Periodic Reporting for period 2 - CyberWiz (Cyber-Security Visualization and CAD-Tool for the Vulnerability Assessment of Critical Infrastructures) Reporting period: 2016-09-01 to 2017-08-31 Summary of the context and overall objectives of the project Information & Communication Technology (ICT) is today central in our society. In critical infrastructures, ICT handle management of critical data as well as control of physical processes such as the power grid. Cyber security is thus crucial, and the number of cyber-attacks is rapidly increasing.Managing cyber security is however very challenging. ICT architectures are typically composed of a large number of systems, processes and individuals connected to form a complex system-of-systems. Enterprise cybersecurity decision maker cannot be expected to have the deep understanding of all types of ICT security vulnerabilities and their dependencies that is needed in order to make insightful proactive decisions. As a result, they struggle to get an objective and fact-based overview of where they are more or less vulnerable and what investments to prioritize. This is where enhanced tool support - as securiCAD - can provide significant value to enterprises. The purpose of this project is to help enterprise decision makers analyse their cybersecurity posture in a meaningful and understandable way. The project among other improves and adapts the tool securiCAD to the need of critical infrastructure operators, and test in realistic condition with two critical infrastructure operators in Germany. The project objectives have been structured in 3 key areas, supported by specific exploitable results: - Adapt and improve the solution based on customer feedback - Validate the practical value of the solution - Develop best practices guidelines and methodologies and encourage widespread adoption of the solution Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far In summary, the project was a success. The software solution has been adapted and improved for the analysis of critical infrastructures, and has been packaged for various sales opportunities and for use by consultants. Additional value has been created by developing supporting material such as components, manuals, and documentation of guidance, best practices, and methodologies. The value of the approach and toolset has been shown and validated by two major pilot projects in the electric power generation and distribution industry. Further, a “Turing test” has validated securiCAD®’s ability to make security assessments as good as human security experts. As part of establishing commercial viability, various events with experts were performed. The approach of CyberWiz was very well received.Project work has included the following: Improving the solution, including both securiCAD® Professional and Enterprise Edition. Demonstrating the practical value of securiCAD®. Two pilot projects in the energy sector were conducted. These were well received by the customers. Further, a Turing test of the securiCAD® software has been carried out to benchmark it with domain experts. It was found that securiCAD® performed at least as good as domain experts. To support consultants in securiCAD® projects, a set of documents called “Guidance and best practice” were developed. Further, a partner certification scheme was developed. Being certified implies that the consultant knows how to properly leverage the securiCAD® solution and provide the outmost quality to the end customer.A large number or communication activities were performed to ensure good dissemination about the project and the solution. This includes issuing press releases, writing and submitting articles in reputable magazines, attending conferences, driving social media communication, and more.For commercialization activities, the project has developed and executed on a commercialization plan. Execution activities includes development of sales material and proof of concept, conducting customer sales meetings, defining processes for support, training, and delivery, attracting funding, and more. Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far) CyberWiz introduces a tool and methods with distinct advances compared to the commercial state of the art. In short, the tool is a threat modeling and proactive risk management tool based on the concepts of attack graphs and Bayesian Networks. A Bayesian Network is a graphical representation of cause-and-effect relationships within a problem domain. A Bayesian network is a powerful tool for security analysis, especially for the proactive, forward looking “what-if” analyses. However, it is not trivial to make it practical and valid. Challenges that have been solved in the tool, include setting the right taxonomy and model to make it practically viable, proving that the output is valid, providing the ability to model the uncertainty inherited in security analysis, and more. It employs a taxonomy that couple attacks and defences to objects in a way end-users can easily model and understand and provide actionable decision support as output. securiCAD Enterprise Logo Symbolizing the path from manual evalution work to a CAD solution CyberWiz Logo to be used in header or similair
