Ken Yau

Kam-Pui Chow

Siu-Ming Yiu

An Incident Response Model for Industrial Control System Forensics Based on Historical Events

Keywords: Industrial control systems, incident response, forensics

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The critical infrastructure is defined as processes, systems, facilities, technologies, networks, assets and services that are essential to the health, safety security or economic well-being of citizens and the effective functioning of government [14]. Critical infrastructure assets can be stand-alone or interconnected, and interdependent within and across cities, states and nations. Disruptions or damage to critical infrastructure assets could result in the loss of life, adverse economic effects and loss of public confidence [14].

Industrial control systems are indispensable to the safe and efficient operation of critical infrastructure assets. An industrial control system can be a single embedded system such as a programmable logic controller (PLC) that controls an automatic door or an elevator; or it could be a large and complex distributed control system connected to multiple supervisory control and data acquisition (SCADA) systems in a nuclear power plant [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF].

Modern industrial control systems are increasingly connected to corporate networks and the Internet over TCP/IP and wireless protocols to improve their performance and effectiveness [START_REF] Spyridopoulos | Incident analysis and digital forensics in SCADA and industrial control systems[END_REF], exposing the previously-isolated systems to myriad remote attacks. According to an IBM report [START_REF] Mcmillen | Security Attacks on Industrial Control Systems: How Technology Advances Create Risks for Industrial Organizations[END_REF], cyber attacks on industrial systems in 2016 increased by 110% over the previous year (2015). Because of the importance of industrial control systems, it is crucial to protect them from remote cyber attacks as well as from undesirable incidents such as hardware failures, malicious intruders, accidents and natural disasters [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF].

Digital forensics is an important part of an incident investigation. It helps reconstruct past events and activities based on timelines in order to prevent recurring attacks and undesirable incidents from occurring. Industrial control systems may comprise hundreds to thousands of interconnected devices. The devices include programmable logic controllers and remote terminal units (RTUs), which are highly specialized embedded systems that often have limited computational and memory resources, and functionality. As a result, it can be difficult to acquire data from industrial control systems. Traditional digital forensic techniques are also inadequate for industrial control systems. Moreover, standard forensic guidelines, procedures and tools are not as yet available for investigating incidents involving industrial control systems.

Several frameworks, processes and tools have been developed for industrial control system security and forensics; these are primarily based on attack patterns of real or synthetic industrial control system malware. However, only a portion of industrial control system incidents involve malware attacks. This chapter presents an incident response model for industrial control system forensics based on historical events. In particular, representative industrial control incidents -cyber attacks and accidents -that have occurred over the past 25 years are categorized and analyzed. The resulting incident response model is useful for forensic planning and investigations. The model enables incident response teams and forensic investigators to decide on the expertise, techniques and tools to be applied to ensure sound evidence acquisition, analysis and reporting.

Forensic Challenges

Digital forensic techniques and tools are required to collect evidence for legal proceedings and internal investigations, as well as to handle malware incidents and unusual operational problems. Regardless of the application, digital forensics involves four basic processes: (i) collection; (ii) examination;

Collection Examination Analysis Reporting

Figure 1. Digital forensic process [START_REF] Kent | Guide to Integrating Forensic Techniques into Incident Response[END_REF].

(iii) analysis; and (iv) reporting (Figure 1). The implementation details of these processes vary based on the specific forensic needs. Although digital forensics is becoming a mature domain, investigators need to modify traditional digital forensic processes for use in industrial control system environments. The following forensic challenges are encountered in industrial control environments [START_REF] Fabro | Recommended Practice: Creating Cyber Forensic Plans for Control Systems[END_REF]:

The availability of industrial control systems is a top priority. Therefore, it is often not possible to shut down devices such as programmable logic controllers for evidence collection and forensic investigations.

Most modern industrial control environments provide only some of the required data collection features (e.g., identifying, recording, copying and labeling materials from a variety of data sources in the information architecture). Many industrial control systems do not support forensic data collection.

Contemporary forensic tools, such as those used to examine running processes and services, automate evidence collection through precompiled scripts or programs, bit copy processes and programs that generate checksums for image verification, are often not designed to accommodate industrial control system technologies. Many forensic tools cannot be adapted to operate in industrial control environments.

Industrial Control Networks

Operational technology (OT) refers to the hardware and software that monitor and/or control industrial processes. Industrial control systems and SCADA systems are examples of operational technology. The protection of critical infrastructure networks is commonly considered to fall in the domain of SCADA security [START_REF] Dar | Protecting industrial control networks -It's not just about SCADA security[END_REF]. However, this is not necessarily true.

In fact, critical infrastructure networks are hybrids of operational technology and information technology [START_REF] Dar | Protecting industrial control networks -It's not just about SCADA security[END_REF]. Industrial control systems are often connected to corporate networks (Figure 2). Whether they reside in large critical infrastructure assets or small localized controller-run assets, industrial control systems integrate operational and information technologies.

Stuxnet, a most sophisticated and complex malware, was designed to target industrial control systems. It was launched from a conventional information technology network to attack programmable logic controllers in an operational technology network. The Stuxnet attack demonstrated that an air gap between information technology and operational technology can be breached [START_REF] Dar | Protecting industrial control networks -It's not just about SCADA security[END_REF].

Literature Review

Research on industrial control system and programmable logic controller security and forensics significantly ramped up after Stuxnet was discovered in 2010. The research has generally focused on vulnerabilities in industrial control systems and protocols. Several types of simulated cyber attacks have been investigated to advance security and forensic efforts.

Spenneberg et al. [START_REF] Spenneberg | PLC-Blaster: A worm living solely in the PLC[END_REF] developed a worm that propagates to programmable logic controllers. The worm scans a network for programmable logic controllers, attacks the targets and then replicates itself on the targets. Spenneberg and colleagues have analyzed the impacts of the worm on various targets and have suggested possible mitigations.

Abbasi and Hashemi [START_REF] Abbasi | Ghost in the PLC: Designing an undetectable programmable logic controller rootkit via pin control attack, presented at Black Hat Europe[END_REF] have investigated the security implications of embedded system input/output pin control. They demonstrate how an attacker can affect the integrity and availability of embedded system inputs and outputs by exploiting pin control operations. Such attacks on programmable logic controllers can be difficult to detect.

Ben Aloui [START_REF] Aloui | Industrial Control Systems Dynamic Code Injection, Cybersecurity Labs[END_REF] has demonstrated the ease with which dynamic code injection can be executed on a Siemens S7-300 programmable logic controller without shutting down or restarting the device. The program, which is written in the C language and uses the Snap7 library, pushes a new program segment (organization block) into the CPU. A small human-machine interface (HMI) was developed to illustrate dynamic modifications of the execution flow. Several countermeasures and protection strategies were proposed to combat dynamic code injection.

All these research efforts are useful for industrial control system threat analysis and forensics, but they focus on simulated, not real, cyber attacks. Thus, the results do not reflect real situations. Indeed, realistic solutions for industrial control system forensics are unlikely to be developed by considering only simulated attacks.

Eden et al. [START_REF] Eden | A forensic taxonomy of SCADA systems and approach to incident response[END_REF] have proposed a forensic incident response model for industrial control systems. The model has four stages: (i) prepare; (ii) detect; (iii) triage; and (iv) respond. Eden and colleagues outline the forensic triage process and highlight the differences and challenges involved in performing forensic incident responses on industrial control systems compared with traditional systems. The forensic incident response model is useful, but is generic as opposed to incidentspecific.

Classification of Incidents

In order to develop a practical methodology for industrial control system forensics, representative incidents since 1992 discussed in newspaper articles, technical reports and research papers were examined. The incidents were first organized into two types: (i) attacks; and (ii) accidents. They were then classified into four categories: (i) general computer malware; (ii) unauthorized access; (iii) industrial control system malware; and (iv) accidents.

The classification model is based on categories of malicious activity [START_REF] Carr | Development of a Tailored Methodology and Forensic Toolkit for Industrial Control Systems Incident Response[END_REF] and accidents. Tables 1 and2 summarize the incidents.

General Computer Malware

General computer malware targets traditional information technology systems such as office computers and human-machine interfaces. However, malware attacks can indirectly shut down or otherwise impact industrial control system operations.

A variant of the Sobig worm was introduced into the CSX Railroad headquarters in Jacksonville, Florida in August 2003 [START_REF] Carr | Development of a Tailored Methodology and Forensic Toolkit for Industrial Control Systems Incident Response[END_REF]. The malware installed applications and created backdoors while continuing to spread by infecting email attachments. Although the worm was not specifically designed to target railroad systems, it propagated to the control center and proceeded to disrupt signaling, dispatch and other related systems. Reports indicated that Amtrak trains in the area were also affected by the malware in CSX Railroad systems. The malware attack caused multiple train delays and expensive clean-up activities.

Unauthorized Access

These incidents involve unauthorized persistent access of control center systems or field devices from another network such as a corporate network or in Feurs, France to cause an explosion [START_REF]Ministry of the Environment, Energy and the Sea, Lessons Learnt from Industrial Accidents, 12th Seminar[END_REF] 2015 Pressurized flammable gas leaked into a petrochemical complex in Gonfrevillel'Orcher, France [START_REF]Ministry of the Environment, Energy and the Sea, Lessons Learnt from Industrial Accidents, 12th Seminar[END_REF] 2017 An escalator suddenly accelerated and then reversed its direction in a mall in Mong Kok, Hong Kong [START_REF] Television | Langham Place escalator malfunctions[END_REF] the Internet. The attackers can be insiders (e.g., employees, contractors and vendors) or outsiders. One of the most famous SCADA system breaches occurred at Maroochy Water Services on Queensland's Sunshine Coast in Australia [START_REF] Slay | Lessons learned from the Maroochy water breach[END_REF]. Vitek Boden, a former Maroochy consultant, used a laptop computer and a radio transmitter to take control of 150 sewage pumping stations. Over a three-month period, he released one million liters of untreated sewage into a water drain from where it flowed into local waterways. Mr. Boden launched the attack because he was denied a fulltime position with the Maroochy Shire Council.

Industrial Control System Malware

Industrial control system malware specifically targets field devices such as programmable logic controllers. The incidents may involve firmware tampering or exploiting device vulnerabilities.

Stuxnet is a most sophisticated industrial control system malware that leveraged four zero-day vulnerabilities and two compromised digital certificates in its attacks on Iran's uranium hexafluoride centrifuges [START_REF] Carr | Development of a Tailored Methodology and Forensic Toolkit for Industrial Control Systems Incident Response[END_REF] application software to control Windows systems that could modify the control programs of Siemens programmable logic controllers, inducing abnormal operations and eventually destroying several centrifuges.

Accidents

Accidents include incidents such as incorrect control, power disruptions, hardware failures and fires that are not due to cyber attacks or cyber criminal activities [START_REF] Dzwiarek | An analysis of accidents caused by improper functioning of machine control systems[END_REF]. They are typically caused by design flaws, human error and natural phenomena.

A fire in the nacelle of a wind turbine in The Netherlands in October 2013 killed two service engineers [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF]. Investigators working in collaboration with the Netherlands Forensic Institute, Department of Digital Technology and the wind turbine manufacturer were able to remove the controller located at the base of the turbine to extract evidence.

Refined Incident Response Model

Incident response requires substantial planning and resources. [START_REF] Souppaya | Guide to Malware Incident Prevention and Handling for Desktops and Laptops[END_REF]. Digital forensics, which is a core component of incident response capabilities, covers the collection, examination, analysis and reporting of incident data [START_REF] Fabro | Recommended Practice: Creating Cyber Forensic Plans for Control Systems[END_REF]. A forensic program is typically initiated after incident response processes such as restoration, mitigation and initial reporting. Many organizations integrate the forensic function in incident response processes, especially when the start of the forensic function cannot be defined clearly.

Fabro and Cornelius [START_REF] Fabro | Recommended Practice: Creating Cyber Forensic Plans for Control Systems[END_REF] have studied the integration trend and have defined a cyber incident response model with an embedded forensics component as shown in Figure 3. In this approach, forensic collection is embedded in incident response, forensic analysis in incident recovery and forensic reporting in incident closure.

The study of historical industrial control system incidents reveals that special skills and techniques are not always required for digital forensic examinations of industrial control systems. Some incidents can be investigated using traditional forensic techniques and tools, especially when the incidents fall in the general computer malware and unauthorized access categories. In the case of an industrial control system incident, the incident response team typically incorporates industrial control system specialists and applies special techniques and tools in the investigation. However, the historical incident data reveals that traditional forensic techniques and tools are adequate for investigating incidents in the general computer malware and unauthorized access categories, eliminating the need to use specialized techniques and tools.

Therefore, in order to increase the efficiency of forensic processes, the core components of cyber incident response in Figure 3 are refined by inserting a new incident categorization component after the incident detection component during the early stage of preparing a forensic response plan. Figure 4 shows the refined incident response model with an embedded industrial control system forensics component.

Additionally, two types of response are incorporated: (i) traditional forensics; and (ii) industrial control system forensics. Depending on the classification assigned to an incident, the investigation can employ either traditional forensics or industrial control system forensics during the early stage. This saves time, effort and resources while ensuring more precise and effective incident response.

Traditional Forensics

This section discusses the application of traditional forensics to industrial control systems in incidents involving general computer malware and unauthorized access. Since traditional information technology computers, networks and protocols are targeted, traditional forensic methods are adequate for digital investigations. Normal hard drive analysis, log analysis and network tools can be used to examine what was running on the systems and reveal the causes of the incidents.

General Computer Malware:

In the case of the virus attack on CSX Railroad, traditional digital forensics would have been sufficient because the incident did not involve industrial control equipment or field devices. The incident mainly involved general computer systems. Therefore, the investigation would have identified the hosts that were infected by malware, and appropriate containment, eradication and recovery ac-

Audit Log Analysis

Monitor and review insider (e.g., employee, vendor and contractor) activities

ICS Skills and Knowledge

ICS field devices

ICS communications protocols PLC programming languages

Electronics, electrical and mechanical knowledge

ICS Incident Detection

Incident Categorization

Response Initiation

Traditional Forensics tions would have been applied to the infected hosts. Evidence would then have been collected from the domain name server (DNS) logs, application server logs and network device logs. Traditional network forensic logs would also have been analyzed to reveal detailed information about the malware activity [START_REF] Souppaya | Guide to Malware Incident Prevention and Handling for Desktops and Laptops[END_REF].

ICS Forensics Traditional Forensics

Unauthorized Access: In the case of the unauthorized access incident at Maroochy Water Services, a PDS Compact 500 process controller, twoway radio and computer laptop were found in Mr. Boden's automobile. Mr. Boden stated that he owned all the items and was using them for study, personal correspondence and work related to his family business. However, law enforcement discovered that the PDS Compact 500 controller and two-way radio were stolen from Hunter Watertech, a company contracted to install PDS Compact 500 units at pumping stations belonging to Maroochy Shire.

The software installed in Mr. Boden's laptop computer was developed by Hunter Watertech and was required to communicate with the SCADA system at Maroochy Water Services; the software had no other practical use. The two-way radio was set to the same frequency as two of the three available repeater stations. The laptop computer startup and shutdown times were consistent with the logged intrusions. The PDS Compact 500 process controller had the same address as the one logged during the intrusions. Moreover, Mr. Boden was arrested at a location that was within radio range of the pumping station repeater and close enough to connect to the SCADA network. All the evidence in the Maroochy Water Services incident was collected by applying traditional digital forensic techniques and tools with the assistance of Hunter Watertech personnel. Mr. Boden was ultimately sentenced to two years in jail on 30 charges of computer hacking, theft and causing environmental damage [START_REF] Sayfayn | Cybersafety Analysis of the Maroochy Shire Sewage Spill[END_REF]. Industrial control system attacks are not limited to malware. Other attacks include advanced persistent threats (APTs), spear phishing, SQL injection, distributed denial-of-service (DDoS), social engineering and man-in-the-middle (MITM) attacks. However, less sophisticated methods such as unauthorized access, brute forcing and insider attacks can be just as effective [START_REF] Sayfayn | Cybersafety Analysis of the Maroochy Shire Sewage Spill[END_REF]. As in the case of the CSX Railroad and Maroochy Services attacks, many incidents can be handled using traditional forensic methods because the incidents did not involve industrial control equipment or field devices.

Industrial Control System Forensics

Traditional forensic techniques and tools do not provide data collection functionality for programmable logic controllers, remote terminal units, intelligent electronic devices and other field devices encountered in industrial control environments [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF]. Therefore, incidents that fall in the industrial control system malware and accidents categories require the application of industrial control forensic expertise and tools.

Industrial Control System Malware: The Stuxnet malware was developed to target specific industrial control systems. The malware conducted a layered attack against three systems: (i) Windows operating system; (ii) Siemens PCS 7, WinCC and STEP 7 industrial software applications that run on Windows (SCADA system); and (iii) Siemens STEP 7 programmable logic controllers (SCADA system).

Figure 5 provides an overview of the Stuxnet infection. The malware entered and infected a target system via a USB flash drive, following which it searched for, propagated to and infected other target systems. It originally leveraged four zero-day Windows vulnerabilities to propagate and infect systems. Stuxnet was designed to sabotage centrifuges that employ Siemens SCADA systems by reprogramming the programming logic controllers to command the centrifuges to operate outside their designed parameter ranges [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF].

In order to conduct a forensic investigation of a Stuxnet-type incident, incident response personnel must have substantial knowledge about SCADA systems, especially programmable logic controller and field device hardware, firmware and software (applications) as well as SCADA communications protocols. Furthermore, highly specialized techniques and tools are required to collect and analyze data from industrial control devices in a forensically-sound manner.

Accidents: In the case of an accident like the wind turbine fire in The Netherlands discussed above, investigators were required to have adequate industrial control system expertise and sophisticated tools because evidence pertaining to the accident had to be collected from the RAM chip in the programmable logic controller located at the base of the turbine. Therefore, the accident investigators worked closely with professionals from the Netherlands Forensic Institute, Department of Digital Technology and the wind turbine manufacturer to collect and analyze the evidence.

On March 25, 2017, a serious escalator accident occurred in a busy Mong Kok, Hong Kong shopping mall. A 45-meter escalator linking the fourth and eighth floors and carrying about 120 patrons malfunctioned and suddenly moved in the reverse direction, injuring 18 people [START_REF] Sacha | Translatable finite state time machine[END_REF].

The technical investigation report [START_REF]EMSD releases technical investigation report on escalator incident at Langham Place[END_REF] stated that the escalator accident was due to the failure of the main drive chain and a broken chain safety device. There was no overloading of the escalator. The investigators worked closely with escalator workers, a registered escalator engineer, the escalator contractor and personnel from the mall management company to collect evidence for examination.

Investigating incidents involving industrial control systems is not only about finding evidence about potential criminal activities. This is because incidents are often the result of accidents such as equipment malfunctions and fires [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF]. Accident investigators must have adequate technical expertise and the appropriate tools to collect and analyze evidence from industrial control systems that are directly or indirectly connected to accidents, or are proximal to the accidents [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF].

Discussion

This study has some limitations. A large number of industrial control system incidents go unreported and, in other cases, details about the incidents are not published. The number of incident categories proposed depends on the representative incidents considered in the study and different selections of incidents would likely yield different incident categories. Moreover, information about the incidents considered in the study was collected from various sources, and may have various assumptions and biases. All these factors are expected to affect the results of the analysis.

This study reveals that a large proportion of industrial control system incident investigations can be conducted using traditional forensic processes. However, some incidents are more difficult to handle because embedded systems such as programmable logic controllers are specialized devices with their own communications protocols, connection interfaces, operating systems and programming languages [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF]. Therefore, in the case of incidents related to embedded systems, investigators may have to work with experts who have the appropriate tools to collect and analyze data from industrial control equipment. Some tools are able to extract evidence from RAM chips in the devices, but this may not always be done in a forensically-sound manner [START_REF] Van Vliet | Forensics in industrial control system: A case study[END_REF].

Programmable logic controllers are arguably the most important components in industrial control systems. They are attractive targets because successful attacks on programmable logic controllers can result in significant industrial process malfunctions and equipment damage. Each vendor usually provides custom software for programming, communicating and configuring its programmable logic controllers. For example, STEP 7 software running in Windows environments is used to program, communicate with and configure Siemens programmable logic controllers.

The following STEP 7 features are useful in forensic investigations of programmable logic controllers:

Logging communications between a programmable logic controller and STEP 7 software: Communications events of interest include Program Change, Start PLC and Stop PLC (Figure 6). For example, the logged information enables an investigator to identify who changed the control program and when it was changed.

Checking the integrity of the control program in a programmable logic controller:

The control program in a programmable logic controller and the source program in the device used to program it can be compared to identify alterations to the program logic.

Monitoring programmable logic controller inputs/outputs and control program memory addresses:

The inputs/outputs and memory address values provide valuable information about malicious activity.

Monitoring execution time:

A programmable logic controller executes in a cyclic manner. Every cycle has three phases: (i) read inputs; (ii) execute the control program; and (iii) update outputs [START_REF] Sacha | Translatable finite state time machine[END_REF]. A change in the execution time can indicate control program alteration. Other vendors (e.g., Allen Bradley) provide similar software (RSLogix) for their programmable logic controllers. The software is useful for investigating industrial control system incidents involving industrial control system malware and accidents.

The official investigative report [START_REF]EMSD releases technical investigation report on escalator incident at Langham Place[END_REF] on the escalator incident in the Mong Kok, Hong Kong shopping mall attributed the cause to the failure of the main drive chain as well as a broken chain safety device. The main drive chain failure was due to metal fatigue, and the chain safety device malfunction was due to the presence of grease on the sliding surface of the moving part of the device and an improper setting of the compression springs. The incident was classified as an accident and the investigators cooperated with the escalator contractor and manufacturer to collect evidence for analysis. However, the focus was on the mechanical parts of the escalator. Clearly, the investigation would have been more comprehensive by applying digital forensic processes to extract and analyze evidence residing in the controllers.

In order to prepare an efficient plan for industrial control system forensics, incidents should be classified at an early stage if possible. In the case of incidents involving general computer malware or unauthorized access, the investigations can be handled just like they are for incidents involving conventional information technology systems. In the case of incidents involving industrial control system malware and accidents, the investigations must incorporate industrial control system experts, including vendor personnel. The investigators must understand the technical and tactical aspects of industrial control system forensics. Additionally, specialized industrial control system evidence recovery and analysis tools would have to be used in the investigations. The proposed model inserts the incident categorization component before the incident detection component. However, it is not always possible to categorize an incident at an early stage. In such instances, incident categorization can be performed after response initiation, after incident response or after incident recovery, as appropriate. The important point is that, regardless of when incident categorization is performed, it enhances the efficiency of the investigation.

Conclusions

The incident response model presented in this chapter is useful for forensic planning and investigations of industrial control system incidents. The model enables incident response teams and forensic investigators to decide on the expertise, techniques and tools to be applied to ensure sound evidence acquisition, analysis and reporting.

Most investigations of industrial control system incidents tend to focus on malware attacks; this could obscure determinations of other causes of the incidents. The majority of the representative incidents considered in this work (19% + 35% = 54% in Table 3) fall in the general computer malware and unauthorized access categories, which means that they could be investigated using traditional forensic techniques. In the other words, industrial control system experts and specialized tools are not required for all investigations of industrial control system incidents. Robust guidelines and tools are available for such investigations, which greatly simplify incident response.

Another key point is that performing incident categorization early in incident response renders the entire process more effective and efficient. Based on the incident categorization, forensic investigators can decide on the industrial control system expertise, techniques and tools that are required, which reduces the time, effort, costs and resources.

Future research will analyze a comprehensive collection of industrial control system incidents. This research will provide valuable insights into incident handling, enabling the creation of a robust forensic investigation model for industrial control systems.

Figure 2 .

 2 Figure 2. Example industrial control network [4].

Figure 3 .

 3 Figure 3. Cyber incident response model with an embedded forensics component.

Figure 4 .

 4 Figure 4. Refined incident response model with an ICS forensics component.

Figure 5 .

 5 Figure 5. Stuxnet infection.

Figure 6 .

 6 Figure 6. STEP 7 event activity log.

Table 1 .

 1 Selected incidents classified into four categories[START_REF] Carr | Development of a Tailored Methodology and Forensic Toolkit for Industrial Control Systems Incident Response[END_REF][START_REF] Mcmillen | Security Attacks on Industrial Control Systems: How Technology Advances Create Risks for Industrial Organizations[END_REF].

	Type	Category	Year Representative Incident
	Attacks General	2003 The SQL Slammer worm disabled a nuclear
		Computer	power plant in Ohio, USA
		Malware	2003 The Sobig worm was introduced in the CSX
			Railroad headquarters in Florida, USA
			2005 The Zotob worm infected 13 automobile
			plants in Ohio, USA, causing shutdowns
			and delays
			2006 An attacker penetrated a water treatment
			facility network in Pennsylvania, USA
			2014 The modified Gh0st RAT Trojan infected
			a fast-breeder nuclear reactor in Tsuruga,
			Japan
	Attacks Unauthorized 1992 A fired employee hacked into Chevron
		Access	systems in New York and California, USA,
			and reconfigured the emergency alert
			network
			1997 A teenager connected to a dial-up loop
			carrier system servicing an airport in
			Massachusetts, USA and sent a series
			of commands that disabled the system
			2000 A former consultant attacked a sewage
			treatment plant in Maroochy, Australia
			2007 Striking workers (insiders) penetrated
			a traffic system in California, USA
			2008 An attacker used a homemade device to
			remotely derail a train in Lodz, Poland
			2009 A disgruntled former IT contractor
			hacked into leak detection systems on
			multiple oil platforms off the coast
			of California, USA
			2011 A hacker used Shodan to access HMIs in
			a water utility network in Texas, USA
			2013 A sophisticated attacker penetrated the
			U.S. Army Corps of Engineers National
			Inventory of Dams, USA
			2014 A hacker accessed a SCADA server in the
			USA that operated mechanical equipment

Table 2 .

 2 Selected incidents classified into four categories[START_REF] Carr | Development of a Tailored Methodology and Forensic Toolkit for Industrial Control Systems Incident Response[END_REF][START_REF] Mcmillen | Security Attacks on Industrial Control Systems: How Technology Advances Create Risks for Industrial Organizations[END_REF] (continued).

	Type	Category Year Representative Incident
	Attacks	Industrial 2003 An attacker sabotaged a marine terminal
		Control	in Venezuela
		System	2010 The Stuxnet worm destroyed uranium hexa-
		Malware	fluoride centrifuges in Natanz, Iran
			2014 The Havex Trojan entered OPC servers and
			tried to exfiltrate data from industrial
			control systems in the USA and Europe
			2016 The BlackEnergy Trojan caused power outages
			in the Ivano-Frankivsk region of Ukraine
	Accidents Accidents 2013 Two mechanics died in a fire in the nacelle
			of a wind turbine in The Netherlands [12]
			2013 An elevator dropped on its way up a
			building in North Point, Hong Kong [11]
			2014 Nickel sulfate was discharged into a river
			from a mine in Harjavalta, Finland [13]
			2015 Water mixed with molten metal in a foundry

Incident Response Action/Forensic Collection Incident Recovery/Forensic Analysis Incident Closure/Forensic Reporting

	General Comp.	Unauthorized	ICS Malware	Accidents
	Malware	Access
	Malware Analysis
	Check antivirus
	software logs
	Consult security
	software vendors
	Analyze DNS,
	application server
	and network device
	logs

Table 3 .

 3 Summary of industrial control system incidents.

	Category	Incidents (%) Techniques
	General Computer Malware	5 (19%)	Traditional forensics
	Unauthorized Access	9 (35%)
	ICS Malware	6 (23%)	ICS forensics
	Accidents	6 (23%)


Siddharth Dongre

Sumita Mishra

Carol Romanowski

Manan Buddhadev

Chapter 1 QUANTIFYING THE COSTS OF DATA BREACHES

Keywords: Data breaches, cost analysis, providers, consumers

Recent years have seen increases in the number of data breaches. This chapter attempts to quantify the impacts of data breaches in terms of the monetary costs incurred by providers and consumers. This is important because data breaches are a major factor when allocating funds for security controls. Case studies involving the Equifax incident in 2017 and the Target incident in 2013 are employed to demonstrate that the cost impacts of data breaches are significant for providers as well as consumers. The cost components in the overall cost function for providers and consumers are presented. Guided by open-source data, the cost components in the provider portion of the cost function are expressed as best-fit functions of time since the data breach. An important point in the cost quantification is that equal weights are assigned to the costs incurred by the provider and the consumers.

Introduction

The average cost of data breaches has increased by 6.4% during the past year, with an average increase of 4.8% in the cost of each stolen record [START_REF]Cost of a Data Breach Study: Global Overview[END_REF]. These statistics point to a general increase in the cost impacts of data breaches. Clearly, it is imperative to understand the many aspects of data breaches in terms of their cost impacts.

A data breach is defined as an incident that leads to the loss or exposure of sensitive information. The focus of this chapter is on specific data breaches that have exposed personal information such as social security numbers, driver's license information, dates of birth, credit card numbers, telephone numbers and residential addresses, and/or other information that malicious entities could use to perpetrate activities such as identity theft and credit card fraud.

The root causes of data breaches vary from incident to incident. Most data breaches occur due to vulnerabilities in web applications hosted by providers or through cyber-espionage activities [START_REF]Cost of a Data Breach Study: Global Overview[END_REF]. Since the majority of breaches have these two vectors, their costs appear to be more significant to providers than consumers.

Acquisiti et al. [START_REF] Acquisti | Is there a cost to privacy breaches? An event study[END_REF] have analyzed the impact of privacy breaches on the market value of providers. Their research demonstrates that a data breach has a statistically-significant negative impact on the market value of a company on the day that the breach is announced.

Romanosky [START_REF] Romanosky | Examining the costs and causes of cyber incidents[END_REF] has analyzed the causes and costs of cyber incidents in an attempt to understand how companies should improve their security postures in order to reduce the risk of data breaches. He states that public concerns regarding data breaches are excessive compared with the financial impacts on companies.

Most research efforts, including the work of Acquisiti et al. [START_REF] Acquisti | Is there a cost to privacy breaches? An event study[END_REF] and Romanosky [START_REF] Romanosky | Examining the costs and causes of cyber incidents[END_REF], analyze the cost impacts of data breaches on providers. Limited research has focused on the cost impacts on consumers. In contrast, the research described in this chapter considers the cost impacts from the perspectives of providers and consumers. Both providers and consumers have to pay to mitigate the negative effects of data breaches. For example, the Equifax data breach of 2017 cost the company approximately °439 million [START_REF] Pymnts | Equifax breach to cost total of °439M ([END_REF], but numerous Equifax consumers also paid a price by becoming victims of identity theft [START_REF] Mccoy | Equifax data breach: What's changed since last year's huge hack of personal information? USA Today[END_REF] that exposed them to financial losses.

This chapter presents a mathematical formulation that expresses the cost impacts of data breaches. The costs incurred by the provider and consumers have different components, all of which vary with time. Therefore, a cost function for a provider and consumers is developed, which incorporates multiple cost components and weights for the components that vary with time. In the case of providers, the component weights are derived from real data pertaining to the Equifax data breach of 2017 and the Target data breach of 2013. The two case studies were selected because they had significant, direct impacts on providers and consumers, and open-source data related to the breaches and their impacts was available.

Cost Function

The cost impacts of a data breach can be broadly expressed as a function of time C(T ). Specifically, this cost function is the sum of the costs incurred by the provider and by consumers, C p (T ) and C c (T ), respectively, which are also functions of time. The time T denotes the number of months elapsed since the breach was discovered. Unique weights W p ∈ [0, 1] and W c ∈ [0, 1] are assigned to the costs incurred by the provider and by consumers, respectively, based on the relative impacts of the two cost perspectives. Thus, the costs incurred due to a data breach at time T months after the breach is given by:

C(T ) = W p C p (T ) + W c C c (T ) ( 1 )
Each term in Equation ( 1) is expressed as the sum of the individual cost components for the provider and consumers, C pi (T ) and C cj (T ), where 1 ≤ i ≤ N and 1 ≤ j ≤ M , and N and M are the numbers of cost components incorporated for the provider and consumers, respectively.

Thus, the costs incurred by the provider and by consumers are given by:

C p (T ) = N i=1 C pi (T ) ( 2 )
C c (T ) = M j=1 C cj (T ) ( 3 )
Each term C pi (T ) and C cj (T ) can be further expressed as the sum of the costs incurred each month, which varies with time t ∈ [0, T ] expressed in months:

C pi (T ) = T t=0 C pi (t) ( 4 ) C cj (T ) = T t=0 C cj (t) ( 5 )
Equations ( 1) through ( 5) can be combined to yield the following overall cost function for the provider and consumers:

C(T ) = W p N i=1 T t=0 C pi (t) + W c M j=1 T t=0 C cj (t) ( 6 )
where the weights are based on well-defined cost component values C pi and C cj for the provider and consumers, respectively. These cost component values vary on a case by case basis. In this work, the cost component values are assigned based on case studies involving the 2017 Equifax and 2013 Target data breaches.

2017 Equifax Data Breach

Equifax is one of the leading credit reporting agencies along with TransUnion and Experian. It provides important services that determine the creditworthiness of consumers based on their credit histories. The information provided by Equifax is used by lenders to decide whether or not to issue credit lines to consumers and to determine the appropriate credit limits.

In July 2017, Equifax became the victim of one of the largest data breaches in history [START_REF] Gressin | The Equifax Data Breach: What to Do, Federal Trade Commission[END_REF]. The breach was traced to a vulnerability in Equifax's web application systems, which were developed using the Apache Struts 2 framework [START_REF] Luszcz | Apache Struts 2: How technical and development gaps caused the Equifax Breach[END_REF].

In March 2017, a few months before the breach, Apache announced a vulnerability in its technology. However, many users, including Equifax, did not apply the patch. The vulnerability enabled an unknown entity to remotely access Equifax's web application servers and run malicious programs, eventually extracting sensitive data belonging to more than 145 million consumers. Credit card numbers of more than 209,000 consumers were compromised. Private information such as social security numbers, driver's license numbers and dates of birth were also exposed.

Equifax reportedly handled the data breach in an irresponsible manner. It did not notify the affected consumers until two months after the breach was discovered. Equifax executives sold nearly °2 million in stock before the breach was disclosed; however, a special company committee cleared the executives upon finding that they did not know about the breach when they made the transactions [4].

Equifax stock lost billions of dollars within a few months of the announcement of the breach, demonstrating the major impacts that data breaches can have on providers. However, numerous innocent consumers became victims of identity theft and credit card fraud as a result of the breach. Indeed, the Equifax breach is a lesson about the significant impacts that data breaches can have on consumers.

Components Affecting Data Breach Costs

An analysis of corporate filings and news reports in the aftermath of the Equifax data breach identified several components that may affect the costs incurred by providers. Data from Equifax quarterly reports was used to derive the cost function for each component. The cost function formulas were obtained by applying machine learning algorithms to the available data.

Earnings Loss from Customer Dissatisfaction. Equifax reported that its earnings were affected by customer dissatisfaction -its net income fell 27% to °96.3 million in the third quarter of 2017 [START_REF] France-Presse | Massive data breach has cost Equifax nearly °90 million[END_REF]. It is safe to assume that the loss in earnings due to customer dissatisfaction is the highest immediately after a breach and decreases gradually over time.

The four data points in Figure 1 show Equifax's net income (earnings loss) figures for four consecutive quarters after the breach. Based on the variation of net income (earnings loss) C p1 in millions of dollars over time t in months, the following best-fit function was obtained to express the costs due to customer dissatisfaction as a function of time:

C p1 (t) = 165.39 -33t + 3.42t 2 (7)
where the parameters a = 165.39, b = -33 and c = 3.42 are specific to the provider, in this case, Equifax. dropped by °5.3 billion [START_REF] Reklaitis | Equifax's stock has fallen 31% since breach disclosure, erasing °5 billion in market cap[END_REF]. However, after the initial slump, the stock value gradually increased over the next three quarters. The four data points in Figure 2 show Equifax's market capitalization losses from four consecutive quarterly reports after the breach. The costs associated with this component decrease linearly with time. Based on the variation in the market capitalization loss C p2 in billions of dollars over time t in months, the following best-fit function was obtained to express the costs due to investor nervousness as a function of time:

Market Capitalization

C p2 (t) = 5.3 -0.44t (8)
where the parameters c = 5.3 and m = -0.44 are specific to Equifax. Legal and Investigation Fees. The four data points in Figure 3 show Equifax's legal and investigation fees from four consecutive quarterly reports after the breach. Equifax spent °99.4 million in fees during the final quarter of 2017 and °28.9 million during the first quarter of 2018 [START_REF] Heller | Equifax hack could cost well over °600M[END_REF][START_REF] Mccrank | Equifax breach could be most costly in corporate history[END_REF][START_REF] Titanadmin | The cost of the Equifax data breach? °242 million and rising, SpamTitan[END_REF]. The costs associated with this component start low, increase gradually and finally decrease again, which exhibits the characteristics of a Gaussian curve.

Based on the variation in the costs associated with legal and investigation fees C p3 in hundreds of millions of dollars over time t in months, the following best-fit Gaussian function was obtained to express the legal and investigation fees component as a function of time:

C p3 (t) = 1.38 × e -(t-3.93) 2 /2(1.17) 2 (9)
where the parameters a = 1.38, b = -3.93 and c = 1.17 are specific to Equifax.

Customer Services. The four data points in Figure 4 show Equifax's customer services costs from four consecutive quarterly reports after the breach.

Equifax paid approximately °64.4 million for customer support services during the final quarter of 2017 and the payments went down to °4.1 million during the first quarter of 2018 [START_REF] Titanadmin | The cost of the Equifax data breach? °242 million and rising, SpamTitan[END_REF]. This cost component decreases gradually with time in a manner similar to earnings loss due to customer dissatisfaction. Based on the variation in the costs associated with customer services C p4 in millions of dollars over time t in months, the following best-fit function was obtained to express the customer services cost component as a function of time:

C p4 (t) = -0.14 + 64.54 2 t/0.76 [START_REF] Javelin | Identity fraud hits all time high with 16.7 million U.S. victims in 2017, according to new Javelin Strategy and Research study[END_REF] where the parameters a = -0.14, b = 64.54 and c = 0.76 are specific to Equifax. Information Technology Security Upgrades. The four data points in Figure 5 show Equifax's information technology security upgrade costs from four consecutive quarterly reports after the breach. Immediately after the breach was announced, Equifax incurred a one-time charge of °87.5 million, which was presumably spent on incident response and disaster recovery [START_REF] France-Presse | Massive data breach has cost Equifax nearly °90 million[END_REF].

During the last quarter of 2017, a portion of the °99.4 million spent on fees was due to information technology security upgrades; the upgrade costs dropped to °45.7 million during the first quarter of 2018 [START_REF] Titanadmin | The cost of the Equifax data breach? °242 million and rising, SpamTitan[END_REF]. This cost component starts high immediately after the data breach and decreases gradually.

Based on the variation in information technology security upgrade costs C p5 in millions of dollars over time t in months, the following best-fit Gaussian function was obtained:

C p5 (t) = 99.65 × e -(t-1.79) 2 /2(3.79) 2 (11)
where the parameters a = 99.65, b = -1.79 and c = 3.79 are specific to Equifax.

2013 Target Data Breach

Target is one of the largest departmental store chains in the United States. It specializes in fast-moving consumer goods. In December 2013, Target became the victim of a massive data breach in which nearly 40 million credit and debit card numbers, and nearly 70 million personal information records were stolen [START_REF] Shu | Breaking the Target: An Analysis of the Target Data Breach and Lessons Learned[END_REF].

Several security firms analyzed the data breach to determine the root causes. Their reports state that poor network segmentation, a mistake on Target's part and malicious actions by an adversary contributed to the massive data breach. The adversary reportedly installed BlackPOS malware on point-of-sale terminals to collect sensitive user information, especially credit and debit card numbers. The stolen information was discovered being sold on black market websites [START_REF] Krebs | Who's selling credit cards from Target? Krebs on Security[END_REF].

The data breach exposed numerous consumers to identity theft and credit card fraud. It is another example of how the impacts of a data breach on consumers are just as significant as those on the provider.

Components Affecting Data Breach Costs

Since the Target data breach was announced, several reports have been released that estimate the losses incurred by the company. This section discusses the components that affect the costs incurred by Target as a provider.

Earnings Loss from Customer Dissatisfaction. Target's profits reportedly fell by °440 million during the final quarter of 2013, i.e., immediately after the data breach [START_REF] Marketwatch | Target's profits down °440M after data breach[END_REF]. In the final quarter of 2014, Target reported a net loss of °2.6 billion during the one year after the breach [START_REF] Roman | Target breach costs: °162 million. Response expenses continue to grow following 2013 incident, BankInfoSecurity[END_REF]. It can be assumed that this cost component (earnings loss) reached its maximum value in the first quarter after the data breach and decreased sharply over the course of a year.

The four data points in Figure 6 show Target's net income (earnings loss) figures for four consecutive quarters after the breach. Based on the variation of net income (earnings loss) C p1 in billions of dollars over time t in months, the following best-fit Gaussian curve was obtained to express the cost due to customer dissatisfaction as a function of time:

C p1 (t) = 0.91 × e -(t-7.22) 2 /2(3.81) 2 (12)
where the parameters a = 0.91, b = -7.22 and c = 3.81 are specific to Target. Legal Fees and Lawsuit Settlements. Target reportedly made settlements totaling more than °153.9 million through May 2017, almost four years after the breach. The major costs incurred by Target during this period were [START_REF] Lynch | Cost of 2013 Target data breach nears °300 million, Hashed Out[END_REF]:

°10 million to settle a class action lawsuit by consumers in March 2015.

°19 million to MasterCard in April 2015.

°67 million to Visa in August 2015.

°39.4 million to banks and credit unions in December 2015.

°18.5 million to settle actions by 47 state governments in May 2017.

Figure 7 shows the variation in Target's lawsuit settlement costs over a twoyear period starting eighteen months after the breach. It is a classic example of how the costs incurred by a provider due to legal actions arising from a data breach are considerable over a long period of time. However, due to the unpredictable nature of legal settlements, it is difficult to express the associated costs as a function of time. The only statement that can be made is that the legal costs are significant over a long period of time.

Other Expenses. Target's 2016 annual financial report estimated that its total costs due to the data breach were °292 million. The annual breakdowns were °17 million in 2013, °145 million in 2014 and °39 million in 2015; information about the 2016 costs was not provided [START_REF] Lynch | Cost of 2013 Target data breach nears °300 million, Hashed Out[END_REF]. These figures cover the expenses incurred for incident response and forensics, disaster recovery and information security upgrades. Figure shows the variation in Target's other costs (for incident response and forensics, disaster recovery and information security upgrades) over a threeyear period following the data breach. Based on the variation in the other costs C p3 in millions of dollars over time t in months, the following best-fit Gaussian function was obtained to express the cost component as a function of time: C p3 (t) = 148.57 × e -(t-13.44) 2 /2(6.47) 2 [START_REF] Luszcz | Apache Struts 2: How technical and development gaps caused the Equifax Breach[END_REF] where the parameters a = 148.57, b = -13.44 and c = 6.47 are specific to Target.

Cost Impacts on Consumers

Data breaches expose sensitive consumer information such as social security numbers, driver's license information, dates of birth, credit card numbers, telephone numbers and residential addresses. Consumer information of this nature can be exploited to perpetrate identity theft and other fraudulent activities that can have devastating financial impacts on consumers.

It is posited that consumers as a whole incur costs that are comparable to those incurred by the provider as a result of data breaches. Therefore, the weights assigned to the costs incurred by the provider and consumers in Equation ( 6) are equal, i.e., W p = W c = 0.5. Thus, the overall cost function is given by:

C(T ) = 0.5 N i=1 T t=0 C pi (t) + 0.5 M j=1 T t=0 C cj (t) (14)
The following sections discuss four components of the cost function for consumers.

Identity Theft and Credit Card Fraud Costs

Many consumers whose personal data has been exposed by a breach become unwitting victims of identity theft and credit card fraud. In 2016, 15.4 million consumers were victims of identity theft or fraud and they collectively lost more than °16.2 billion. These figures went up in 2017 with 16.7 million victims losing °16.8 billion in total. On average, every consumer who becomes a victim of identity theft or fraud loses more than °1,000 a year [START_REF] Javelin | Identity fraud hits all time high with 16.7 million U.S. victims in 2017, according to new Javelin Strategy and Research study[END_REF]. The costs include notary fees and fax, copying, postage, mileage and calling charges incurred to address identity theft or fraud. The costs also include loss of income as a result of taking time off from work to handle the problems.

Protection and Monitoring Costs

The exposure of personal information puts consumers at risk of becoming targets of identity theft and credit card fraud. Consumers are urged to enroll in credit monitoring and identity protection services, which cost °120 to °300 annually [START_REF]guarding your ID. Do-it-yourself safeguards are just as effective as paid services[END_REF].

Legal Fees

Victims of data breaches have the right to file lawsuits against providers that may be responsible for the breaches. Attorney expenses vary, but are they still relatively high [START_REF] Goguen | How, and How Much, Do Lawyers Charge? Lawyers[END_REF]. Consumers who live in small towns and rural areas may be charged °100 to °200 per hour by experienced attorneys. In metropolitan areas, attorney fees are °200 to °400 per hour. Attorney fees for complicated data breach cases that require technical expertise are even higher.

Other Costs

Consumers who are victims of data breaches are highly susceptible to identity theft and credit card fraud. Most victims are unaware that fraudulent activities are being perpetrated until it is too late; there are cases where even minors have become victims of identity theft or fraud [START_REF] Grant | Identity theft isn't just an adult problem. Kids are victims, too[END_REF].

Identity theft victims should consider freezing their credit, which prohibits credit reporting companies from disclosing their credit histories. This also prevents malicious entities from opening fake credit card accounts in their names. Credit freeze requests can cost consumers °2 to °10 per credit reporting agency [START_REF] Williams | How credit freezes work and what they cost, Credit-Cards.com[END_REF]; several states now ensure that credit freeze requests are free [START_REF] Lobosco | Congress just made credit freezes free[END_REF].

Consumers who become victims of identity theft face the following severe consequences: Difficulty securing credit cards and loans.

Difficulty securing home mortgages and home rentals.

High credit card interest rates.

Difficulty securing jobs.

Psychological impacts such as distress and anxiety.

Conclusions

This research is the first attempt to quantify the costs of data breaches for providers and consumers. This is important because data breaches are a major factor when allocating funds for security controls. The cost components in the overall cost function for the provider and consumers have been identified. Guided by open-source data, the cost components in the provider portion of the cost function have been expressed as best-fit functions of time elapsed since the data breach. An important point in the cost quantification is that equal weights are assigned to the costs incurred by the provider and the consumers.

Future research will attempt to formulate cost components in the consumer cost function as functions of time. This effort will be theoretical as opposed to empirical because of the lack of data pertaining to consumer costs over time.

Figure 1 .Figure 2 .

 12 Figure 1. Variation in Equifax's costs (earnings loss) from customer dissatisfaction.

Figure 3 .

 3 Figure 3. Variation in Equifax's legal and investigation fees.

Figure 4 .Figure 5 .

 45 Figure 4. Variation in Equifax's customer services costs.

Figure 6 .

 6 Figure 6. Variation in Target's costs (earnings loss) from customer dissatisfaction.

Figure 7 .Figure 8 .

 78 Figure 7. Variation in Target's lawsuit settlement costs over four years.