Digital Forensic Readiness for Hyper-Connected Critical Infrastructure

由于电力供应中断，生产线和核离心机关闭，城市陷入黑暗，一个城镇的供水试图中毒，美国最大的燃料管道被勒索软件切断--这些灾难性的网络攻击可能使我们现代社会日常生活的核心严重依赖的关键国家基础设施(CNI)瘫痪。这类事件旨在扰乱对物理过程的控制，并造成经济、地缘政治或环境的持久损害和/或生命损失，已经并将继续发生针对工业控制系统(IC)的事件，也称为监控和数据采集(SCADA)系统。针对可编程逻辑控制器PLC等核心组件的复杂和国家支持的攻击如Stuxnet和Triton的上升，以及缺乏可靠的取证工具、方法和技术，促使该博士研究传统数字取证工具和能力在关键国家基础设施内的网络物理系统领域的适用性和可转移性。随着法医调查人员在SCADA法医调查中面临重大挑战，例如ICS设备中有限的计算/存储资源、供应商特定的专有固件、ICS协议规范的不透明、缺乏内存获取工具和不足的日志记录能力，一种新的经过实验验证的ICS法医就绪性体系结构可以在事件发生前建立取证能力，同时保持安全关键属性，这是我博士的核心目标。

A city plunged into darkness due to a disrupted electric supply, production lines and nuclear centrifuges shut down, water supplies to a town attempted to be poisoned and the largest fuel pipeline in the US was taken down by a ransomware - these catastrophic cyberattacks could cripple critical national infrastructures (CNI) on which the core of everyday life in our modern societies heavily relies. Such incidents which aim to disrupt the control of physical processes and cause an economic, geopolitical, or environmental lasting damage and/or loss of life, have and will continue to occur against industrial control systems (ICS), also referred to as Supervisory Control and Data Acquisition (SCADA) systems.The ascent of sophisticated and state-sponsored attacks such as Stuxnet and Triton against core components like Programmable Logic Controllers PLCs, along with the lack of forensically sound tools, approaches and techniques have motivated this PhD to examine the applicability and transferability of traditional digital forensics tools and capabilities to the realm of cyber physical systems within critical national infrastructures. With major challenges forensic investigators are facing in SCADA forensic investigations such as limited computing/storage resources in ICS devices , vendor-specific proprietary firmware, opacity of ICS protocol specifications, lack of memory acquisition tools and insufficient logging capabilities, a new and experimentally validated ICS forensic readiness architecture to establish a forensic capability before an incident while maintaining the safety-critical properties represent the core objective of my PhD.