In recent years, the majority of the world's Critical Infrastructures (CIs) evolved to become more flexible, cost efficient and able to offer better services and conditions for business opportunities. Towards this evolution, CIs and companies offering CI services had to adopt many of the recent advances of the Information and Communication Technologies (ICT) field. This adaptation, however, was rather hasty and without thorough evaluation of its impact on security. The result was to leave CIs vulnerable to a new set of threats and attacks that impose high levels of risk to the public safety, economy and welfare of the population.
In so far, the main approach to protect CIs is to handle them as comprehensive entities and offer them a complete solution for their overall infrastructures and systems (IT&OT departments). However complete CI protection solutions exist in the form of products from individual companies.
The main aim of CIPSEC is to create a unified security framework that orchestrates state-of-the-art heterogeneous security products to offer high levels of protection in IT (information technology) and OT (operational technology) departments of CIs. As part of this framework CIPSEC will offer a complete security ecosystem of additional services that can support the proposed technical solutions to work reliably and at professional quality. These services include vulnerability tests and recommendations, key personnel training courses, public-private partnerships (PPPs) forensics analysis, standardization and protection against cascading effects.
All solutions and services will be validated in three pilots performed in three different CI environments (transportation, health, environment). CIPSEC will also develop a marketing strategy for optimal positioning of its solutions in the CI security market.
- CIPSEC will provide a Unified security framework for Critical Infrastructures by allowing easy integration of heterogeneous systems to its framework with reduced adjustment, notably anomaly detection, anti-malware, cyber-security detection and prevention, distributed denial of service, and hardware security platforms. CIPSEC will collect and process input from multiple sources and will provide monitoring for the complete Critical Infrastructure.
- CIPSEC will offer a complete set of additional services to reliably support the proposed technical solutions at a professional demanding level, among which industrial control system vulnerability tests, studies for cascade effect attacks, contingency plans, and innovative forensics analysis are included. Training courses and certification will also be provided.
- Through the identification of a requirements baseline for security and resilience within pilots, CIPSEC will be endorsed under true conditions and real infrastructures. CIPSEC will supply an overall solution, suitable for transportation, health and environment sectors both at module level (for each industry and security facet) and at system level (the complete framework).