1. 1 Dr. Spyros Papastergiou, University of Piraeus (Greece)–Dept. of Informatics paps@unipi.gr M. Zaharias Singular Logic (Greece) CYSM Risk Assessment Methodology & Tool Demonstration

2.  Basic Concepts  CYSM Objectives  CYSM Risk Assessment Methodology  CYSM System Architecture & Services  CYSM System Demonstration Topics

3. Commercial Ports

5. Objectives  O1: To introduce a targeted risk management methodology for port CIIs, taking into account the protection of physical and cyber assets. The methodology will be aligned to relevant standards and legislation.  O2: To implement, deploy and evaluate an integrated security management system (for CII operators) enabling asset modeling, risk analysis, anticipation/management of attacks, as well as stakeholders’ collaboration.  O3: To increase the collaboration between European port stakeholders towards improved management of the physical and cyber nature of CIIs in a harmonized manner.  O4: To document best practices for integrated security management of port CIIs. Accordingly, to disseminate them to maritime policy-shaping groups (e.g., ECSA, ICS-ISF) and contribute towards an acceptable, applicable Integrated Maritime Policy (IMP).

6. Consortium PartnerRole PORT INSTITUTE FOUNDATION OF STUDIES AND COOPERATION OF THE VALENCIA REGION (FEPORTS) Project Coordinator UNIVERSITY OF PIRAEUS RESEARCH CENTRE (UPRC)Technical Manager SINGULARLOGIC ANONYMOS ETAIRIA PLIROFORIAKON SYSTIMATON & EFARMOGON PLIROFORIKIS (SiLo) Technical Partner Università degli Studi di Genova (DITEN)Technical Partner Piraeus Port Authority S.A. (PPA) Pilot Valenciaport Foundation for Research, Promotion and Commercial Studies of the Valencian region (VPF) Pilot Port-of-Mykonos (POM) (subcontractor of SiLo) Pilot

7. CYSM Risk Assessment Methodology CYSM Risk Assessment Methodology is oriented:  to cover the security and safety requirements on the demanding sector of commercial ports,  to assess all the physical and cyber facilities required for the robust and uninterruptible operation of ports  physical facilities such as buildings, platforms, gates, marinas, data centers, platform  cyber facilities such as networks, equipment, satellites, servers, relay stations, tributary stations, information, etc.

8. Requirements CYSM Risk Assessment Methodology should satisfy:  Compatible with standards (e.g. ISO27001, and ISPS code)  Multi-scope analytic: Be able to perform risk analysis using different scopes  Collaborative: Ensures collaboration among all port users  Broad analytic: Analyses sectoral, interconnected and interdependent threats  Time and resource economical: Avoids the plethora of questionnaires and frustrating interviews with all participants  Accurate: Derives accurate results  Good Functional requirements: Needs to be clear for all actors involved, precise, and measurable  Easy to implement: Easy to implement the methodology  Well documented: All steps of the methodology can be documented in clear format with clear outcomes for each step  Responsibility centric: Methodology has to be oriented to users’ role

9. General Approach of CYSM Methodology

11.  Open Standards: adoption of peak technologies and worldwide accepted and mature standards  Interoperability: adoption of world-wide known and used open standards as the core communication protocol (Interconnection of many distributed and heterogeneous systems (Efficient & Quicker Integration)  Modularity: Complex systems consist of a large number of different modules that interact in a non-simple way, and tiers.  Reusability: all essential primary functions that can be easily reused, configured and customized in every service  Scalability & Extensibility: robust and extensible in order to efficiently support ports’ business activities  Security: five critical security requirements Authentication, Integrity, confidentiality, Non-repudiation, Availability  Privacy: support of mechanisms that provide effective and efficient management of users’ identities and access rights to the system Architectural Design Principles

12.  Support for information security risk management knowledge codification  Support for information security management personalization  Support for collaboration  Role-specific content views  Descriptive approach Overall requirements

13. CYSM System Architecture

14. Security & Safety Management Services

15. Impacts for the Mediterranean Ports Raise their cyber and physical intelligence and culture Harmonize their digital security practices Improve the trust in the maritime environment Increase predictability and reduce uncertainty of business operations Provide the appropriate guidance to the ports’ personnel (selecting security countermeasures, upcoming threats, best practices and related regulations) Assist them on how to comply with legal and regulatory frameworks

16. Mykonos-GR