Incident Analysis & Digital Forensics in SCADA and Industrial Control Systems

SCADA and industrial control systems have been traditionally isolated in physically protected environments. However, developments such as standardisation of data exchange protocols and increased use of IP, emerging wireless sensor networks and machine-to-machine communication mean that in the near future related threat vectors will require consideration too outside the scope of traditional SCADA security and incident response. In the light of the significance of SCADA for the resilience of critical infrastructures and the related targeted incidents against them (e.g. the development of stuxnet), cyber security and digital forensics emerge as priority areas. In this paper we focus on the latter, exploring the current capability of SCADA operators to analyse security incidents and develop situational awareness based on a robust digital evidence perspective. We look at the logging capabilities of a typical SCADA architecture and the analytical techniques and investigative tools that may help develop forensic readiness to the level of the current threat environment requirements. We also provide recommendations for data capture and retention

Soft systems methodology in net-centric cyber defence system development

Complexity is ever increasing within our information environment and organisations, as interdependent dynamic relationships within sociotechnical systems result in high variety and uncertainty from a lack of information or control. A net-centric approach is a strategy to improve information value, to enable stakeholders to extend their reach to additional data sources, share Situational Awareness (SA), synchronise effort and optimise resource use to deliver maximum (or proportionate) effect in support of goals. This paper takes a systems perspective to understand the dynamics within a net-centric information system. This paper presents the first stages of the Soft Systems Methodology (SSM), to develop a conceptual model of the human activity system and develop a system dynamics model to represent system behaviour, that will inform future research into a net-centric approach with information security. Our model supports the net-centric hypothesis that participation within a information sharing community extends information reach, improves organisation SA allowing proactive action to mitigate vulnerabilities and reduce overall risk within the community. The system dynamics model provides organisations with tools to better understand the value of a net-centric approach, a framework to determine their own maturity and evaluate strategic relationships with collaborative communities

caCORRECT2: Improving the accuracy and reliability of microarray data in the presence of artifacts

© 2011 Moffitt et al.; licensee BioMed Central Ltd. This is an open access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/2.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.DOI: 10.1186/1471-2105-12-383Background. In previous work, we reported the development of caCORRECT, a novel microarray quality control system built to identify and correct spatial artifacts commonly found on Affymetrix arrays. We have made recent improvements to caCORRECT, including the development of a model-based data-replacement strategy and integration with typical microarray workflows via caCORRECT's web portal and caBIG grid services. In this report, we demonstrate that caCORRECT improves the reproducibility and reliability of experimental results across several common Affymetrix microarray platforms. caCORRECT represents an advance over state-of-art quality control methods such as Harshlighting, and acts to improve gene expression calculation techniques such as PLIER, RMA and MAS5.0, because it incorporates spatial information into outlier detection as well as outlier information into probe normalization. The ability of caCORRECT to recover accurate gene expressions from low quality probe intensity data is assessed using a combination of real and synthetic artifacts with PCR follow-up confirmation and the affycomp spike in data. The caCORRECT tool can be accessed at the website: http://cacorrect.bme.gatech.edu webcite. Results. We demonstrate that (1) caCORRECT's artifact-aware normalization avoids the undesirable global data warping that happens when any damaged chips are processed without caCORRECT; (2) When used upstream of RMA, PLIER, or MAS5.0, the data imputation of caCORRECT generally improves the accuracy of microarray gene expression in the presence of artifacts more than using Harshlighting or not using any quality control; (3) Biomarkers selected from artifactual microarray data which have undergone the quality control procedures of caCORRECT are more likely to be reliable, as shown by both spike in and PCR validation experiments. Finally, we present a case study of the use of caCORRECT to reliably identify biomarkers for renal cell carcinoma, yielding two diagnostic biomarkers with potential clinical utility, PRKAB1 and NNMT. Conclusions. caCORRECT is shown to improve the accuracy of gene expression, and the reproducibility of experimental results in clinical application. This study suggests that caCORRECT will be useful to clean up possible artifacts in new as well as archived microarray data

Use of Rollover Protective Structures -- Iowa, Kentucky, New York, and Ohio, 1992-1997

Agriculture has one of the highest occupational fatality rates of all industries in the United States (1). Tractors and other types of agricultural equipment account for a large proportion of these fatalities, and farm-tractor rollovers account for approximately 130 work-related deaths each year in the United States (2). Although rollover protective structures (ROPS) are effective in protecting tractor operators from fatal injuries during rollovers (3-5), most tractors in the United States are not equipped with ROPS (4-7). Beginning in 1985, tractor manufacturers in the United Sates agreed to sell only tractors with ROPS; however, many older tractors without ROPS remain in use. To determine the prevalence of the use of ROPS, beginning in 1992, the Farm Family Health and Hazard Surveillance (FFHHS) program * collected state-based data on tractor age and use of ROPS from selected states. As of August 1997, four states had completed collection and analysis of data on farm tractors. This report summarizes the results of that survey, which indicates that 80%-90% of tractors in use in the four states were manufactured before 1985 and that less than 40% are equipped with ROPS

Effect of noise on coupled chaotic systems

Effect of noise in inducing order on various chaotically evolving systems is reviewed, with special emphasis on systems consisting of coupled chaotic elements. In many situations it is observed that the uncoupled elements when driven by identical noise, show synchronization phenomena where chaotic trajectories exponentially converge towards a single noisy trajectory, independent of the initial conditions. In a random neural network, with infinite range coupling, chaos is suppressed due to noise and the system evolves towards a fixed point. Spatiotemporal stochastic resonance phenomenon has been observed in a square array of coupled threshold devices where a temporal characteristic of the system resonates at a given noise strength. In a chaotically evolving coupled map lattice with logistic map as local dynamics and driven by identical noise at each site, we report that the number of structures (a structure is a group of neighbouring lattice sites for whom values of the variable follow certain predefined pattern) follow a power-law decay with the length of the structure. An interesting phenomenon, which we call stochastic coherence, is also reported in which the abundance and lifetimes of these structures show characteristic peaks at some intermediate noise strength.Comment: 21 page LaTeX file for text, 5 Postscript files for figure

Bose-Einstein condensation as symmetry breaking in compact curved spacetimes

We examine Bose-Einstein condensation as a form of symmetry breaking in the specific model of the Einstein static universe. We show that symmetry breaking never occursin the sense that the chemical potential $\mu$ never reaches its critical value.This leads us to some statements about spaces of finite volume in general. In an appendix we clarify the relationship between the standard statistical mechanical approaches and the field theory method using zeta functions.Comment: Revtex, 25 pages, 3 figures, uses EPSF.sty. To be published in Phys. Rev.