A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure

Peter Eden, Andrew Blyth, Pete Burnap, Yulia Cherdantseva, Kevin Jones, Hugh Soulsby, Kristan Stoddart

Research output: Chapter in Book/Report/Conference proceedingOther chapter contributionpeer-review


SCADA systems are essential for the safe running of critical infrastructure but in recent years have increasingly become the target of advanced cyber-attacks through their convergence with public and corporate networks for easier monitoring and control. Cyber-events within critical infrastructure can have devastating consequences affecting human life, the environment and the economy. Therefore, it is vital that a forensic investigation takes place to provide remediation, understanding and to help in the design of more secure systems. This paper provides an overview of the SCADA forensic process, within critical infrastructure, and discusses the existing challenges of carrying out a SCADA forensic investigation. It also discusses ways in which the process may be improved together with a suggested SCADA incident response model. This paper is part of an ongoing research project that is working towards the creation of best practice guidelines for the forensic handling and incident response of SCADA systems.

Original languageEnglish
Title of host publicationCritical Information Infrastructures Security
Subtitle of host publication10th International Conference, CRITIS 2015, Berlin, Germany, October 5-7, 2015, Revised Selected Papers
EditorsErich Rome, Marianthi Theocharidou, Stephen Wolthusen
ISBN (Electronic)978-3-319-33331-1
ISBN (Print)978-3-319-33330-4
Publication statusPublished - 18 May 2016

Publication series

NameLecture Notes in Computer Science
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


  • Critical infrastructure
  • Digital forensics
  • Incident response
  • Cyber security lifecycle
  • SCADA forensics


Dive into the research topics of 'A Cyber Forensic Taxonomy for SCADA Systems in Critical Infrastructure'. Together they form a unique fingerprint.

Cite this