Contributing an integrated Research and Innovation Agenda for Cybersecurity The role and approach of the market study

Transcription

1 Contributing an integrated Research and Innovation Agenda for Cybersecurity The role and approach of the market study Véronique Pevtschin Engineering Ingegneria Informatica S.p.A CSP Innovation Forum 2015

2 Project number: CAPITAL in a nutshell European Commission DG CNECT Duration: 2 years (October October 2015) 9 Partners across Europe: European Organisation for Security, TNO, Engineering IngegneriaInformatica, Atos, Thales, Fraunhofer, Ecorys, Universita Degli Studi di Trento, Conceptivity Coordinator: European Organisation for Security

3

4 A bottom-up approach Classify technological areas according to their expected challenges and impact in cybersecurity and privacy How do application domains rely on these ICT areas for their progress

5

6 Introduced a unique CRYSTAL BALL reference model Describe relationships between entities that shape technological areas

7

8 The reference model The reference model consists of the following classes of entities, grouped in three layers: Business Practices -at the core of the model because it defines the needs and goals of products evolving from an emerging area. (Macro-) Environmental Forces -the outer ring of the crystal ball. They are an external influence for the business practices and the whole emerging area of technology. Technologies Used - the foundation of each emerging area

9

10 Prioritise the major gaps through an evolutive process

11 Emerging Areas of Information Technology Future Clouds Future Sec & Priv. Incident Management Cybersec & Privacy engineering Internet of things Mobile Computing Big Data Critical Industrial Systems Online Trust & Transparency for Privacy Reference Models Current and Future Cybersecurity Threats Existing Solutions Gap Analysis Promising concepts Evaluation, prioritization, selection & consultation with stakeholders Research Items Research Agenda

12 Emerging areas Threats and threat agents

13 Emerging areas Threats and threat agents Prioritise threats based on the frequency with which they were identified in the 8 emerging areas in order to assess the urgency of each of the threats

14 Emerging Areas of Information Technology Future Clouds Future Sec & Priv. Incident Management Cybersec & Privacy engineering Internet of things Mobile Computing Big Data Critical Industrial Systems Online Trust & Transparency for Privacy Reference Models Current and Future Cybersecurity Threats Existing Solutions Gap Analysis Promising concepts Evaluation, prioritization, selection & consultation with stakeholders Research Items Research Agenda

15 Solutions Categories of solutions for improved cybersecurityand privacy in each of the selected areas Used to assess the extent to which the threats are covered

16 Categories of solutions Select, for each emerging area, 5 to 10 categories of solutions for improved security and privacy

17 Categories of solutions Select, for each emerging area, 5 to 10 categories of solutions for improved security and privacy Categories cover broader, key needs for security and privacy in the emerging areas. of solutions research concepts, methodologies, processes, guidelines, software tools, techniques, commercial products, etc.

18 Categories of solutions Select, for each emerging area, 5 to 10 categories of solutions for improved security and privacy Select 3 categories: specially challenging, tackle new security and privacy issues and are less mature, most representative of cyber security and privacy issues in the near future Further validate through questionnaires Further refine for each category: purposes, main stakeholders, and tackled challenges / level of maturity and current limitations and vulnerabilities/ future evolution Analyse on-going work / gaps addressed by the research community

19 Virtualisation and middleware security Cryptographic hardware Reliable and secure communications, incident management and response, and security visualisation and reporting Software hardening and vulnerability analysis and discovery, privacy by design in software development, and measuring application security and privacy Identity and authentication, protocol and network security, and network segregation Upgrade to Internet Protocol version 6 (IPv6), testing and simulation, and monitoring and detection On-The-Fly Encryption (OTFE), process-based access control, and information assurance Mobile malware analysis, and sandboxed smartphone virtualisation Access control based on extensibleaccess Control MarkupLanguage (XACML), public key infrastructures, and browser privacy awareness tools

20 Emerging Areas of Information Technology Future Clouds Future Sec & Priv. Incident Management Cybersec & Privacy engineering Internet of things Mobile Computing Big Data Critical Industrial Systems Online Trust & Transparency for Privacy Reference Models Current and Future Cybersecurity Threats Existing Solutions Gap Analysis Promising concepts Evaluation, prioritization, selection & consultation with stakeholders Research Items Research Agenda

21 Prioritise the major gaps through an evolutive process

22 Emerging Areas of Information Technology Future Clouds Future Sec & Priv. Incident Management Cybersec & Privacy engineering Internet of things Mobile Computing Big Data Critical Industrial Systems Online Trust & Transparency for Privacy Reference Models Current and Future Cybersecurity Threats Existing Solutions Gap Analysis Promising concepts Evaluation, prioritization, selection & consultation with stakeholders Research Items Research Agenda

23 What is the role of the market study? To validate whether the identified gap between cyber threats and cyber research (challenges) is experienced by the (main market) players. To assess the market structure and dynamics features determining the innovativeness of the market support / prioritise / validate the timeline choices of cyber-security research agenda

24 What is the role of the market study? To validate whether the identified gap between cyber threats and cyber research (challenges) is experienced by the (main market) players. To assess the market structure and dynamics features determining the innovativenessof the market support / prioritise / validate the timeline choices of cyber-security research agenda

25 What is the approach? Activities: 1. Identify clusters 2. Identify main players: SMEs, MNEs, (semi-) governmental institutions, universities 3. Conduct interviews

26 The impact of clusters A cluster is a geographical concentration of specialised companies connected through multiple linkages. Since cyber space is a virtual one, does the distance between the entities matter? Do clusters improve the challenge of the multidisciplinary issue? Talent pool: is it enough? Education: is it enough? Value chain collaboration & cooperation Public-Private Partnerships Speed up the gaps identification / evolution?

27 Belgium Cyber Security Coalition LSEC SIRRIS - Cyber Security Agency being established: on the way to PPP - Awareness raising - Knowledge exchange

28 Finland FISC & Jyväskylä & Digile 3 different initiatives: industry, government/municipality, NGO 250 million annually: information security products and services Employees 3,000 people in information security

29 The Netherlands The Hague Security Delta - Official opening ,100 security companies - Public-Private Partnership - Turnover 6 billion - 1,7 billion in the Hague - Employees 60,500 people - 13,400 people in the Hague

30 United Kingdom ADS Group & UK Cyber Security Forum & SITC - UK is worth almost 2.8 billion in High proportion of defence - Public-Private partnership - SMEs focus

31

32