Full III Validation Exercise Demonstration 15th November 2017

Full III Exercise Overview (1) - Setup Replicate and validate the full GAMMA architecture Several integrated security prototypes and security management entities (geo-distributed) Human operators Additional (but non-relevant) incoming messages simulated by security event generators (to achieve a more realistic workload) © GAMMA.All rights reserved

Full III Exercise Overview (2) - Threats Realistic coordinated and non-coordinated cyber attacks according to threats identified in GAMMA Hacker attack on System-Wide Information Management (SWIM) to manipulate essential aeronautical weather data Hacker attack on airplane systems via on-board network © GAMMA.All rights reserved

Full III Exercise Overview (3) - Measurements Situational Awareness (SASHA) System Usability (SUS) Trust (SATI) Reaction & Transmission times False Alerts / Missed Alerts User Acceptance + Tailor-made questions and subjective feedback from observers © GAMMA.All rights reserved

Full III Exercise Overview (4) - Runs Performed Runs: Run ID Date Internal Validation Runs (GAMMA operators from Leonardo): IV1-1 15th Mar 2017 IV1-2 IV2 22nd Mar 2017 IV3-1 11th Apr 2017 IV3-2 Final Validation Runs (external persons acting as GAMMA operators) FV-1 4th May 2017 FV-2 © GAMMA.All rights reserved

Coordinated Countermeasures European Level Correlation + Coordinated Countermeasures EGCC EGCC Attack Warning Attack Warning Sanitized Alert Sanitized Alert Sanitized Alert Sanitized Alert Attack Warning Attack Warning No correlation NGSMP 1 NGSMP 1 NGSMP 2 NGSMP 2 NGSMP 3 NGSMP 3 Alert Alert A passenger tries to hack on-board systems IMC IMC Alert Alert SWIM Node Alert Alert Hacker Attack on SWIM Target: Essential Aeronautical Weather Data 03:30 / UTC 12:28:54 Start 05:16 / UTC 12:30:40 1st SWIM Attack starts 05:25 / UTC 12:30:49 IEG 1 detects and sends report to NGSMP1 05:30 / UTC 12:30:54 IEG 1 report received at NGSMP1 05:44 / UTC 12:31:08 NGSMP1 forwards the report to EGCC 05:59 / UTC 12:31:23 EGCC receives the IEG1 alert 06:31 / UTC 12:31:55 IMC attack + report 06:44 / UTC 12:32:08 IMC attack report received 07:00 / UTC 12:32:24 IEG2 attack + report (not visible in the video) 07:14 / UTC 12:32:38 IEG2 attack report received 07:28 / UTC 12:32:52 NGSMP2 forwards the IEG 2 report to EGCC 07:39 / UTC 12:33:03 Received and Correlation at EGCC 07:49 / UTC 12:33:13 Forward to NGSMP3 07:55 / UTC 12:33:19 Forward to SWIM IEG 1 IEG 1 IEG 2 IEG 2 Weather Data SWIM Country 1 Country 2 Country 3

© GAMMA.All rights reserved Quick Facts After the second part of the coordinated attack is detected, the identification (even in a geo-distributed setup) can easily be done in less than one minute All attacks were successfully defended Very few false alerts in all exercise runs Safe and efficient handling of security information Average reaction time of human GAMMA operators (noticing the alert, understanding the alert, decision making and taking action): 23 sec Positive user acceptance and experts feedback © GAMMA.All rights reserved Trust, Usability, Situational Awareness

© GAMMA.All rights reserved Partners involved Partner Role Component Location DLR Exercise Lead / Coordination Multi-Screen Workstation Braunschweig, Germany Leonardo SMP operator NGSMP1, NGSMP2, EGCC, SEGs Chieti, Italy Airbus DS IEG operator IEG 1, IEG 2 (Stub) IEG 1: Elancourt, France, IEG 2: Chieti, Italy TRT IMC operator IMC Reading, UK 42Solutions IDS operator IDS NGSMP1, IDS NGSMP2, IDS NGSMP3, IDS EGCC Eindhoven, Netherlands Boeing RTE SWIM Node operator SWIM Node Madrid, Spain © GAMMA.All rights reserved Wer hat was wo gemacht Quick facts