Project blog

Supervised vs automated response to cyberthreats

Cyberthreats are continually becoming more sophisticated, thus creating a demand for an equally advanced threat detection and response. Detection of cyberthreats can very much benefit from the adoption of AI, as it is able to detect attack patterns and perform correlations among various security-related events. However, when it comes to incident handling, a fully AI-enabled approach may actually cause more harm than good, due to the critical human factors involved.

Continue reading

Storytelling Workshops 2022

We have organised storytelling workshops in the two pilot sites of the project: the municipalities of Larissa and Foggia. Representatives of multiple public and private organisations came together for four days for these workshops that were organised by our project.

During the workshop, participants shared stories about their experiences with cybersecurity in their organisations, and, in addition, discussed real world examples of cyberattacks that had serious implications on a region, or, the term we like to use, on an entire ecosystem. An ecosystem is a group of organisations that live and interact together in a particular environment. Despite cybersecurity being ubiquitous, and attacks coming from anywhere, in an ecosystem, local organisations can have joint interests when it comes to cybersecurity.

Continue reading

Cybersecurity – a case for advanced decision models

Advanced attacks demand advanced countermeasures. On a technical level there already is an elevated level of awareness and readiness. That is why in a first wave of attacks criminals usually focus on tricking users into opening up systems for them . While this has now been the rule for at least over a decade, the way in which these attacks are prepared now follow an almost military style approach. With new, highly distributed environments, little protected IoT systems, tools based on AI, and the weakest link in the chain, the human, not being able to invest the needed time and resources in cyber security, the rise in successful cyber-attacks is predictable . While the need for education and training is commonly accepted, the necessary significant shift in countering cyber-attacks from a purely operational to a tactical and strategic level is still an open issue in many organizations. Policy-based reactions to cyber-attacks should have long ago replaced the still prevailing bug-fixing approach to dealing with an intrusion. However, there is some light at the end of the tunnel. Learning from military and business decision making, such long overdue model-based solutions are also finding their way into the field of cyber security. The first highly successful wave of these decision models is shaped by the now legendary OODA Loop , which properly links observations (e.g., OSINT cyber threat intelligence, system monitoring) with an advanced form of classification (called orientation). These two steps, when combined properly, can provide the critical situational awareness needed to make the right decision, on which the actions taken depend. Especially in distributed collaborative environments, which typically characterize the ecosystem of projects like CS-AWARE-NEXT , these models are a welcome game changer. When applied together with well-established cyber defence frameworks such as NIST/CSF , there is an opportunity to thwart even advanced AI-based attacks. Attacks are on the rise and their sophistication is growing, but better situational awareness, advanced military grade decision models and proven cybersecurity frameworks, when applied in an integrated way can equip Security Operations Centres with the necessary tools to successfully shelter the expected oncoming heavy attack storms.

Continue reading

Data poisoning attacks

Data poisoning is an increasingly important security concern for Machine Learning (ML) systems. As machine learning models are becoming more prevalent in our lives, they are also becoming more vulnerable to malicious attacks. Data poisoning attacks are one of the most insidious and difficult-to-detect kinds of threats on ML models.

Data poisoning is a type of adversarial attack in which a cybercriminal injects malicious data into a machine learning model. These attacks can be used to manipulate the results of a machine learning system, or to redirect the system’s resources away from its intended purpose.

Continue reading

Massive increase in cyber attacks in 2022

Universities, research centers, state and military services, hospitals, communication infrastructure and banks have received numerous cyberattacks in 2022; and the worst is yet to come.

It is estimated that more than 1.000 cyberattacks per organisation take place throughout the universe, which is 38% more than 2021. In Europe in particular, the average number of attacks per target reached 1.000, with an increase of 26% when compared to 2021. In a worse position one can find the Americans, as they faced an increase of 52%!

Continue reading

CriM -- Cyber Security Seminar and Workshops -- 2022

During November 2022 we held the Cyber Security Seminar and Workshops in Oulu, Finland. This four days event has been held since 1999 and brings together teachers, researchers, experts, and students of cybersecurity: https://www.oulu.fi/en/crim.

CriM had twelve talks before lunch and three exercises in the afternoon, covering topics from incidence response to password handling. We were especially glad to hear a talk from Bart Preneel, Europe’s most pronounced cryptography expert, who reminded us at the end of his presentation to a quote from Immanuel Kant “Optimism is a moral duty”.

Continue reading

Cybersecurity For Public Utilities Solutions III

Failing to understand the gravity of the potential effects of a power grid attack leaves municipal utility companies unprepared to enact the necessary cybersecurity counter-measures necessary to prevent or, at least, mitigate attacks. As Miller [1], points out, local governments could benefit from the information that would lead to the early prevention of cyberattacks. Unfortunately, the information is often hidden or never revealed. Although municipalities are obliged to report attacks in a timely fashion, they often avoid reporting attacks to maintain credibility. Nor do they necessarily see sharing of information about attacks as useful.

Continue reading

Cybersecurity For Public Utilities Solutions II

Cyberattacks launched on municipal utility companies are similar to attacks in any other industry. However, the potential for OT attacks and the dangers of a major service disruption has raised the stakes. Miller outlines in this article [1] the most common cybersecurity attacks that have affected municipal utility companies. 

Denial of Service 

Attacks that stop users from accessing essential networks are typically referred to as denial of service (DoS) or distributed denial of service (DDoS) attacks. A DoS attack is initiated by a single attacking computer. A DDoS attack is launched by multiple attacking devices. While the attack is in progress, companies can’t access the means to provide services. These attacks have serious implications for any company, but the interruption of essential services like electricity or running water can quickly become disastrous.  Unfortunately, given the lack of training many utilities are particularly vulnerable to denial of service attacks. While these attacks are difficult to deal with, more work on raising an awareness of the issues and possible counter-measures would be invaluable.

Continue reading

Cybersecurity For Public Utilities Solutions I

In 2021 Jason Miller wrote an article on cybersecurity for municipal utilities stressing that cyber-attacks were increasing every year and greatly impacting a wide range of high-profile targets from governmental agencies to financial and insurance organizations, hospitals and other health facilities, and educational institutions. Of particular concern in many countries, he points out, is the situation on local levels where local governments with municipal utilities are often under-funded with poorly trained staff [1]. Unfortunately, the solutions he offers do not take into account the range of problems facing municipal utilities. Many are not aware, however, of how municipal utilities have become targets for “nation-state actors” and the possibly disastrous effects of an attack.

Continue reading

Welcome CS-Connect!

In CS-AWARE-NEXT, the role of our unit, CERICT-Università di Salerno, is to design, develop and evaluate, a collaboration layer for the ecosystem, aimed to support the organisations in their activities toward improved security.

We are actually collecting all the requirements from the use cases and we have had very interesting discussions with the organisations in the ecosystems in Larissa and in Foggia, to find out what is actually needed to ensure adequate support to the ecosystem. And indeed, we have collected quite a few requirements, some of which were expected by us (aren’t we all collaborating on something after all) but many were surprising and stimulating. We cannot spoil them as they are going to be in the Deliverable that Workpackage 2 is creating by February 2023. For example, we cannot tell you that we are considering different scenarios that involve the ecosystem in different activities, with different tools and different support by the collaboration system. As well as we cannot tell you that a flexible visibility mechanism for the information shared will allow to accommodate different ecosystem with diverse cohesion. And, of course, we cannot tell you that the visualization of the system will be based on the CS-AWARE visualization but contextualized with the goal of the scenario. Sorry. What we can tell you now is what is the name of the tool! In fact, during the General Meeting in Wien, stimulated by the words, dubiously attributed to the Bard of Avon:

Continue reading