CS-AWARE aimed to increase the automation of cybersecurity awareness approaches, by collecting cybersecurity relevant information from sources both inside and outside of monitored local public administrations (LPA) systems, performing advanced big data analysis to set this information in context for detecting and classifying threats and to detect relevant mitigation or prevention strategies.
CS-AWARE aimed to advance the function of a classical decision support system by enabling supervised system self-healing in cases where clear mitigation or prevention strategies for a specific threat could be detected. One of the key aspects of the European cybersecurity strategy is a cooperative and collaborative approach towards cybersecurity. CS-AWARE was built around this concept and relied on cybersecurity information being shared by relevant authorities in order to enhance awareness capabilities. At the same time, CS-AWARE enabled system operators to share incidents with relevant authorities to help protect the larger community from similar incidents. CS-AWARE has shown promising results and received acceptance by both pilot users in Italy and in Greece. An extensive trial period towards the end of the project helped us to assess the validity of the approach in day-to-day LPA operations.
At the technical level, the project aimed to improve cybersecurity by providing an online monitoring and awareness system that is able to detect security incidents by monitoring the complex organizational systems, and set it in context with information collected from external sources like cybersecurity information sharing communities or network and information security (NIS) competent authorities, as specified by the European cybersecurity strategy. This allows to classify suspicious events and incidents to concrete threats and attacks, as well as applicable strategies for prevention or mitigation. Furthermore, CS-AWARE is designed to interact with cybersecurity information sharing communities to share information about newly discovered incidents that could not be classified, in order to allow the community to analyze those events and potentially help others affected by the same incident.
We list below the overall objectives of the project:
1. Provide a cybersecurity situational awareness solution for local public administrations in line with the current and upcoming legal cybersecurity framework in the European Union and its member states.
2. Advance the automation of cyber incident detection, classification and visualisation to provide situational awareness. This includes socio-technical system analysis, data collection, data analysis and decision making as well as the visualisation of the findings.
3. Include a cybersecurity information exchange framework that embraces the collaboration and cooperation initiatives of European cybersecurity strategies. This includes the utilisation of cybersecurity data for threat detection as well as sharing of newly discovered cyber incident data.
4. Illustrate that cyber situational awareness is a key technology in cybersecurity by building advanced features like system self-healing on top of the situational awareness capabilities
5. Evaluate and validate the user needs through end-user involvement and pilot testing.
