Cyber Forensic Tool Kit for Machinery Control

The objective of this project is to develop a portable and lightweight cyber forensics software toolkit with advanced capabilities for supporting live forensics on SCADA Machinery Control Systems (MCSs). The lack of standards, coupled with extensive reliance on proprietary solutions and protocols, essentially prevent the ready adoption and utilization of current forensic tools and methods. Additionally, the unique requirements of legacy and proprietary components, protocols, and the likes, within SCADA MCS, necessitate an open architecture design in order to functionally test various tool components to be integrated into the CyFT framework. Based on our Phase I feasibility study, we feel confident and encouraged to propose developing an Open Systems Architecture-based Cyber Forensics Toolkit (CyFT) Framework. Tools developed with cyber forensics capabilities can be seamlessly integrated into CyFT framework. Some of the key factors evaluated for suitability and feasibility of available alternatives for adoption during Phase II prototype implementation are as follows:     1.     Design Alternatives –Modular vs Integral;      2.     Solution Architecture – Closed vs Open;      3.     API Specifications – Open Standard vs Custom;      4.     Evaluation Models – Formal/Abstract vs Simulation/Prototype; and     5.     Tool Execution – Memory Resident (e.g., Terminate & Stay Resident (TRS)) vs Disk           Resident.