Community Research and Development Information Service - CORDIS


CyberWiz Report Summary

Project ID: 673980

Periodic Reporting for period 1 - CyberWiz (Cyber-Security Visualization and CAD-Tool for the Vulnerability Assessment of Critical Infrastructures)

Reporting period: 2015-09-01 to 2016-08-31

Summary of the context and overall objectives of the project

Information & Communication Technology (ICT) applications handle everything from management of critical data to control of physical processes such as the power grid. Considerable effort is thus spent by both researchers and practitioners to preserve ICT systems in a reliable and predictable state. This is however a difficult topic to manage as a modern ICT architecture typically is composed of a large number of systems, processes and individuals connected to form a complex system-of-systems (hereafter refered to simply as system).

Critical infrastructures, such as electricity generation plants, transportation systems, oil refineries, chemical factories and manufacturing facilities are large, distributed complexes. Plant operators must continuously monitor and control many different sections of the plant to ensure its proper operation. During the last decades this remote command and control has been made feasible due to the development of networking technology and the advent of Industrial Control Systems (ICS). ICS are command and control networks and systems designed to support industrial processes. The largest subgroup of ICS is SCADA (Supervisory Control and Data Acquisition) systems.

ICS have passed through a significant transformation from proprietary, isolated systems to open architectures and standard technologies highly interconnected with other corporate networks and the Internet. Today ICS products are mostly based on standard embedded systems platforms, applied in various devices, such as routers or cable modems, and they often use commercial off-the shelf software. All this has resulted in reduction of costs, ease of use and enabled the remote control and monitoring from various locations. However, an important drawback derived from the connection to intranets and communication networks, is the increased vulnerability to computer network-based attacks.

An enterprise cyber security decision maker cannot be expected to have a deep understanding of all types of ICT security vulnerabilities and their dependencies. As a result, they struggle to get an objective and fact-based overview of their complete architecture (i.e. where they are more or less vulnerable and hence what investments to prioritize). In practice, enterprise decision-makers consult experts, e.g., network penetration testers. While consulting experts certainly is valuable, resulting estimates come with three significant limitations: they are only valid for 1) the time that they were carried out, 2) the parts of the enterprise architecture that were studied by the expert, and 3) the competence of the consulted expert. These limitations are especially problematic given the dynamic nature of enterprise IT systems and the lack of resources available for analyses.

Enterprise decision makers are thus in need of tools that can help estimate the cyber security of enterprise architectures in a both useful and easy-to-understand fashion. The attack graph approach is often considered the best suited method for estimating the security of enterprise architectures. Attack graphs involve usage of formal reasoning and graphical modelling to present possible attack paths corresponding to a certain architecture. According to a recent survey, there are more than 30 different types of attack graph approaches. However, while there is a myriad of methodologies, most tools implementing these methodologies do not provide a satisfactory analysis of the security of an enterprise architecture as they require significant expertise or cover a too restrictive scope.

This project is to help enterprise decision makers analyse the cyber security, or vulnerability, of their enterprise architectures in a meaningful and understandable way. More specifically, the project improves existing prototypes of a cyber security meta-model and an enterprise tool developed in previous phases, in order to adapt them to the need of critical infrastructure operators such as power generation and power distribution operators. The final prototype will be tested in realistic condition with two critical infrastructure operators in Germany.

The project objectives have been structured in 3 key areas supported by specific exploitable results
• Adapt and improve the solution based on customer feedback
• Validate the practical value of the solution
• Develop best practices guidelines and methodologies and encourage widespread adoption of the solution.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

CyberWiz has structured its work into six work packages. The following paragraphs summarize the work performed and results obtained during the first 12 months of the 2-year project.

Work Package 1 “Solution prototype improvements”

The focus of work package 1 has been to take securiCAD to the next level in terms of user friendliness to enhance the overall value package provided.

A lot of effort has been put into developing the new GUI, taking feedback from customers and prestudy, the lab test performed in work package 2, continuous feedback from the carrying out of pilot 1 in work package 3, as well as extensive internal redesign workshops and written code specifications on the new GUI.

As the new GUI has been developed it has also undergone rigourous testing in terms of automatic test, manual validation and a quality assurance phase.

Not only does the new GUI have a new look and feel, but also a lot of new features that enhances the user experience and adds new value to securiCAD, these include:
• Several new methods of constructing a model
• New ways of analyzing
• Updated methods of visualizing the influences of an attack

The project has so far two tool releases.

In addition, the interface to network scanners and enterprise architecture tools were regarded. The idea is to build a compiler to translate export files from other tools into securiCAD import format.

Work package 2 “Pilot preparation”

An essential part of work package 2 was the preparation of the first pilot project.

After selecting the pilots apsec with support from foreseeti did
• Learn how to handle securiCAD
• Perform tests of securiCAD functionality and performance
• Prepare handling instructions for the consulting.

In parallel the training material / user manual was developed by foreseeti.

Work package 3 “Pilot implementation & evaluation”

An essential part of work package 3 was the consulting project at pilot 1. It started in February 2016 and was finished in August 2016.

This project was separated into several steps: preparation, collection of the customer’s information and data, modelling the customer’s IT-infrastructure, calculation and analysis of the customer’s cyber¬security, definition of measures and recommendations to the customer, editing the final customer report, discussion of the results with the customer. The main delivery to the customer was a customer report. The report describes the customer’s IT-infrastructure and the results of the securiCAD-calculation as well as measures and recommendations.

In addition, an implementation and an evaluation report were written.

Work package 4 “Community building, project promotion and communication”

The start of work package 4 was to set up a website for CyberWiz and an internal repository. The website is hosted at A forum – message board, was also set up in the internal repository dedicated for communication between the parties of the consortium.

One of the larger tasks in work package 4 was to develop the communication plan. This document is a collection of methods used to inform about the CyberWiz project from a project perspective as well from a company specific perspective. In the communication plan, the target audiences were identified and grouped in order to have tangible targets for the communication.

The work of implementing the communication plan has also been ongoing. Initial customer meetings informing about the CyberWiz solution have been conducted. Press releases have been published, material prepared before events and events have been attended.

A linkedIn page dedicted to the CyberWiz project has been setup as part of creating a partner eco system. Newspapers / magazines have been approached with project related articles.

Work package 5 “Industrialization & scaling up”

The main activity in work package 5 has been to develop the commercialization plan. The commercialization plan describes the overall commercialization objectives (revenue targets, commercialization activities and KPIs), the business need and value provided by securiCAD, business model, target customers (end user companies and consulting partners), commercial offerings (software license, support, managed services, training and implementation guide) and the commercialization activities to be conducted within the project.

During this period there has also been ongoing scaling up activities in line with the commercialization plan where the following has been achieved:

Preparing, conducting and following up end user meetings for marketing and sales:
• Preparing marketing and sales materials
• Meetings with utilities / energy companies
• Meetings with other critical infrastructure / industries
• Consulting partner meetings

Investor meetings and preparations.

Work package 6 “Mangement”

The work carried per project management included:
• Setup of project and organizational structure
• Setup of project instruments and processes to control progress, effort and finance
• Setup project communication
• Development of Project Quality Handbook
• Perform project and monitor the progress of project
• Risk management
• Ensure compliance with Consortium Agreement and Grant Agreement

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

CyberWiz introduces a tool and methods with distinct advances compared to the commercial state of the art. In short the tool is a threat modeling and proactive risk management tool based on the concepts of attack graphs and Bayesian Networks. A Bayesian Network is a graphical representation of cause-and-effect relationships within a problem domain. A Bayesian network is a powerful tool for security analysis, especially for the proactive, forward looking “what-if” analyses. However, it is not trivial to make it practical and valid. Challenges that have been solved in the tool, include setting the right taxonomy and model to make it practically viable, proving that the output is valid, providing the ability to model the uncertainty inherited in security analysis, and more. It employs a taxonomy that couple attacks and defences to objects in a way end-users can easily model and understand and provide actionable decision support as output.

Related information

Record Number: 193698 / Last updated on: 2017-01-24
Follow us on: RSS Facebook Twitter YouTube Managed by the EU Publications Office Top