FP7: Critical Infrastructure Protection: Difference between revisions

From Istlab
Jump to navigationJump to search
← Older editNewer edit →
Content deleted Content added
Louridas (talk | contribs)
84 edits
Louridas (talk | contribs)
84 edits
Line 11: Line 11:


* [[CallDetails-ICT-SEC-2007.1.7]]: Call details
* [[CallDetails-ICT-SEC-2007.1.7]]: Call details

==Mapping Critical IT Infrastructures==

Develop a way to map critical IT infrastructures. The
dependencies are very complex, and therefore you need tools and data
to explore what is really critical. Is Vodafone part of Greece's
critical infrastructure? Linux? Solaris? MS-DOS? Postgres? So we do a
kind of service and artefact dependency analysis, mapping dependencies
and criticality indicators/measures not only software but telecom
links, hardware facilities, etc. We develop the software and then run
a pilot study. Our proposed approach differs from automatic vulnerability analysis, because we follow and explore the effect of dependencies, rather than primary vulnerabilities.

How do we measure criticality? I can come up with two dimensions:

# The amount of infrastructure affected. If we map the infrastructure on a graph, it is clear that some nodes are more central than others. This has been explored at length in scale-free networks research, providing grounding why the internet is vulnerable to targeted attacks.
# The exact effects on the affected infrastructure. A slight performance degradation is not the same as a crash.

In software, it has long since been observed that not all bugs are worth fixing, as they
may never produce a failure. This observations may extend to whole security infrastructures,
and perhaps this is what we are aiming at here?

===Cons===
The importance of this proposal is, at least to me, self-evident, but I was wondering if this information should be made public. Identifying the most critical nodes in every complex system, is like pinpointing the most valuable targets for adversaries wanting to wreck havoc. Nonetheless I would love to work in that proposal…

===Possible Partners===


===Cover Letter===

'''Mapping Critical IT Infrastructures and their Dependencies'''

Department of Management Science and Technology
Athens University of Economics and Business

STREP proposal (FP7/ICT)
Strategic Objective: ICT-SEC-2007.1.7: Critical Infrastructure Protection (Joint Call between ICT and Security Themes FP7-ICT-SEC-2007-1)

Communication systems, supply systems, services, form complex interconnected infrastructure networks whose functioning is fundamental for our
society. Infrastructure networks are vulnerable both to malicious attacks and to accidental malfunction; in recent years, in various countries, we have seen examples of commodity infrastructures such as telecommunications, transportation, or power supply networks that were attacked or failed accidentally leading to loss of their availability. In several of these cases large parts of the attacked systems were adversely affected due to domino-like effects: failure in a system component had far reaching rippling effects that had not been predicted, as the criticality of infrastructure components, and the possibilities for damage propagation had not been assessed.

Information and Communication Technology (ICT) infrastructures are becoming more and more complex, not only because their size grows daily but also (mostly) due to their interconnected nature and the fact that we are moving towards the unification of such networks (e.g., data and voice networks). It is therefore becoming more difficult to efficiently monitor their operation, master their vulnerabilities, prevent against the cascading effects of failures and provide recovery and continuity in critical scenarios. Tools are needed in order to explore and map the dependencies between the parts of these systems in order to identify the ones that are critical. If failures are inevitable, it is necessary to know the extent of the expected damage, in order to prepare the most adequate reaction.

The proposed project aims to deliver algorithms and tools for mapping and exploring dependencies between the different artefacts and components that ICT infrastructures are made of and identifying/examining criticality measures for each one. This includes not just hardware or software but also service provisioning (e.g., power supply, telecommunication links, Web Services). The project's macro level goal is not to create a tool that automatically detects vulnerabilities and proposes countermeasures, but to follow and explore the effect of dependencies between the various components of a system that is geographically dispersed and relies on the availability of various service providers in order to operate. In this way we will be able to predict the extent of the damage that may result from a malfunctioning component in an infrastructure network. The dependencies and probabilities about the spread of damage will be visualised to aid decision making; for instance, our tools will produce graphical overlays on infrastructure maps.

The project's software deliverables will be available for internal use by the project's partners and in the future could become part of or form the basis of novel products and business solutions. Scientific contributions will be exploited by means of journal articles and conference publications. Licensing and commercial exploitation of research results will be discussed during the proposal preparation phase.

'''What we need from you'''

This project is a research proposal being submitted for the first time. We plan to carry out the major parts of the write-up using our own resources, although help from partners will be greatly appreciated. We expect our partners to contribute their opinions in areas of their particular expertise and to formally review the proposal before it is submitted.

Further information and communication

This proposal is initiated by the Software Engineering and Security Group of the Information Systems Technology Laboratory, directed by Diomidis Spinellis (http://www.dmst.aueb.gr/dds/), hosted by the Department of Management Science and Technology at the Athens University of Economics and Business.

Our website: http://istlab.dmst.aueb.gr.
Contact us by email at circular@aueb.gr .




Revision as of 15:56, 19 September 2007

ideas we have:

Project Proposals

Call


Web Applications Security

(iii) Web applications security is constantly gaining the interest of research community, as the existence of web applications is getting ubiquitous, and new threats to the critical infrastructure are introduced. Ajax security, XSS, CSRF, to name a few, even traditional security people fail to understand and protect against these, or new attack vectors created by the complex nature of web applications. What I see missing is a well defined framework and/or the static analysis tools required to test applications and find vulnerabilities. Discovering and fixing such vulnerabilities is a great move towards more secure infrastructure. (mgogoulos)

Are you talking about some kind of Web 2.0 Security Infrastructure here? Not necessarily, web application security issues affects all web services, but since Web 2.0 technologies are more complicated our work can be valuable to either traditional Web or Web 2.

Cons

There is an interest lately in related matters, e.g., AJAX security, see [1]. How do we differentiate from that?

Possible Partners

A PROactive Malware Identification System (PROMIS) based on Peer-to-Peer Networks

The promis project has moved. PROMIS


Telemonitoring system for remote power plants (need work). Call Details: Objective ICT-2007.6.3: ICT for Environmental Management and Energy Efficiency)

There is the ICT Call 2 for Environment with deadline October 9th. There is interest from a Greek company involved with solar plants and stuff, as well as SINGULAR, to propose something along the lines of a telemonitoring system for remote power plants. I very briefly looked in the internet, and there is some information, relevant projects and systems etc. I could not, by myself, undertake the preparation of such a proposal, but if I had some help from someone else in the group, we could go for it, it would be interesting. Bare in mind (i've been following this a little), that a great "boom" in renewable energy investments is expected soon, and it could very well be that the outcome of such a project could be a very interesting commercial project (don't laugh, i'm the first to criticize the outcome of all EU funded projects, but this time it's really well positioned in time and geographically). So if there is interest in this, and someone is willing to start right away working on consortium and proposal preparation with me, let me know. We are talking about a STREP, so I guess 5-6 partners (we already have AUEB, SINGULAR, and ENOLIA, this company I've mentioned from Greece, so I think everyone else should be from Europe, I have a couple of potential contacts already), and about 2MEuros or so... Perhaps we can make Singular coordinators and avoid some of the accounting hussle

Possible Partners


Reliability Evaluation of Free / Open Source / Libre Software

The interoperability and inter-connectivity of communication networks are is one of the cornerstones of our society. All workings of today's society, be them financial transactions, interpersonal communications, health care provision or knowledge acquisition, are heavily dependent on telecommunications network meshes, able to transfer information in real time. As control of those infrastructures is increasingly left over to complex software systems, our society is increasingly dependent on the security and quality of the construction of this software.

On the other hand, FLOSS (free / libre / open source software) is quickly becoming a key component of critical infrastructures and therefore an important factor of the ICT sector in the EU. FLOSS is expected to be present in many different products and systems in the EU in the near future. However, while some well known FLOSS packages, such as the Apache web server and the Linux kernel, have a proved security record, a great number of other FLOSS programs is in use, without their users knowing their security properties. This situation is even more pronounced in the case of proprietary software. Large scale users base their IT decisions for critical infrastructures on word-of-mouth recommendations and have trust software houses based on their reputation, rather than utilising independent and objective security evaluations.

The scientific community has long been studying the issue of software security. Tools to detect common problems in both code and program runtime are widely available, both as FLOSS and as commercial products. Also, a number of security provisioning method are available and cover all the phases of the development of information systems.

The <PROJECT_ACRONYM> project aims to bridge the gap between the availability of tools and methodologies and the absence of their application on the field of critical information systems. Our goal is to build a platform that integrates existing security-related tools and using well established methodologies it will allow for the scientific evaluation of the security of critical software. Our particular focus will be the field of FLOSS, as the availability of the source code will allow us to develop in-depth evaluation methods.

More specifically, we plan to develop:

  • Integrated tools that assess the security of software projects
  • A classification of security-evaluated projects
  • An integrated method for performing security evaluations of software

Using a large set of projects, of a different kind (operating systems, web servers etc), the security of different products will be measured. Those products will be classified by field of application, and by their security metrics. Depending on the field of application, the risk associated to each possible security flaw will be evaluated. The consequences of that flaw will be evaluated as well. With that information, a ranking of products will be made. This ranking will be useful to certificate FLOSS products for different fields of application, and also as a roadmap in order to fix those products that are the least secure. For the measurement system, existing tools will be evaluated, and when the needs of the system may not be covered with existing alternatives, new tools will be developed.

Our proposed work will build upon two currently running, FP6-funded projects, FLOSSMETRICS and SQO-OSS. FLOSSMETRICS [1] has build a comprehensive database of software quality related metrics for a great number of projects and will function as our source of raw data. On the other hand, the SQO-OSS plug-in based software evaluation platform [2] will be the basis for the software we are planning to develop. The integration of the quality metrics tools from FLOSSMETRICS project and the security tools that will be developed for <PROJECT_ACRONYM> on the SQO-OSS tool, will effectively create a tool for the holistic evaluation of software quality and security, which will allow critical IS implementers to choose from the best available projects.

All the software produced by this research project will be released in the public domain under the European Public License (EUPL).

What we need from you

The <PROJECT_ACRONYM> project is a research proposal being submitted for the first time. We plan to carry out the major parts of the write-up using the resources of URJC and AUEB, although help from partners will be greatly appreciated. We expect our partners to contribute their opinions in areas of their particular expertise and to formally review the proposal before it is being submitted.


Further information and communication This proposal is co-ordinated by the <LAB> of the <UNI>, directed by Jesus Gonzalez Barajona <MAIL>, <TEL>, <WEB> etc. The Information Systems Laboratory of the Department of the Athens University of Economics and Business, directed by Diomidis Spinellis, will be participating in the proposal preparation.

[1] - Flossmetrics: http://www.flossmetrics.org [2] - SQO-OSS: http://www.sqo-oss.eu

Retrieved from "https://istlab.dmst.aueb.gr/wiki/index.php?title=FP7:_Critical_Infrastructure_Protection&oldid=2414"