Project description
Helping companies manage cybersecurity risks of the fragmented ICT supply chain
Most companies developing ICT solutions require the integration or synergy of other ICT components developed by third parties. This can pose a high security risk, hampering the verification of potential vulnerabilities. The EU-funded BIECO project is working on a holistic framework that provides the necessary mechanisms to help companies understand and manage the cybersecurity risks and threats they are subject to when they become part of the ICT supply chain. The framework is composed of a set of tools and methodologies that will address the challenges related to vulnerability management, resilience and auditing of complex systems.
Objective
Nowadays most of the ICT solutions developed by companies require the integration or collaboration with other ICT components, which are typically developed by third parties. Even though this kind of procedures are key in order to maintain productivity and competitiveness, the fragmentation of the supply chain can pose a high risk regarding security, as in most of the cases there is no way to verify if these other solutions have vulnerabilities or if they have been built taking into account the best security practices.
In order to deal with these issues, it is important that companies make a change on their mindset, assuming an “untrusted by default” position. According to a recent study only 29% of IT business know that their ecosystem partners are compliant and resilient with regard to security. However, cybersecurity attacks have a high economic impact and it is not enough to rely only on trust. ICT components need to be able to provide verificable guarantees regarding their security and privacy properties. It is also imperative to detect more accurately vulnerabilities from ICT components and understand how they can propagate over the supply chain and impact on ICT ecosystems. However, it is well known that most of the vulnerabilities can remain undetected for years, so it is necessary to provide advanced tools for guaranteeing resilience and also better mitigation strategies, as cybersecurity incidents will happen. Finally, it is necessary to expand the horizons of the current risk assessment and auditing processes, taking into account a much wider threat landscape. BIECO is a holistic framework that will provide these mechanisms in order to help companies to understand and manage the cybersecurity risks and threats they are subject to when they become part of the ICT supply chain. The framework, composed by a set of tools and methodologies, will address the challenges related to vulnerability management, resilience, and auditing of complex systems.
Fields of science (EuroSciVoc)
CORDIS classifies projects with EuroSciVoc, a multilingual taxonomy of fields of science, through a semi-automatic process based on NLP techniques. See: https://op.europa.eu/en/web/eu-vocabularies/euroscivoc.
CORDIS classifies projects with EuroSciVoc, a multilingual taxonomy of fields of science, through a semi-automatic process based on NLP techniques. See: https://op.europa.eu/en/web/eu-vocabularies/euroscivoc.
- social scienceseconomics and businesseconomicsproduction economicsproductivity
- natural sciencesbiological sciencesecologyecosystems
- natural sciencescomputer and information sciencescomputer security
You need to log in or register to use this function
We are sorry... an unexpected error occurred during execution.
You need to be authenticated. Your session might have expired.
Thank you for your feedback. You will soon receive an email to confirm the submission. If you have selected to be notified about the reporting status, you will also be contacted when the reporting status will change.
Keywords
Programme(s)
Call for proposal
(opens in new window) H2020-SU-ICT-2018-2020
See other projects for this callSub call
H2020-SU-ICT-2019
Funding Scheme
RIA - Research and Innovation actionCoordinator
2829-516 Caparica
Portugal
The organization defined itself as SME (small and medium-sized enterprise) at the time the Grant Agreement was signed.