Mapping Critical IT Infrastructures
Develop a way to map critical IT infrastructures. The dependencies are very complex, and therefore you need tools and data to explore what is really critical. Is Vodafone part of Greece's critical infrastructure? Linux? Solaris? MS-DOS? Postgres? So we do a kind of service and artefact dependency analysis, mapping dependencies and criticality indicators/measures not only software but telecom links, hardware facilities, etc. We develop the software and then run a pilot study. Our proposed approach differs from automatic vulnerability analysis, because we follow and explore the effect of dependencies, rather than primary vulnerabilities.
How do we measure criticality? I can come up with two dimensions:
- The amount of infrastructure affected. If we map the infrastructure on a graph, it is clear that some nodes are more central than others. This has been explored at length in scale-free networks research, providing grounding why the internet is vulnerable to targeted attacks.
- The exact effects on the affected infrastructure. A slight performance degradation is not the same as a crash.
In software, it has long since been observed that not all bugs are worth fixing, as they may never produce a failure. This observations may extend to whole security infrastructures, and perhaps this is what we are aiming at here?
Cons
The importance of this proposal is, at least to me, self-evident, but I was wondering if this information should be made public. Identifying the most critical nodes in every complex system, is like pinpointing the most valuable targets for adversaries wanting to wreck havoc. Nonetheless I would love to work in that proposal…
Possible Partners
Cover Letter
Mapping Critical IT Infrastructures and their Dependencies
Department of Management Science and Technology Athens University of Economics and Business
STREP proposal (FP7/ICT) Strategic Objective: ICT-SEC-2007.1.7: Critical Infrastructure Protection (Joint Call between ICT and Security Themes FP7-ICT-SEC-2007-1)
Communication systems, supply systems, services, form complex interconnected infrastructure networks whose functioning is fundamental for our society. Infrastructure networks are vulnerable both to malicious attacks and to accidental malfunction; in recent years, in various countries, we have seen examples of commodity infrastructures such as telecommunications, transportation, or power supply networks that were attacked or failed accidentally leading to loss of their availability. In several of these cases large parts of the attacked systems were adversely affected due to domino-like effects: failure in a system component had far reaching rippling effects that had not been predicted, as the criticality of infrastructure components, and the possibilities for damage propagation had not been assessed.
Information and Communication Technology (ICT) infrastructures are becoming more and more complex, not only because their size grows daily but also (mostly) due to their interconnected nature and the fact that we are moving towards the unification of such networks (e.g., data and voice networks). It is therefore becoming more difficult to efficiently monitor their operation, master their vulnerabilities, prevent against the cascading effects of failures and provide recovery and continuity in critical scenarios. Tools are needed in order to explore and map the dependencies between the parts of these systems in order to identify the ones that are critical. If failures are inevitable, it is necessary to know the extent of the expected damage, in order to prepare the most adequate reaction.
The proposed project aims to deliver algorithms and tools for mapping and exploring dependencies between the different artefacts and components that ICT infrastructures are made of and identifying/examining criticality measures for each one. This includes not just hardware or software but also service provisioning (e.g., power supply, telecommunication links, Web Services). The project's macro level goal is not to create a tool that automatically detects vulnerabilities and proposes countermeasures, but to follow and explore the effect of dependencies between the various components of a system that is geographically dispersed and relies on the availability of various service providers in order to operate. In this way we will be able to predict the extent of the damage that may result from a malfunctioning component in an infrastructure network. The dependencies and probabilities about the spread of damage will be visualised to aid decision making; for instance, our tools will produce graphical overlays on infrastructure maps.
The project's software deliverables will be available for internal use by the project's partners and in the future could become part of or form the basis of novel products and business solutions. Scientific contributions will be exploited by means of journal articles and conference publications. Licensing and commercial exploitation of research results will be discussed during the proposal preparation phase.
What we need from you
This project is a research proposal being submitted for the first time. We plan to carry out the major parts of the write-up using our own resources, although help from partners will be greatly appreciated. We expect our partners to contribute their opinions in areas of their particular expertise and to formally review the proposal before it is submitted.
Further information and communication
This proposal is initiated by the Software Engineering and Security Group of the Information Systems Technology Laboratory, directed by Diomidis Spinellis (http://www.dmst.aueb.gr/dds/), hosted by the Department of Management Science and Technology at the Athens University of Economics and Business.
Our website: http://istlab.dmst.aueb.gr.
Contact us by email at circular@aueb.gr .
