During the first year of the project, system engineering activities have been carried out: Telco operators needs have been translated in coded system requirements and system architecture has been defined. The main sub-systems, Long Term Control Loop in charge of off-line Risk and Resilience assessment and management and the Short Term Control Loop in charge of the run-time activities to detect, react and mitigate threatening events, have been designed.
During the second year, 9 use cases were defined to test and demonstrate the performance of the RESISTO platform. New detection systems, for both cyber and physical events, and the RESISTO correlator have been developed. Concerning the prediction capabilities, the CISIApro system has been improved and adapted to the specific complexity of a distributed telecommunication system. These elements have been integrated and the corresponding outcomes reported to the user through the Leonardo SC2 platform. Use case environments have been consolidated and testbeds implemented.
During the last period, each pilot has been executed according to a two-phase – two run- approach. The first run results allowed us to target early flaws and challenges. In the second run, a more mature and stable version of the pilots has been tested.
Overall, despite the heterogeneity of the use cases, a few common conclusions can be highlighted:
• the RESISTO system managed to correlate events using data from a wide variety of sensors (both cyber and physical), to identify and assess potential cascading effects, and to suggest appropriate mitigation actions, assisting network operators to cope with the scale and complexity of new advanced threats
• KPI measurements showed that the risk predictor and the correlator provided adequate performance
• RESISTO proved to be a reliable solution to enhance network security, complementary to traditional solutions, particularly for combined cyber-physical attack scenarios.
The RESISTO platform, that reached TRL 7, fits most of the key success factors identified for the CI protection market: a proper exploitation strategy has to be implemented leveraging on the most promising Key Exploitable Results (KERs). The main drivers are expected to be the LEs (Leonardo and Ericsson) and TELCOs (Telecom Italia, British Telecom, OTE Group, Orange Romania, Altice Labs, Retevision) given their customer base, financial strength and organization. The best market opportunities are represented by the widespread adoption of 5G and associated investments by the TELCOs, and the more than 700 billion stimulus packages put in place by the EU Commission through the Recovery & Resilience Facility.
In the last period the dissemination activities were carried out more extensively to cover a broader audience: the consortium produced 16 scientific contributions, participated to 7 conferences and 4 workshops, organized 2 workshops and 1 conference, and published 3 newsletters, produced 3 videos, co-organized with other EU project 2 events. Over 2500 people, including scientific communities, industry, general public, and policy makers were reached by these actions.
