for I4.0 and [ 42 , 47 ] provide methods for improving M2M/IoT security at the component level.…”

A Taxonomy of Security Issues in Industrial Internet-of-Things: Scoping Review for Existing Solutions, Future Implications, and Research Challenges

“…To mitigate the effect of threats on SCADA, den, P. et.al has presented a seven stem forensic model for IIoT structure. This model understands, detects, isolates, avoids, analyzes, responds and reports the finding and then updates the system architecture and requirements for future prevention [65]. Another detection model to collect and communicate attack data to the forensic department is shown by T.Guo et.al [66].…”