CYRENE started off by collecting security and legal requirements for supply chain services (SCSs). Security requirements were collected from SCS stakeholders (both project partners and external stakeholders through online questionnaires) while legal requirements were collected by the legal partner of the consortium. The requirements were classified, analyzed and reported. The analysis of the requirements led to the specification of the conformity certification assessment scheme and the conformity assessment process, which was defined as a stepwise multi-level evidence-driven assessment process among different actors (auditors, assessors, supply chain services providers, administrators and security officers) with hierarchical access control rights. Moreover, ontological models for infrastructure dependencies and events as well as for hardware and software assets, threats, vulnerabilities, cyber dependencies, actors and interactions among them and algorithms for cascading effects of threats, risks and vulnerabilities have been developed. Moreover, an architecture has been defined for a platform to support the conformity assessment process. The successful completion of the aforementioned outcomes marked the fulfillment of the first three milestones MS1, MS2, MS3 of the project.
Further work focused on the design and implementation of the prerequisites (i.e. assets, vulnerabilities, supply chain services, business processes in a relational database schema compliant with CVSS3.1) to facilitate the horizontal calculation of the risks between interconnected supply chains that involve multiple actors (i.e. supply chain providers, auditors and assessors).
Automatic crawling services were designed and implemented to collect and mine information from the dark web. Similarly, a data pipeline for data processing, curation, storage, graph and text analytics was implemented. Machine Learning has been employed to classify text according to the relevance of its content to cyber-attacks, illegal activities and emerging events detected in dark web forums, marketplaces and sites. The Threat Intelligence Sharing Platform has been used to bind and classify the extracted terms from the dark web into cyber concepts correlated with cyber security incidents and malware.
Appropriate technologies have also been setup to allow successful integration of the aforementioned developed modules. They include a GitLab repository for uploading of relevant module code to the integration system, a number of integration tools such as Kafka broker, Elasticsearch, and keycloak for secure access. Additionally, the Redmine environment has been setup for issue reporting and tracking of project activities. The continuous integration tasks include the aforementioned GitLab environment for code repository for the process that runs the tests and deploys the code for every iteration. Finally, a template for info collection that will lead to the testing scheme of individual modules as well as the integrated system has been circulated. Moreover, WP5 activities include the design of the experimentation methodology with the creation of appropriate templates to lead to the actual design of the experiments to take place in WP6.
