FP7: Critical Infrastructure Protection

Project Proposals

• RedZone
• Mapping Critical IT Infrastructures
• PROMIS
• Telemonitoring System for Remote Power Plants
• WRC: Wireless Research Center

Call

• CallDetails-ICT-SEC-2007.1.7: Call details

Reliability Evaluation of Free / Open Source / Libre Software

The interoperability and inter-connectivity of communication networks are is one of the cornerstones of our society. All workings of today's society, be them financial transactions, interpersonal communications, health care provision or knowledge acquisition, are heavily dependent on telecommunications network meshes, able to transfer information in real time. As control of those infrastructures is increasingly left over to complex software systems, our society is increasingly dependent on the security and quality of the construction of this software.

On the other hand, FLOSS (free / libre / open source software) is quickly becoming a key component of critical infrastructures and therefore an important factor of the ICT sector in the EU. FLOSS is expected to be present in many different products and systems in the EU in the near future. However, while some well known FLOSS packages, such as the Apache web server and the Linux kernel, have a proved security record, a great number of other FLOSS programs is in use, without their users knowing their security properties. This situation is even more pronounced in the case of proprietary software. Large scale users base their IT decisions for critical infrastructures on word-of-mouth recommendations and have trust software houses based on their reputation, rather than utilising independent and objective security evaluations.

The scientific community has long been studying the issue of software security. Tools to detect common problems in both code and program runtime are widely available, both as FLOSS and as commercial products. Also, a number of security provisioning method are available and cover all the phases of the development of information systems.

The <PROJECT_ACRONYM> project aims to bridge the gap between the availability of tools and methodologies and the absence of their application on the field of critical information systems. Our goal is to build a platform that integrates existing security-related tools and using well established methodologies it will allow for the scientific evaluation of the security of critical software. Our particular focus will be the field of FLOSS, as the availability of the source code will allow us to develop in-depth evaluation methods.

More specifically, we plan to develop:

• Integrated tools that assess the security of software projects
• A classification of security-evaluated projects
• An integrated method for performing security evaluations of software

Using a large set of projects, of a different kind (operating systems, web servers etc), the security of different products will be measured. Those products will be classified by field of application, and by their security metrics. Depending on the field of application, the risk associated to each possible security flaw will be evaluated. The consequences of that flaw will be evaluated as well. With that information, a ranking of products will be made. This ranking will be useful to certificate FLOSS products for different fields of application, and also as a roadmap in order to fix those products that are the least secure. For the measurement system, existing tools will be evaluated, and when the needs of the system may not be covered with existing alternatives, new tools will be developed.

Our proposed work will build upon two currently running, FP6-funded projects, FLOSSMETRICS and SQO-OSS. FLOSSMETRICS [1] has build a comprehensive database of software quality related metrics for a great number of projects and will function as our source of raw data. On the other hand, the SQO-OSS plug-in based software evaluation platform [2] will be the basis for the software we are planning to develop. The integration of the quality metrics tools from FLOSSMETRICS project and the security tools that will be developed for <PROJECT_ACRONYM> on the SQO-OSS tool, will effectively create a tool for the holistic evaluation of software quality and security, which will allow critical IS implementers to choose from the best available projects.

All the software produced by this research project will be released in the public domain under the European Public License (EUPL).

What we need from you

The <PROJECT_ACRONYM> project is a research proposal being submitted for the first time. We plan to carry out the major parts of the write-up using the resources of URJC and AUEB, although help from partners will be greatly appreciated. We expect our partners to contribute their opinions in areas of their particular expertise and to formally review the proposal before it is being submitted.

Further information and communication This proposal is co-ordinated by the <LAB> of the <UNI>, directed by Jesus Gonzalez Barajona <MAIL>, <TEL>, <WEB> etc. The Information Systems Laboratory of the Department of the Athens University of Economics and Business, directed by Diomidis Spinellis, will be participating in the proposal preparation.

[1] - Flossmetrics: http://www.flossmetrics.org [2] - SQO-OSS: http://www.sqo-oss.eu