A Forensic Analysis Framework for Industrial Control Systems

Industrial Control Systems (ICS) are susceptible to a variety of cyber attacks especially due to the increased internet connectivity and convergence of IT and Operational Technology (OT).Proving and understanding such attacks require analyzing collected and examined data for evidence, while OT forensics research remains scarce or focuses on field devices only.To address this, we propose a forensic analysis framework for ICS to trace incidents by analyzing collected and examined data considering all ICS components.It incorporates the MITRE ATT&CK ICS catalog as threat model while providing a forensic data model for ICS forensics.The procedural model of the framework can be applied to systematically determine answers to forensic questions such as what happened, when, where, and why, in a complex ICS including the impact on safety.To evaluate the framework, a Denial of Service (DoS) attack is conducted against the Distributed Control System (DCS) of a real-world operational electrical utility and analyzed using our model.The DCS is based on the ABB 800xA DCS suite, which is widely used in the energy sector.