FP7: Critical Infrastructure Protection

(i) Assume that attacks and breaches are unavoidable; focus on how to make systems resilient in spite of them. For instance, extend Recovery Oriented Computing ideas to apply to the security infrastructure. What if instead of a company or country running services on servers, having them run on virtual machines (cf. what Amazon offers with its EC2 service) that run on farms and can be brought up and down at will? If something is attacked, we just bring it down and spawn another pre-configured virtual machine hosting exactly the same services... In sort, combine virtualisation and ROC for security infrastructure.

(ii) Develop a way to map ciritical IT infrastructures. The dependencies are very complex, and therefore you need tools and data to explore what is really critical. Is Vodafone part of Greece's critical infrastructure? Linux? Solaris? MS-DOS? Postgres? So we do a kind of service and artefact dependency analysis, mapping dependencies and criticality indicators/measures not only software but telecom links, hardware facilities, etc. We develop the software and then run a pilot study.