# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.3. DFIR Analysis  
Digital forensics forms a substantial part of IR in the cybersecurity sector; it is a recognised scientific methodology with a key focus on the process and verifiable conclusions. Although several published digital investigation models outline the steps for investigation by the forensic teams, there is no single uniform IR model. The simplest lifecycle for an investigation model consists of three stages, \"acquisition\", \"analysis\" and \"reporting\". However, with the increased penetration of digital technologies into modern lives, there were several revisions to the investigation stages. The U.S. Department of Justice (DoJ) proposed four-stage process consisting of \"acquisition\", \"identification\", \"evaluation\" and \"admission as evidence\" [138]; the DFRWS model consists of six phases namely \"identification\", \"preservation\", \"collection\", \"examination\", \"analysis\" and \"presentation\" [139]. The ADFM has expanded the process by three more stages: \"preparation\", \"approach strategy\" and \"returning evidence\" [140]. Due to the evolving sources of digital evidence, the digital and physical environments are closely converged where physical artefacts contain the digital evidence, which is reflected in the Integrated Digital Investigation Process (IDIP) consisting of five stages defined as \"readiness\", \"deployment\", \"physical crime scene\", \"digital crime scene\" and \"review\" [141]. Similar to the DFRWS model, the ISO/IEC 27050-3:2017, a general-purpose framework for electronically stored information (ESI) was developed for digital investigations containing seven stages: \"identification\", \"preservation\", \"collection\", \"processing\", \"analysis\", \"review\" and \"production\". The National Institute for Standards and Technology published an IR procedure NIST 800-61 in response to the frequency of emerging incidents consisting of four stages: \"preparation\", \"detection and analysis\", \begin{table}
\begin{tabular}{c c} \hline \hline
**Threat Type** & **Primary Studies** \\ \hline Internal and External Threat & [33, 51, 63, 100, 109, 110, 114, 119, 120, 130] \\ External Threat & [38, 65, 99, 104, 108, 111, 113, 115, 118, 121, 137] \\ Internal Threat & [22, 61, 65, 102, 104, 131, 135, 138] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Primary studies categorisation by adversary threat type. Figure 8: Adversary type threat factor categorisation of smart sectors addressed by the primary studies. In this graph, multiple sectors addressed in a single study are reported individually to preserve sector visibility. \"containment, eradication and recovery\" and finally \"post-incident activity\". In CPSs, IR is a complex, multifaceted problem crossing the physical and cybersecurity boundaries. The primary studies were classified by their key themes into groups according to the NIST 800-61 IR stages [98]. The studies were determined to have focused predominantly on the detection and analysis stage, as shown in Table 8.  
**Preparation** is an important part of the IR. Apart from compiling assets, creating a communication plan, setting metrics or creating an incident plan for each type of incident, security event simulation is also a valuable part of this stage. Simulation or modelling helps identify gaps, determine and optimise which security events and at what trigger should be investigated; therefore, they provide a controlled opportunity to strengthen weaker areas and improve cyber resilience, which we discussed in the previous section. For example, the author in reference [13] proposed a novel framework using Fuzzy Analytic Hierarchy Process to evaluate and rank the cybersecurity challenges in smart cities. Amongst the 9 identified smart sectors (factors) and 32 sub-factors, smart security was rated highest for being influenced by cybersecurity challenges in smart cities.