The Role of Digital Forensics in Protecting Critical Energy Infrastructure from Cyberattacks
By: Inda Kreso
References
- Abraham, D., Houmb, S.H., Erdodi, L., 2025. Cyberattacks on energy infrastructure – A literature overview and perspectives on the current situation. Applied Sciences 15, 9233. DOI: 10.3390/app15179233.
- Ahmed, I., Obermeier, S., Naedele, M., Richard, G.G., 2012. SCADA systems: Challenges for forensic investigators. Computer (Long Beach Calif) 45, 44–51. DOI: 10.1109/MC.2012.325.
- Akkad, A., Wills, G., Rezazadeh, A., 2023. An information security model for an IoT-enabled smart grid in the Saudi energy sector. Computers and Electrical Engineering 105, 108491. DOI: 10.1016/j.compeleceng.2022.108491.
- Alelyani, S., Kumar, G.R.H., 2018. Overview of cyberattack on Saudi organizations. Journal of Information Security and Cybercrimes Research. DOI: 10.26735/16587790.2018.004.
- Alharbi, F., 2025. Twelve years of cyber resilience: Analyzing cyberattacks in Saudi Arabia (2012–2024). TEM Journal 14, 1791–1807. DOI: 10.18421/TEM142-77.
- Alkhalifa, M., Aljaafari, M., Muzafar, S., 2024. Top 5 deadly cybersecurity threats to Kingdom of Saudi Arabia. Preprints. DOI: 10.20944/preprints202408.2244.v1.
- Al-Mulhim, R.A., Al-Zamil, A., Al-Dossary, F.M., 2020. Cyber-attacks on Saudi Arabia environment. International Journal of Computer Networks and Communications Security 8, 1–7. DOI: 10.47277/IJCNCS/8(3)1.
- Alsaeed, A., 2021. The cyberattack on Saudi Aramco in 2012. Asian Journal of Engineering and Applied Technology 10, 25–28. DOI: 10.51983/ajeat-2021.10.2.3057.
- Arshad, H., Jantan, A. B., Abiodun, O.I., 2018. Digital forensics: Review of issues in scientific validation of digital evidence. Journal of Information Processing Systems 14, 346–376. DOI: 10.3745/JIPS.03.0095.
- Apostolou, B., Apostolou, N., Schaupp, C. L., 2018. Assessing and responding to cyber risk: The energy industry as example. Journal of Forensic & Investigative Accounting 10, 73–94.
- Bakić, B., Milić, M., Antović, I., Savić, D., Stojanović, T., 2021. 10 years since Stuxnet: What have we learned from this mysterious computer software worm? Proceedings of IT 2021. IEEE. DOI: 10.1109/IT51528.2021.9390103.
- Bellamkonda, S., Bellamkonda, S., 2024. Ransomware attacks on critical infrastructure: A study of the Colonial Pipeline incident. International Journal of Research in Computer Applications and Information Technology 7, 1423–1433. DOI: 10.5281/zenodo.14191113.
- Bozhyk, V., Popovych, M., Khakhutsiak, O., Denysenko, M., Herasymenko, O., Law, I., 2025. Evaluating computer forensics for cybercrime investigations in critical infrastructure sectors. Journal of Theoretical and Applied Information Technology 103.
- Carcano, A., Coletta, A., Guglielmi, M., Masera, M., Nai Fovino, I., Trombetta, A., 2011. A multidimensional critical state analysis for detecting intrusions in SCADA systems. IEEE Transactions on Industrial Informatics 7, 179–186. DOI: 10.1109/TII.2010.2099234.
- Cassotta, S., Sidortsov, R., 2019. Sustainable cybersecurity? Rethinking approaches to protecting energy infrastructure. Energy Research & Social Science. DOI: 10.1016/j.erss.2019.01.003.
- Çetinkaya, Ş., Terzi, S., 2024. Analysing the effects of cyber security on national security from a realist perspective: Stuxnet example. Journal of Security Studies 26, 38–51.
- Cusack, B., Mahmoud, A., 2018. Digital forensics investigative framework for control rooms in critical infrastructure. Australian Digital Forensics Conference, 17–23. DOI: 10.25958/5c52674f66685.
- Dimitriadis, A., Ivezic, N., Kulvatunyou, B., Mavridis, I., 2020. Digital forensics framework for investigating cyber attacks. Array 5, 100015. DOI: 10.1016/j.array.2019.100015.
- Dudley, R., Golden, D., 2021. The Colonial Pipeline ransomware hackers had a secret weapon. ProPublica.
- Energy Sector Control Systems Working Group, 2014. Cybersecurity procurement language for energy delivery systems. U.S. Department of Energy.
- Fabro, M., Cornelius, E., 2008. Recommended practice: Creating cyber forensics plans for control systems. Idaho National Laboratory. DOI: 10.2172/944209.
- Gawazah, L., 2024. To pay or not to pay: The U.S. Colonial Pipeline ransomware attack. Arizona State University.
- Hoehn, J.R., 2020. Intelligence, surveillance, and reconnaissance design for great power competition. Congressional Research Service.
- Kilpatrick, T., González, J., Chandia, R., Papa, M., Shenoi, S., 2008. Forensic analysis of SCADA systems and networks. International Journal of Security and Networks 3, 95–102. DOI: 10.1504/IJSN.2008.017222.
- Kilpatrick, T., González, J., Chandia, R., Papa, M., Shenoi, S., 2006. An architecture for SCADA network forensics. Advances in Digital Forensics II. Springer, 273–285. DOI: 10.1007/978-0-387-36891-7_22.
- Lewis, J.A., 2023. Cyberattack on civilian critical infrastructures in a Taiwan scenario. Center for Strategic and International Studies.
- Mittal, S., 2015. The issues in cyber-defence and cyber-forensics of the SCADA systems. Indian Police Journal 62, 29–41.
- Musakhanov, D., 2023. The international consequences of cyber warfare: A study of the Stuxnet case. Acta of Turin Polytechnic University in Tashkent.
- Slowik, J., 2018. Anatomy of an attack: Detecting and defeating CRASHOVERRIDE. Dragos.
- Taleghani, M., Jabreilzadeh Sola, M., 2025. Digital forensics in industrial safety. International Journal of Machine Tools and Maintenance Engineering 6, 22–27. DOI: 10.22271/27074544.2025.v6.i1a.51.
- U.S. Department of Energy, Office of Electricity Delivery and Energy Reliability, Pacific Northwest National Laboratory, 2016. Understanding the special case of digital forensics in energy delivery systems (EDS): Making live analysis work for energy delivery systems. U.S. Department of Energy, Washington, DC.
- Van der Knijff, R., 2014. Control systems forensics: Challenges and solutions for investigating industrial control systems. Digital Investigation 11, 160–174. DOI: 10.1016/j.diin.2014.06.007.
- Wakchaure, M., Sarwade, S., Siddavatam, I., 2016. Reconnaissance of industrial control systems by deep packet inspection. Proceedings of the International Conference on Engineering and Technology (ICETECH). DOI: 10.1109/ICETECH.2016.7569418.
- Yang, Y., McLaughlin, K., Sezer, S., Wang, Y., 2014. Multiattribute SCADA intrusion detection system. IEEE Transactions on Power Delivery 29, 1092–1102. DOI: 10.1109/TPWRD.2014.2300099.
- Zubair, N., Ayub, A., Yoo, H., Ahmed, I., 2022. Remote forensic acquisition of PLC memory in industrial control systems. Forensic Science International: Digital Investigation 40. DOI: 10.1016/j.fsidi.2022.301336.
- Kaplan, F., 2016. Dark Territory: The Secret History of Cyber War. Simon and Schuster, New York.
- Roscini, M., 2014. Cyber Operations and the Use of Force in International Law. Oxford University Press, Oxford.
- Even, S., Siman-Tov, D., 2012. Cyber warfare: Concepts and strategic trends. Institute for National Security Studies Memorandum 117.
- Falliere, N., Murchu, L.O., Chien, E., 2011. W32. Stuxnet dossier. Symantec Security Response.
- Broad, W.J., Markoff, J., Sanger, D.E., 2011. Israeli test on worm called crucial in Iran nuclear delay. New York Times.
- Singer, P., Friedman, A., 2014. Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford University Press, Oxford.
- Belous, A.I., Solodukha, V.A., 2021. Fundamentals of Cybersecurity: Standards, Search, Methods and Media. Tekhnosfera, Moscow.
- Anderson, C., Sadjadpour, K., 2018. Iran's cyber threat. Carnegie Endowment for International Peace.
- Volkova, E., 2020. Cyber attacks as a means of political influence. CyberLeninka.
- International Atomic Energy Agency, 2012. IAEA and Iran: Chronology of key events. IAEA, Vienna.
- Langner, R., 2011. Stuxnet: Dissecting a cyberweapon. IEEE Security and Privacy 9, 49–51.
- Farwell, J.P., Rohozinski, R., 2011. Stuxnet and the future of cyber war. Survival 53, 23–40.
- Garfinkel, S.L., 2010. Digital forensics research: The next 10 years. Digital Investigation 7, S64–S73.
- Eden, P., Blyth, A., Burnap, P., 2017. Cyber-physical systems security: A manufacturing perspective. Computers in Industry 93, 1–10.
- Hosseini, S., Rezaei, M., 2019. Risk assessment in Iranian industrial operations. Journal of Industrial Management Studies 12, 45–60.
- Ministry of Science, Research and Technology, 2021. National digital security strategy report. Tehran.
- National Iranian Electricity Company, 2020. Technical assessment of power plant infrastructure. Tehran.
- Safety Division, Tehran Power Plant, 2023. Safety audit report: Cybersecurity preparedness. Tehran.
- Internal Incident Report, Isfahan Power Plant, 2021. Turbine failure analysis. Isfahan.
- Isfahan Power Plant Maintenance Records, 2022. Annual safety and maintenance summary. Isfahan.
- World Bank, 2023. Energy infrastructure resilience report. Washington, DC.
- Fars News Agency, 2022. Power outages spark protests in southern Iran.
- Braun, V., Clarke, V., 2006. Using thematic analysis in psychology. Qualitative Research in Psychology 3, 77–101.
- Yin, R.K., 2018. Case Study Research and Applications: Design and Methods. Sage Publications, Thousand Oaks.
- American Psychological Association, 2020. Publication Manual of the American Psychological Association, 7th ed. APA, Washington, DC.
- Wu, D., Liu, J., Yang, S., 2018. Cyber-physical security in transportation systems. Transportation Research Part C 92, 214–230.
- Katzman, K., 2022. Iran sanctions. Congressional Research Service Report.
- Reason, J., 2016. Managing the Risks of Organizational Accidents. Routledge, London.
- Energy Delivery Systems Cybersecurity Roadmap Working Group, 2011. Roadmap to achieve energy delivery systems cybersecurity. U.S. DOE.
- Dragos, Inc., 2017. CRASHOVERRIDE analysis report. Dragos Intelligence Report.
- Dragos, Inc., 2018. Lessons learned from CRASHOVERRIDE. Dragos Intelligence Report.
- ProPublica, 2021. Colonial Pipeline ransomware case analysis.
- Congressional Research Service, 2020. Intelligence, surveillance and reconnaissance overview. Washington, DC.
- Arizona State University, 2024. To pay or not to pay: Colonial Pipeline ransomware case study.
- Idaho National Laboratory, 2008. Cyber forensics plans for control systems. INL Report.
- Pacific Northwest National Laboratory, 2016. Live analysis toolkit evaluation for energy delivery systems. PNNL Report.
- U.S. Department of Energy, 2014. Cybersecurity procurement language for energy delivery systems. DOE Report.
- CSIS, 2023. Cyberattack scenarios on civilian infrastructure. Center for Strategic and International Studies.
- IEEE, 2021. Proceedings of IT 2021 conference. IEEE Press.
- Springer, 2006. Advances in Digital Forensics II. Springer, Boston.
- Symantec Security Response, 2011. Stuxnet technical analysis whitepaper.
- Carnegie Endowment for International Peace, 2018. Iran cyber capabilities report.
- Tekhnosfera Publishing, 2021. Cybersecurity standards and practices. Moscow.
Language: English, Slovenian
Page range: 53 - 71
Published on: Sep 30, 2026
Published by: General Staff of the Slovenian Armed Forces
In partnership with: Paradigm Publishing Services
Publication frequency: 4 issues per year
Related subjects:
© 2026 Inda Kreso, published by General Staff of the Slovenian Armed Forces
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.