Securing Saudi Arabia’s Smart Cities and Critical Infrastructure Against APTs: A Framework for IoT/OT Forensic Readiness

Abstract

The Vision 2030 of Saudi Arabia has encouraged the development of smart cities by means of all-inclusive integration of Internet of Things (IoT) and Operational Technology (OT) systems. While this transformation is very positive, it also makes critical national infrastructure more vulnerable to advanced cyber threats like Advanced Persistent Threats (APTs). This dissertation demonstrates that while the Kingdom is investing heavily in cybersecurity, there is a major gap in the area of forensic preparedness in these complex IoT/OT environments. The main problem is not only technical, but also related to major legal and procedural ambiguities in the applicable frameworks. This paper conducts a Multi-Vocal Literature Review (MVLR) of Saudi Arabia's Anti-Cyber Crime Law and Personal Data Protection Law (PDPL) to show how laws that are intended for conventional IT are causing challenges for investigators in obtaining digital evidence from Smart City systems. A comparative study of international frameworks, followed by a derived SWOT analysis, characterises a pressing demand for clarity of procedure on a jurisdictional basis. The paper concludes with four useful suggestions for how forensic preparedness practice may be enhanced by addressing these gaps in the law through mandatory 'forensics by design', standardised procedures, and capacity building of locally based expertise. This study contributes to a policy-focused approach to securing smart cities through the inclusion of legal and procedural considerations into the technical cybersecurity strategy for the Kingdom of Saudi Arabia.