CIPSEC architecture CIPSEC workshop Frankfurt 16/10/2018 Rubén Trapero Burgos, ATOS Co-funded by the Horizon 2020 Framework Programme of the European Union

CIPSEC Framework Design Principles Critical Infrastructures Commonalities Security Threats CIPSEC pilot requirements Data Lifecycle in Critical Infrastructures CIPSEC architecture

Data Acquisition Data Consumption Data Dissemination Host and Network Sensors SOC Expertise Agents, sensors, sniffing, etc Data Acquisition Security Decision-Making Security Compliance Activity and Security Data (LOG) Status Heartbeats Reports Data Consumption Data Dissemination User Credentials Events/Alarms Tokens Software updates Security Data Insights Security Apps PKI Infrastructure Sotware Repository Dashboards Human End-Users (CI System admins) Post-Mortem Incident Analysis Security Operation Center Personnel Visualization of data Recommendations System administration Aggregate data Filter Data Reasoning Detect anomalies Document Management Repository Security and Activity monitoring engine

Acquisition Data Acquisition Data Consumption Data Dissemination Host and Network Sensors SOC Expertise Agents, sensors, sniffing, etc Acquisition CIPSEC Core Framework Data Acquisition Security Decision-Making Security Compliance Activity and Security Data (LOG) Status Heartbeats Reports Data Consumption Data Dissemination User Credentials Events/Alarms Tokens Software updates Security Data Insights Security Apps PKI Infrastructure Sotware Repository Dashboards Human End-Users (CI System admins) Post-Mortem Incident Analysis Security Operation Center Personnel Aggregate data Filter Data Reasoning Presentation Detection Layer Visualization of data Recommendations System administration User/System manager Data Processing Document Management Repository Network Security Critical Infrastructure Components (sensors, computers, network, servers, routers, …) Security and Activity monitoring engine

High Level CIPSEC Framework Critical Infrastructure Platform User/System manager Layer Presentation Layer Acquisition Layer Detection Layer Data Processing Layer Updating/Patching User training Compliance Management CIPSEC Core Framework Critical Infrastructure Components (sensors, computers, network, servers, routers, …) logs events/alerts correlator admin inferred threats, risks aggregated info (reports, etc) contingency (reconfigurations, etc) CIPSEC security features Compliance report Network Security security data CI security requirements

CIPSEC Framework Reference Architecture

Critical Infrastructure Platform Compliance Management Partners’ role in CIPSEC Reference Architecture Critical Infrastructure Platform CIPSEC Core Framework System manager User/System manager Layer Contingency plan Recommendations Presentation Layer Forensics Analysis Visualization tool Dashboard Data Processing Layer Anonymized Sensitive Data Historic anomalies DB Forensics service Data anonymization and Privacy Updating/Patching Detection Layer Compliance Management Anomaly detection reasoner Acquisition Layer External Security Services Future security services plugged Endpoint Detection and Response Vulnerability Assessment Identity Access Management Integrity Management Crypto services Network Security (DPI firewalls, routers with ACL, network segmentation, DMZ, NAC, etc.) Critical Infrastructure Components (sensors, computers, network, servers, routers, …) User Training

CIPSEC Blocks Covered with Products Reference Architecture Block Products Involved Dashboard Forensics Analysis Visualization tool Data anonymization and Privacy Anomaly detection reasoner Identity Access Management Integrity Management Crypto services Endpoint Detection and Response CIPSEC Pilots

CIPSEC Blocks Covered with Services CIPSEC Core Services Service Leader Contingency Plan Forensics Service Vulnerability Assessment Updating / Patching User Training Compliance Management CIPSEC Pilots

Innovation targeted by CIPSEC Framework CIPSEC proposal is not centred on providing an isolated solution for cybercrime but a more broad solution. CIPSEC which is not addressing individual aspects of large crisis but provides a global solution including additional services related with CIP.   CIPSEC provides a more generic solution, focusing not only on securing network edge services of cloud infrastructures in CI scenarios, but also on the global picture, taking into account existing interdependencies. CIPSEC offers a close-to-market security platform with real validation trials on real CI operational scenarios.

Thanks for your attention! Questions? Contact: Antonio Álvarez ATOS antonio.alvarez@atos.net Rodrigo Díaz ATOS rodrigo.diaz@atos.net Rubén Trapero ATOS ruben.trapero@atos.net www.cipsec.eu @CIPSECproject https://www.linkedin.com/in/cipsec-project/ https://www.youtube.com/channel/UCekxicSFAwZdIPAV3iLHttg CIPSEC Technical Review Meeting Barcelona 22/11/2017