FP7: Critical Infrastructure Protection: Difference between revisions

From Istlab
Jump to navigationJump to search
← Older edit
Content deleted Content added
Louridas (talk | contribs)
84 edits
No edit summary
Stheotok (talk | contribs)
99 edits
 
(3 intermediate revisions by one other user not shown)
Line 3: Line 3:
* [[Mapping Critical IT Infrastructures]]
* [[Mapping Critical IT Infrastructures]]
* [[PROMIS]]
* [[PROMIS]]
* [[Reliability Evaluation of Free / Open Source / Libre Software]]
* [[Telemonitoring System for Remote Power Plants]]
* [[WRC]]: Wireless Research Center


== Call ==
== Call ==
Line 10: Line 9:
* [[CallDetails-ICT-SEC-2007.1.7]]: Call details
* [[CallDetails-ICT-SEC-2007.1.7]]: Call details


== Partners ==


* [[ICT-SEC-2007.1.7 Partners Table]]







==Reliability Evaluation of Free / Open Source / Libre Software==

The interoperability and inter-connectivity of communication networks are is
one of the cornerstones of our society. All workings of today's society, be
them financial transactions, interpersonal communications, health care provision or
knowledge acquisition, are heavily dependent on telecommunications network
meshes, able to transfer information in real time. As control of those
infrastructures is increasingly left over to complex software systems, our
society is increasingly dependent on the security and quality of the
construction of this software.

On the other hand, FLOSS (free / libre / open source software) is quickly
becoming a key component of critical infrastructures and therefore an
important factor of the ICT sector in the EU. FLOSS is expected to be present
in many different products and systems in the EU in the near future.
However, while some well known FLOSS packages, such as the Apache web
server and the Linux kernel, have a proved security record, a great number of
other FLOSS programs is in use, without their users knowing their security
properties. This situation is even more pronounced in the case of proprietary software.
Large scale users base their IT decisions for critical infrastructures on
word-of-mouth recommendations and have trust software houses based on their
reputation, rather than utilising independent and objective security evaluations.
The scientific community has long been studying the issue of
software security. Tools to detect common problems in both code and program
runtime are widely available, both as FLOSS and as commercial products.
Also, a number of security provisioning method are available and cover
all the phases of the development of information systems.

The <PROJECT_ACRONYM> project aims to bridge the gap between the availability
of tools and methodologies and the absence of their application on the
field of critical information systems. Our goal is to build a platform that
integrates existing security-related tools and using well established
methodologies it will allow for the scientific evaluation of the security
of critical software. Our particular focus will be the field of FLOSS,
as the availability of the source code will allow us to develop in-depth
evaluation methods.

More specifically, we plan to develop:

* Integrated tools that assess the security of software projects
* A classification of security-evaluated projects
* An integrated method for performing security evaluations of software

Using a large set of projects, of a different kind (operating systems, web
servers etc), the security of different products
will be measured. Those products will be classified by field of application,
and by their security metrics. Depending on the field of application, the risk
associated to each possible security flaw will be evaluated. The consequences
of that flaw will be evaluated as well. With that information, a ranking of
products will be made. This ranking will be useful to certificate FLOSS
products for different fields of application, and also as a roadmap in order to
fix those products that are the least secure.
For the measurement system, existing tools will be evaluated, and when the
needs of the system may not be covered with existing alternatives, new tools
will be developed.

Our proposed work will build upon two currently running,
FP6-funded projects, FLOSSMETRICS and SQO-OSS. FLOSSMETRICS [1] has
build a comprehensive database of software quality related metrics for
a great number of projects and will function as our source of raw data.
On the other hand, the SQO-OSS plug-in based software evaluation
platform [2] will be the basis for the software we are planning to develop.
The integration of the quality metrics tools from FLOSSMETRICS project and the
security tools that will be developed for <PROJECT_ACRONYM> on the SQO-OSS
tool, will effectively create a tool for the holistic evaluation of software
quality and security, which will allow critical IS implementers to choose
from the best available projects.

All the software produced by this research
project will be released in the public domain under the European Public License (EUPL).

'''What we need from you'''

The <PROJECT_ACRONYM> project is a research proposal being submitted
for the first time. We plan to carry out the major parts of the write-up
using the resources of URJC and AUEB, although help from partners will be greatly
appreciated. We expect our partners to contribute their opinions in areas
of their particular expertise and to formally review the proposal before it
is being submitted.


'''Further information and communication'''
This proposal is co-ordinated by the <LAB> of the <UNI>, directed by Jesus Gonzalez Barajona
<MAIL>, <TEL>, <WEB> etc. The Information Systems Laboratory of the Department of the Athens
University of Economics and Business, directed by Diomidis Spinellis, will be participating
in the proposal preparation.

[1] - Flossmetrics: http://www.flossmetrics.org
[2] - SQO-OSS: http://www.sqo-oss.eu

Latest revision as of 06:41, 12 October 2007

Project Proposals

Call

Partners

Retrieved from "https://istlab.dmst.aueb.gr/wiki/index.php?title=FP7:_Critical_Infrastructure_Protection&oldid=2516"