Incident Analysis & Digital Forensics in SCADA and Industrial Control Systems

SCADA and industrial control systems have been traditionally isolated in physically protected environments. However, developments such as standardisation of data exchange protocols and increased use of IP, emerging wireless sensor networks and machine-to-machine communication mean that in the near future related threat vectors will require consideration too outside the scope of traditional SCADA security and incident response. In the light of the significance of SCADA for the resilience of critical infrastructures and the related targeted incidents against them (e.g. the development of stuxnet), cyber security and digital forensics emerge as priority areas. In this paper we focus on the latter, exploring the current capability of SCADA operators to analyse security incidents and develop situational awareness based on a robust digital evidence perspective. We look at the logging capabilities of a typical SCADA architecture and the analytical techniques and investigative tools that may help develop forensic readiness to the level of the current threat environment requirements. We also provide recommendations for data capture and retention

Soft systems methodology in net-centric cyber defence system development

Complexity is ever increasing within our information environment and organisations, as interdependent dynamic relationships within sociotechnical systems result in high variety and uncertainty from a lack of information or control. A net-centric approach is a strategy to improve information value, to enable stakeholders to extend their reach to additional data sources, share Situational Awareness (SA), synchronise effort and optimise resource use to deliver maximum (or proportionate) effect in support of goals. This paper takes a systems perspective to understand the dynamics within a net-centric information system. This paper presents the first stages of the Soft Systems Methodology (SSM), to develop a conceptual model of the human activity system and develop a system dynamics model to represent system behaviour, that will inform future research into a net-centric approach with information security. Our model supports the net-centric hypothesis that participation within a information sharing community extends information reach, improves organisation SA allowing proactive action to mitigate vulnerabilities and reduce overall risk within the community. The system dynamics model provides organisations with tools to better understand the value of a net-centric approach, a framework to determine their own maturity and evaluate strategic relationships with collaborative communities

A Game Theoretical Method for Cost-Benefit Analysis of Malware Dissemination Prevention

Copyright © Taylor & Francis Group, LLC. Literature in malware proliferation focuses on modeling and analyzing its spread dynamics. Epidemiology models, which are inspired by the characteristics of biological disease spread in human populations, have been used against this threat to analyze the way malware spreads in a network. This work presents a modified version of the commonly used epidemiology models Susceptible Infected Recovered (SIR) and Susceptible Infected Susceptible (SIS), which incorporates the ability to capture the relationships between nodes within a network, along with their effect on malware dissemination process. Drawing upon a model that illustrates the network’s behavior based on the attacker’s and the defender’s choices, we use game theory to compute optimal strategies for the defender to minimize the effect of malware spread, at the same time minimizing the security cost. We consider three defense mechanisms: patch, removal, and patch and removal, which correspond to the defender’s strategy and use probabilistically with a certain rate. The attacker chooses the type of attack according to its effectiveness and cost. Through the interaction between the two opponents we infer the optimal strategy for both players, known as Nash Equilibrium, evaluating the related payoffs. Hence, our model provides a cost-benefit risk management framework for managing malware spread in computer networks

Challenges in the Design and Implementation of IoT Testbeds in Smart-Cities : A Systematic Review

Advancements in wireless communication and the increased accessibility to low-cost sensing and data processing IoT technologies have increased the research and development of urban monitoring systems. Most smart city research projects rely on deploying proprietary IoT testbeds for indoor and outdoor data collection. Such testbeds typically rely on a three-tier architecture composed of the Endpoint, the Edge, and the Cloud. Managing the system's operation whilst considering the security and privacy challenges that emerge, such as data privacy controls, network security, and security updates on the devices, is challenging. This work presents a systematic study of the challenges of developing, deploying and managing urban monitoring testbeds, as experienced in a series of urban monitoring research projects, followed by an analysis of the relevant literature. By identifying the challenges in the various projects and organising them under the V-model development lifecycle levels, we provide a reference guide for future projects. Understanding the challenges early on will facilitate current and future smart-cities IoT research projects to reduce implementation time and deliver secure and resilient testbeds

Antipsychotic prescribing for vulnerable populations: a clinical audit at an acute Australian mental health unit at two-time points

Background: Antipsychotics are recognised as a critical intervention for schizophrenia and bipolar disorder. Guidelines globally endorse the routine practice of antipsychotic monotherapy, at the minimum effective dose. Even in treatmentresistant schizophrenia, clozapine use is endorsed before combining antipsychotics. This aim of this study was to review antipsychotic polytherapy alone, high-dose therapy alone, polytherapy and highdose prescribing patterns in adults discharged from an inpatient mental health unit at two time-points, and the alignment of this prescribing with clinical guideline recommendations. Additionally, associations with polytherapy and high-dose antipsychotic prescribing, including patient and clinical characteristics, were explored. Methods: A retrospective clinical audit of 400 adults (200 patients at two different time-points) discharged with at least one antipsychotic. Preliminary findings and education sessions were provided to physicians between Cohorts. Outcomes (polytherapy alone, high-dose therapy alone, polytherapy and high-dose therapy) were compared between study Cohorts using chi-squared and rank-sum tests. Associations between outcomes and covariates were assessed using multivariable logistic regression. Results: Most patients (62.5%) were discharged on a single antipsychotic within the recommended dose range. There was a clear preference for prescribing second generation antipsychotics, and in this respect, prescribing is aligned with current evidence-based guidelines. However, sub-optimal prescribing practices were identified for both Cohorts in relation to polytherapy and high-dose antipsychotic rates. Involuntary treatment, frequent hospitalisations and previous clozapine use significantly increased the risk of all three prescribing outcomes at discharge. Conclusions: In a significant minority, antipsychotic prescribing did not align with clinical guidelines despite increased training, indicating that the education program alone was ineffective at positively influencing antipsychotic prescribing practices. Further consideration should be given when prescribing antipsychotics for involuntary patients, people with frequent hospitalisations, and those who have previously trialled clozapine

Search for dark matter produced in association with bottom or top quarks in √s = 13 TeV pp collisions with the ATLAS detector

A search for weakly interacting massive particle dark matter produced in association with bottom or top quarks is presented. Final states containing third-generation quarks and miss- ing transverse momentum are considered. The analysis uses 36.1 fb−1 of proton–proton collision data recorded by the ATLAS experiment at √s = 13 TeV in 2015 and 2016. No significant excess of events above the estimated backgrounds is observed. The results are in- terpreted in the framework of simplified models of spin-0 dark-matter mediators. For colour- neutral spin-0 mediators produced in association with top quarks and decaying into a pair of dark-matter particles, mediator masses below 50 GeV are excluded assuming a dark-matter candidate mass of 1 GeV and unitary couplings. For scalar and pseudoscalar mediators produced in association with bottom quarks, the search sets limits on the production cross- section of 300 times the predicted rate for mediators with masses between 10 and 50 GeV and assuming a dark-matter mass of 1 GeV and unitary coupling. Constraints on colour- charged scalar simplified models are also presented. Assuming a dark-matter particle mass of 35 GeV, mediator particles with mass below 1.1 TeV are excluded for couplings yielding a dark-matter relic density consistent with measurements

Paliperidone long-acting injections in Huntington’s Disease for motor and behavioural disturbances

Oral antipsychotics are used to treat motor and behavioural disturbances in Huntington’s disease (HD). However, patients with behavioural disturbances are often non-compliant, thus the oral route is inappropriate. The effects of antipsychotic long-acting injections (LAI) in HD are significantly underrepresented in literature. Paliperidone LAI (P-LAI), an atypical antipsychotic, has benefits over other antipsychotics LAI with its long dosing interval and no initial oral overlap, but has no documented cases for this indication. This case of a 45-year-old female highlights the use of P-LAI for severe aggression and chorea secondary to HD causing failed placement in assisted-care accommodation and mobility via an electronic-wheelchair. Three weeks after commencing treatment, she could walk unassisted, and displayed no aggression. After 10\ua0months, she still had significant improvements and resided in the same accommodation for 6\ua0months without any\ua0concern. Thus, this case suggests that P-LAI may be a treatment option for non-compliant HD patients