Periodic Reporting for period 1 - THREAT-ARREST (THREAT-ARRESTCyber Security Threats and Threat Actors Training - Assurance Driven Multi-Layer, end-to-end Simulation and Training)
Reporting period: 2018-09-01 to 2020-02-29
The THREAT-ARREST platform will offer training on:
a) known and new advanced cyber-attack scenarios
b) use of different security tools for detecting and/or responding to cyber-attacks
c) taking different types of actions against cyber-attacks
d) use of security testing, monitoring and assessment tools at different layers (network, infrastructure, application) in a cyber system
The project's objectives include:
- Develop the means for specifying cyber security threat training and preparation models and programs to drive the realization of the training process
- Develop emulation capabilities enabling the creation of virtual cyber system components, subjecting them to cyber-attacks for training purposes, and enabling trainees to take appropriate response actions and hands-on experience against these cyber-attacks
- Develop multi-layer simulation capabilities enabling the realistic simulation of cyber systems, their usage and security attacks launched on them, through synthetic events at all layers in the implementation stack of these systems and their components reflecting realistic system conditions
- Develop cyber-security training based on serious games and enable trainees to get engaged in cyber-defence, elicit threats and learn about attacks
- Develop key capabilities for the effective delivery of CTTP programs, i.e. the visualization of the operation and state of cyber systems and the emergence and effects of attacks against them; assessing trainee performance in CTTP programs and adapting them depending on it; and assessing the overall effectiveness of a CTTP program and evolving it accordingly
- Align training and simulation with the continuous security assurance of real operational cyber systems, by integrating the developed capabilities into a common platform together with security assurance assessment capabilities
- Demonstrate the use of the THREAT-ARREST framework for effective training against cyber-attacks in the domains of smart energy, healthcare and transport (shipping), using real operational cyber systems within these domains as pilots and, through them, evaluate and validate the framework
- Ensure the uptake, commercialization, and the delivery of innovation of project outcomes by developing an ecosystem around the THREAT-ARREST framework.
For the successful evaluation of the platform, we also demonstrate its application and training capabilities for the three piloting sectors of smart energy, healthcare, and smart shipping. Following the initial analysis of the pilots, we designed 13 main CTTP driven scenarios.The scenarios cover the training for all the defined actuator types (e.g. simple users, administrators, security experts, etc.), the main security properties (e.g. confidentiality, integrity, availability) and key data states (i.e. data in-transit, at-rest, and in-processing), as well as the physical and software components of cyber systems. Moreover, the expected actions for the trainees include, among others, preparedness, detection and analysis, security incident response and post security incident response. For the first integrated version of the platform, we have implemented 3 full demonstrators, one indicative scenario for each pilot.
Once deployed in the platform, the main scenarios can be applied in the other pilots as well or cover different actuators and security properties, by slightly configuring the CTTP model and tailoring it to the examined use case. Thus, after the initial development of the main models, the generation of new scenarios can be increased exponentially.
The final THREAT-ARREST platform is meant to reach TRL7. Afterwards, the commercialization of our solution is becoming important. For this reason, the consortium has prepared a stakeholders’ engagement plan. Furthermore, to enhance the acceptability of the overall THREAT-ARREST approach, the final CTTP programmes have to be aligned with other professional training and certification schemes (e.g. ISACA, ISC2, etc.). The goal is to contact such organizations and include THREAT-ARREST in their affiliation lists. Therefore, our platform can be (a) for further professional development training (which can give CPE points to the certified professionals so that they retain their certification in specific cyber security fields) or even (b) as a training tool within specific sessions of the above training and specification schemes.