An OT Forensic Model Based on Established IT Forensics Using IIRA

Through Industrie 4.0, the connectivity of automation or industrial control systems (ICS) is increasing. Simultaneously the frequency and aggressiveness of remote attacks have increased, impacting the risk and vulnerabilities of ICS [1]. For example, a remote attacker can now damage industrial machines or impair the efficiency of production facilities over the Internet. To find evidence and protect oneself against future attacks as well as to minimize risks, it is necessary to be able to investigate or trace down such incidents by performing forensics within ICS. In this paper, we developed a forensic model to plan and perform forensic investigations within Internet-based ICS. For this purpose, we use established classic IT forensic processes as well as existing forensic research for Operational Technology (OT). Our model is compliant with the Industrial Internet Reference Architecture (IIRA) so it can be integrated or applied to existing Internet-based ICS.The approach is validated by showing that it is suitable to detect and analyze a recently published, more sophisticated attack on the OT specific components of typical ICS architectures.