FP7: Critical Infrastructure Protection - Revision history

Stheotok: /* Project Proposals */

2007-10-12T04:41:28Z

Project Proposals

← Older revision		Revision as of 06:41, 12 October 2007
Line 3:		Line 3:
	* [[Mapping Critical IT Infrastructures]]		* [[Mapping Critical IT Infrastructures]]
	* [[PROMIS]]		* [[PROMIS]]
	* [[Telemonitoring System for Remote Power Plants]]
	* [[Reliability Evaluation of Free / Open Source / Libre Software]]		* [[Reliability Evaluation of Free / Open Source / Libre Software]]

Louridas at 14:21, 19 September 2007

2007-09-19T14:21:56Z

← Older revision		Revision as of 16:21, 19 September 2007
Line 9:		Line 9:

	* [[CallDetails-ICT-SEC-2007.1.7]]: Call details		* [[CallDetails-ICT-SEC-2007.1.7]]: Call details

			== Partners ==

			* [[ICT-SEC-2007.1.7 Partners Table]]

Louridas: /* Reliability Evaluation of Free / Open Source / Libre Software */

2007-09-19T14:02:02Z

Reliability Evaluation of Free / Open Source / Libre Software

← Older revision		Revision as of 16:02, 19 September 2007
Line 9:		Line 9:

	* [[CallDetails-ICT-SEC-2007.1.7]]: Call details		* [[CallDetails-ICT-SEC-2007.1.7]]: Call details









	==Reliability Evaluation of Free / Open Source / Libre Software==

	The interoperability and inter-connectivity of communication networks are is
	one of the cornerstones of our society. All workings of today's society, be
	them financial transactions, interpersonal communications, health care provision or
	knowledge acquisition, are heavily dependent on telecommunications network
	meshes, able to transfer information in real time. As control of those
	infrastructures is increasingly left over to complex software systems, our
	society is increasingly dependent on the security and quality of the
	construction of this software.

	On the other hand, FLOSS (free / libre / open source software) is quickly
	becoming a key component of critical infrastructures and therefore an
	important factor of the ICT sector in the EU. FLOSS is expected to be present
	in many different products and systems in the EU in the near future.
	However, while some well known FLOSS packages, such as the Apache web
	server and the Linux kernel, have a proved security record, a great number of
	other FLOSS programs is in use, without their users knowing their security
	properties. This situation is even more pronounced in the case of proprietary software.
	Large scale users base their IT decisions for critical infrastructures on
	word-of-mouth recommendations and have trust software houses based on their
	reputation, rather than utilising independent and objective security evaluations.

	The scientific community has long been studying the issue of
	software security. Tools to detect common problems in both code and program
	runtime are widely available, both as FLOSS and as commercial products.
	Also, a number of security provisioning method are available and cover
	all the phases of the development of information systems.

	The <PROJECT_ACRONYM> project aims to bridge the gap between the availability
	of tools and methodologies and the absence of their application on the
	field of critical information systems. Our goal is to build a platform that
	integrates existing security-related tools and using well established
	methodologies it will allow for the scientific evaluation of the security
	of critical software. Our particular focus will be the field of FLOSS,
	as the availability of the source code will allow us to develop in-depth
	evaluation methods.

	More specifically, we plan to develop:

	* Integrated tools that assess the security of software projects
	* A classification of security-evaluated projects
	* An integrated method for performing security evaluations of software

	Using a large set of projects, of a different kind (operating systems, web
	servers etc), the security of different products
	will be measured. Those products will be classified by field of application,
	and by their security metrics. Depending on the field of application, the risk
	associated to each possible security flaw will be evaluated. The consequences
	of that flaw will be evaluated as well. With that information, a ranking of
	products will be made. This ranking will be useful to certificate FLOSS
	products for different fields of application, and also as a roadmap in order to
	fix those products that are the least secure.
	For the measurement system, existing tools will be evaluated, and when the
	needs of the system may not be covered with existing alternatives, new tools
	will be developed.

	Our proposed work will build upon two currently running,
	FP6-funded projects, FLOSSMETRICS and SQO-OSS. FLOSSMETRICS [1] has
	build a comprehensive database of software quality related metrics for
	a great number of projects and will function as our source of raw data.
	On the other hand, the SQO-OSS plug-in based software evaluation
	platform [2] will be the basis for the software we are planning to develop.
	The integration of the quality metrics tools from FLOSSMETRICS project and the
	security tools that will be developed for <PROJECT_ACRONYM> on the SQO-OSS
	tool, will effectively create a tool for the holistic evaluation of software
	quality and security, which will allow critical IS implementers to choose
	from the best available projects.

	All the software produced by this research
	project will be released in the public domain under the European Public License (EUPL).

	'''What we need from you'''

	The <PROJECT_ACRONYM> project is a research proposal being submitted
	for the first time. We plan to carry out the major parts of the write-up
	using the resources of URJC and AUEB, although help from partners will be greatly
	appreciated. We expect our partners to contribute their opinions in areas
	of their particular expertise and to formally review the proposal before it
	is being submitted.


	'''Further information and communication'''
	This proposal is co-ordinated by the <LAB> of the <UNI>, directed by Jesus Gonzalez Barajona
	<MAIL>, <TEL>, <WEB> etc. The Information Systems Laboratory of the Department of the Athens
	University of Economics and Business, directed by Diomidis Spinellis, will be participating
	in the proposal preparation.

	[1] - Flossmetrics: http://www.flossmetrics.org
	[2] - SQO-OSS: http://www.sqo-oss.eu

Louridas: /* Project Proposals */

2007-09-19T14:01:53Z

Project Proposals

← Older revision		Revision as of 16:01, 19 September 2007
Line 4:		Line 4:
	* [[PROMIS]]		* [[PROMIS]]
	* [[Telemonitoring System for Remote Power Plants]]		* [[Telemonitoring System for Remote Power Plants]]
			* [[Reliability Evaluation of Free / Open Source / Libre Software]]
	* [[WRC]]: Wireless Research Center

	== Call ==		== Call ==

Louridas at 14:01, 19 September 2007

2007-09-19T14:01:35Z

← Older revision		Revision as of 16:01, 19 September 2007
Line 1:		Line 1:
	ideas we have:

	== Project Proposals ==		== Project Proposals ==
	* [[RedZone]]		* [[RedZone]]

Louridas: /* Telemonitoring system for remote power plants (need work). Call Details: Objective ICT-2007.6.3: ICT for Environmental Management and Energy Efficiency) */

2007-09-19T14:00:29Z

Telemonitoring system for remote power plants (need work). Call Details: Objective ICT-2007.6.3: ICT for Environmental Management and Energy Efficiency)

← Older revision		Revision as of 16:00, 19 September 2007
Line 18:		Line 18:


	==Telemonitoring system for remote power plants (need work). Call Details: Objective ICT-2007.6.3: ICT for Environmental Management and Energy Efficiency)==

	There is the ICT Call 2 for Environment with deadline October 9th. There is interest from a Greek company involved with solar plants and stuff, as well as SINGULAR, to propose something along the lines of a telemonitoring system for remote power plants. I very briefly looked in the internet, and there is some information, relevant projects and systems etc. I could not, by myself, undertake the preparation of such a proposal, but if I had some help from someone else in the group, we could go for it, it would be interesting. Bare in mind (i've been following this a little), that a great "boom" in renewable energy investments is expected soon, and it could very well be that the outcome of such a project could be a very interesting commercial project (don't laugh, i'm the first to criticize the outcome of all EU funded projects, but this time it's really well positioned in time and geographically). So if there is interest in this, and someone is willing to start right away working on consortium and proposal preparation with me, let me know. We are talking about a STREP, so I guess 5-6 partners (we already have AUEB, SINGULAR, and ENOLIA, this company I've mentioned from Greece, so I think everyone else should be from Europe, I have a couple of potential contacts already), and about 2MEuros or so... Perhaps we can make Singular coordinators and avoid some of the accounting hussle

	===Possible Partners===

	* SINGULAR
	* ENOLIA
	* http://www.solarsat.eu/
	* Fraunhofer ISE - Fraunhofer Institute for Solar Energy Systems ( http://www.ise.fhg.de/ )
	* www.flyby.it

Louridas: /* Project Proposals */

2007-09-19T14:00:15Z

Project Proposals

← Older revision		Revision as of 16:00, 19 September 2007
Line 5:		Line 5:
	* [[Mapping Critical IT Infrastructures]]		* [[Mapping Critical IT Infrastructures]]
	* [[PROMIS]]		* [[PROMIS]]
			* [[Telemonitoring System for Remote Power Plants]]
	* [[SENSE]]: Software Engineering and Security
	* [[WRC]]: Wireless Research Center		* [[WRC]]: Wireless Research Center

Louridas: /* A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks */

2007-09-19T13:59:30Z

A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks

← Older revision		Revision as of 15:59, 19 September 2007
Line 15:		Line 15:



	==A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks==

	The promis project has moved. [[PROMIS]]

Louridas: /* Project Proposals */

2007-09-19T13:59:07Z

Project Proposals

← Older revision		Revision as of 15:59, 19 September 2007
Line 4:		Line 4:
	* [[RedZone]]		* [[RedZone]]
	* [[Mapping Critical IT Infrastructures]]		* [[Mapping Critical IT Infrastructures]]
			* [[PROMIS]]
	* [[OIS]]: Organizational Information Systems
	* [[SENSE]]: Software Engineering and Security		* [[SENSE]]: Software Engineering and Security
	* [[WRC]]: Wireless Research Center		* [[WRC]]: Wireless Research Center

Louridas: /* Web Applications Security */

2007-09-19T13:58:37Z

Web Applications Security

← Older revision		Revision as of 15:58, 19 September 2007
Line 14:		Line 14:


	==Web Applications Security==
	'''(iii)''' Web applications security is constantly gaining the interest of research community, as the existence of web applications is getting ubiquitous, and new threats to the critical infrastructure are introduced. Ajax security, XSS, CSRF, to name a few, even traditional security people fail to understand and protect against these, or new attack vectors created by the complex nature of web applications. What I see missing is a well defined framework and/or the static analysis tools required to test applications and find vulnerabilities. Discovering and fixing such vulnerabilities is a great move towards more secure infrastructure. (mgogoulos)

	''Are you talking about some kind of Web 2.0 Security Infrastructure here?''
	Not necessarily, web application security issues affects all web services, but since Web 2.0 technologies are more complicated our work can be valuable to either traditional Web or Web 2.

	===Cons===

	There is an interest lately in related matters, e.g., AJAX security, see [http://www.oreilly.com/catalog/9780596529314/]. How do we differentiate from that?

	===Possible Partners===

	==A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks==		==A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks==