Best Approaches For Reducing Anti-Forensics
Effectiveness When Dealing With Industrial Control Systems

What is Industrial Control Systems (ICS)?
Why Industrial Control Systems security is important than normal network security?
Is there any severity matrix developed for Industrial Control Systems security to deal with risk
assessment?
Is the severity matrix for normal network security different than ICS security when assessing risk?

What is Anti-Forensics?
How it is maintain in normal network security environment?
How it should be maintained in Industrial Control Systems without affecting the current safety level?
Is there a need for new severity matrix to be developed to reduce Anti-Forensics effectiveness when
dealing with Industrial Control Systems? Why?
MJ v03

Best Approaches For Reducing Anti-Forensics
Effectiveness When Dealing With Industrial Control Systems

Abstract—Industrial Control Systems (ICS) incorporate mechanisms to configure process control
schemes, operate distributed interconnected equipment, and maintain production lines. Security of
such networks is therefore more important than normal network security because they contain soft
targets whose vulnerability to disruption is detrimental to the survival of large-scale plants thereby
incurring huge losses. Normal network security is different from ICS security because the latter employs
Mean Failure Cost. It evaluates the computational basis for estimates regarding the availability of a
system based on the loss that every stakeholder will sustain resulting from violations/breakdowns. Anti-
forensics are measures designed to negatively affect the availability, quality/amount of evidence of any
wrongdoing within a system. In ICS, anti-forensics is layered with network traffic protocols and
customized operating system kernels that reverse the ability to access certain ports within the system. It
is therefore laden with constrained devices with anti-logging capabilities, which make it difficult for
conducting checks, or tampering with its operational cause. The dynamic nature of the global industrial
complex does not demand upgrading of current severity matrix to reduce anti-forensic effectiveness
because that would be beneficial to the firms. Preventing the compromise of such systems would
therefore be a prudent move.

Research Project Structure:

1. Abstract (completed, just small modification to stream with overall if required)
2. Introduction (Background Information)
3. Related Work (Literature Review)
   a. Problem and motivation (Use the questions)
   b. Table of Anti-forensics attacks statistics in normal corporate network
   c. Diagram of current ICS threats
4. Implementation and Analysis
   a. Should include existing plant HSE severity matrix
   b. Should include proposed (Anti-forensics) plant HSE severity matrix
   c. Analyze the expected benefits (tangible [dollar value] & untenable [operator
   moral])
5. Results analysis (Overall research contribution + with a graph representing expected
   benefits of new severity matrix assessment vs. current which is only for plant HSE)
6. Discussion (Future work)
7. Conclusion
8. References (Vancouver)
   Use IEEE format http://bit.ly/1OozzKb (there is a LaTeX template) for writing the above.