Today, attackers are using more sophisticated technologies, making existing “add-on” security solutions obsolete or insufficient, and the number of stakeholders involved –both human and machines– is always increasing. Thus, design and embedding of new security mechanisms directly into the systems is needed to drastically increase reliability and security levels and provide higher levels of resilience.
To make the current situation even more challenging, the global financial crisis has imposed unprecedented budgetary restrictions to both the public and private sectors. This means that any new security solution must be both technically efficient and financially cost-effective, facilitating the protection of previous investments and the flexible incremental evolution of the security systems protecting European CI.
To tackle these challenges, PRECYSE will define, develop and validate a methodology, an architecture and a set of technologies and tools to improve –by design– the security, reliability and resilience of the ICT systems supporting the Critical Infrastructures (CI).
It will build on previous research and existing standards and will pay due attention to performance demands of current CI systems, as well as to relevant privacy, legal and ethical issues.
The solutions proposed by PRECYSE will be validated in two demonstrations in the domains of transport and energy. All the process will be strongly user-driven, with not only two high profile user organisations forming part of PRECYSE consortium, but also a powerful User Group which spans through multiple application domains –energy, transport, defence and police forces, utilities, public authorities, etc.- and all European regions, from Southern Europe to Scandinavia. The project will carry out a strong community building effort and activities aimed at preparing the large-scale adoption of the project results.
Cyber security for infrastructure
An EU group is helping to secure critical infrastructure (CI) control systems against future cyberattacks. The integrated systems will rely on new methodologies and software architectures, providing improved threat detection and response.
In recent years, securing CI has become a priority, made more difficult by the increasing sophistication of computer attacks. Add-on security solutions are generally ineffective, necessitating new security measures integrated directly into the control systems.
Developing such measures is the goal of the EU-funded 'Prevention, protection and reaction to cyber-attacks to critical infrastructures' (PRECYSE) project. In order to secure Europe's CI management computers, the nine-member consortium aims to develop and validate its methodology, architecture and tools. The project's first year of three entailed specification and design, with later phases to include implementation and demonstration/dissemination. PRECYSE concludes in February 2015.
During the first reporting period, work focused on identifying scenarios to be investigated, and on defining the work structure breakdown. Hence, the group produced the first draft of the reference architecture. The document defines the components and concepts to be developed, and their relationships.
In parallel, the team established the fundamentals of its security methodology. The combined framework for methodology and security services is expected to have been completed during the first part of the second year.
PRECYSE will contribute to improved security resilience of the computer systems supporting European CI. The resulting systems will also allow superior detection of and response to cyber threats.