The recent surge in security incidents against SCADA/ICS systems raises questions about many organizations' ability to respond to and analyze critical incidents. For this reason, the Agency emphasizes the urgent need to create a proactive learning environment through post-incident analysis. SCADA/
ICS systems are commonly used to control industrial processes in manufacturing, production, and product distribution. Often, outdated, off-the-shelf commercial software is employed. Among the most well-known types of SCADA/ICS systems are SCADA/ICS systems, which constitute the largest subgroup of SCADA/ICS systems. Recent SCADA/ICS incidents demonstrate the importance of good governance and control of SCADA infrastructures. Specifically, and as the Agency stresses, the ability to respond to critical incidents and analyze the aftermath of an attack to learn from it is crucial.
The goal of post-incident analysis is to gain a deeper understanding of the incident, which will facilitate the ability to:
• draw sound conclusions to respond to the evolving nature of both internal and external threats; and
• ensure sufficient learning to enable the deployment of more flexible and resilient systems.
We have identified four key elements in creating a proactive learning environment that, in turn, ensures a rapid response to cyber incidents and their subsequent analysis:
• Complementing the existing technical knowledge base by specializing in post-event analysis and understanding the overlaps between cyber incident response teams and critical physical incident response teams;
• Facilitating the integration of physical and cyber response processes with a greater understanding of where digital evidence may be found and what appropriate measures can be taken for its preservation;
• Designing and configuring systems to enable the retention of digital evidence; and
• Increasing collaborative efforts between organizations, as well as at the interstate level.
Professor Udo Helmbrecht, Executive Director of ENISA, commented: “SCADA systems are often integrated into sectors that form part of a nation’s critical infrastructure, such as energy distribution and transport control, making them attractive targets for cyberattacks carried out by disaffected nationals, dissident groups, or foreign states. Such systems should be used in a way that enables the collection and analysis of digital evidence, which in turn will allow for the identification of what happened during a security breach.”
