Threat modeling is a set of methodologies to analyze the potential threats in a digital system, in order to mitigate them. Digital forensics, on the other hand, is used in order to find the true origin of an event with the help of forensic evidence. Digital forensics is based on Locard's Principle and dictates that even digital crime leaves behind some form of remnants. Both the domains, threat modeling and digital forensics, have separately existed, but have to our knowledge not been used together. In this research we establish the importance of forensic evidence and how it can aid threat modeling by providing more comprehensive threat intelligence. We provide practical examples of how the two fields can be combined, based on attack graphs and Bayesian networks.

Entering the era of the Internet of Things, the traditional Computer Forensics is no longer as trivial as decades ago with a rather limited pool of possible computer components. It has been demonstrated recently how the complexity and advancement of IoT are being used by malicious actors attack digital and physical infrastructures and systems. The investigative methodology, therefore, faces multiple challenges related to the fact that billions of interconnected devices generate tiny pieces of data that easily comprehend the Big Data paradigm. As a result, Computer Forensics is no longer a simple methodology of the straightforward process. In this paper, we study the complexity and readiness of community-accepted devices in a smart application towards assistance in criminal investigations. In particular, we present a clear methodology and involved tools related to Smart Applications. Relevant artefacts are discussed and analysed using the prism of the Digital Forensics Process. This research contributes towards increased awareness of the IoT Forensics in the Edge, corresponding challenges and opportunities.

Connectivity as a whole and the Internet of Things (IoT) has influenced a great many things in the past decade. Among those, the most prominent is our daily life routines, which have increasingly started to depend on technology. A Smart Home, being a central part, has gained more importance from a forensic perspective since it affects many lives and can be an easy target for cybercrimes. In this work in progress paper, we explore the feasibility of conducting forensic analysis on different Smart Plugs and what sort of challenges are encountered in such a forensic investigation. We also review current related work for forensic analysis of Smart Plugs.

The omnipresence of smart devices in many aspects of modern everyday life has helped to achieve an enormous level of automation, has ensured sustainable development, and improved quality of life. Over the last decade, such small and portable devices became cheap and easy to deploy in any kind of application. With the full range of versatile connectivity, such technological development also brings multiple challenges related to the security of infrastructure and data. Many individuals, companies, and states worldwide experience the previously unseen scale and scope of the attacks using novel approaches. All these smart applications have also increased the overall attack surface leading to multiple attack vectors available through vulnerabilities. Lack of standards, insufficient security awareness, and new technological landscape does not help either. Considering this, one needs to enhance forensics investigation methodologies, employ novel tools, combine threat intelligence, and integrate forensic readiness. Such measures will help to reduce the total cyber risk through a high level of preparedness for anticipated data-driven crimes in smart applications. We believe that this paper will help in bringing novel focus to existing digital forensics methodologies with a focus on smart applications. 

In today's connected world, there is a tendency of connectivity even in the sectors which conventionally have been not so connected in the past, such as power systems substations. Substations have seen considerable digitalization of the grid hence, providing much more available insights than before. This has all been possible due to connectivity, digitalization and automation of the power grids. Interestingly, this also means that anybody can access such critical infrastructures from a remote location and gone are the days of physical barriers. The power of connectivity and control makes it a much more challenging task to protect critical industrial control systems. This capability comes at a price, in this case, increasing the risk of potential cyber threats to substations. With all such potential risks, it is important that they can be traced back and attributed to any potential threats to their roots. It is extremely important for a forensic investigation to get credible evidence of any cyber-attack as required by the Daubert standard. Hence, to be able to identify and capture digital artifacts as a result of different attacks, in this paper, the authors have implemented and improvised a forensic testbed by implementing a sandboxing technique in the context of real time-hardware-in-the-loop setup. Newer experiments have been added by emulating the cyber-attacks on WAMPAC applications, and collecting and analyzing captured artifacts. Further, using sandboxing for the first time in such a setup has proven helpful.

The global trend is to go digital, in other words go 'smart'. Like the rest of the world getting smarter, so is the power sector hence the term smart power grids and substations. Such capability comes at a price, in this case increasing risk of potential cyber threats to substations. With all such potential risks, it is important that we are able to trace back and attribute any potential threats to its root. In this paper, we're exploring substations to find potential evidences in case a forensic investigation becomes a necessity. Moreover, a forensic experimental test bed is proposed for digital forensic analysis. Finally, a mapping of attack-based forensic evidences is presented.

Forensic Investigations; Forensic Evidence Substation; Wide Area Monitoring Protection and Control; PMUs etc. Abstract The global trend is to go digital, in other words, go 'smart'. Like the rest of the world, power sector is also getting smarter hence the term smart power grids and substations. Such capability comes at the price of heightened risk of potential cyber threats to substations. With all such potential risks, we must be able to trace back and attribute any potential threats to its root. In this paper, we're exploring substations to find potential evidence in case a forensic investigation becomes a necessity. Moreover, a forensic experimental testbed is proposed for digital forensic analysis. Finally, a mapping of attack-based forensic evidence is presented.

The proliferation of intelligent devices has provisioned more functionality in Critical Infrastructures. But the same automation also brings challenges when it comes to malicious activity, either internally or externally. One such challenge is the attribution of an attack and to ascertain who did what, when and how? Answers to these questions can only be found if the overall underlying infrastructure supports answering such queries. This study sheds light on the power sector specifically on smart grids to learn whether current setups support digital forensic investigations or no. We also address several challenges that arise in the process and a detailed look at the literature on the subject. To facilitate such a study our scope of work revolves around substation automation and devices called intelligent electronic devices (IEDs) in smart grids. 

Power systems domain has generally been very conservative in terms of conducting digital forensic investigations, especially so since the advent of smart grids. This lack of research due to a multitude of challenges has resulted in absence of knowledge base and resources to facilitate such an investigation. Digitalization in the form of smart grids is upon us but in case of cyber-attacks, attribution to such attacks is challenging and difficult if not impossible. In this research, we have identified digital forensic artifacts resulting from a cyber-attack on Wide Area Monitoring, Protection and Control (WAMPAC) systems, which will help an investigator attribute an attack using the identified evidences. The research also shows the usage of sandboxing for digital forensics along with hardware-in-the-loop (HIL) setup. This is first of its kind effort to identify and acquire all the digital forensic evidences for WAMPAC systems which will ultimately help in building a body of knowledge and taxonomy for power system forensics.

Smart grid improves and revolutionizes the way how energy is generated, distributed and consumed. Despite utilization of such technologies for better life of end-users and communities, there might be outlier events happening that will introduce disturbance to the smart grids. To mitigate impact from such events in power grid, particularly in Wide Area Monitoring Protection and Control (WAMPAC) has been introduced for mitigation and prevention of large disruption and extreme events. Large network of interconnected devices is being monitored through WAMPAC sub-system to avoid major events with negative impact through analysis of system-wide contextual information. The assessment of the state is being made based on the data from Phasor Measurement Unit (PMUs) collected and processed in the Phasor Data Concentrator (PDC). There is an enormous amount of Machine-to-Machine (M2M) communication that the system has to analyze. However, blackout prediction and mitigation is done using measurements data and does not necessarily focus on more high level adversarial events. This paper proposes an ongoing research into timely detection of adversarial attack on the power grid.  During the experimental phase, authentication attack scenario was successfully executed on power substation setup. Further, framework for intelligent identification of digital evidences related to attack was suggested unveiling possibility for crime investigations preparedness.