1. TÜBİTAK – BİLGEM – SGE Cyber Security Institute
Asım Gençer Gökce
TÜBİTAK BİLGEM Cyber Security Institute (SGE)
Role: Cyber Security Services Unit Manager/Project Manager
Targeted Call (CIP Session):
CIP : Prevention, detection, response and mitigation of the combination of physical and cyber threats to the critical infrastructure of Europe
Disclaimer: with the submission of this presentation the consent is given by its author for the organisers to distribute the presentation.
SMIG January 2016

2. TÜBİTAK – BİLGEM – SGE Previous / on going projects
National Critical Infrastructure, Asset and Facility Determination, Risk Assessment and Prioritization Project (2015-…) (funded by the Republic of Turkey, Prime Ministry, Disaster & Emergency Management Authority)
National Critical Infrastructure Information Systems Protection Project ( ) (funded by the Republic of Turkey, Ministry of Development)
Projects funded under European Commission FP7
Managing Threats And Vulnerabilities in the Future Internet (SYSSEC) Project ( )
Cloud For Europe (C4E) Project (2013-…)
Penetration Testing and Security Assessment for critical public sector organizations, financial institutions, etc.
ISO Consultancy for critical sector institutions such as the Turkish Atomic Energy Agency.
SMIG January 2016
- National Critical Infrastructure, Asset and Facility Determination, Risk Assessment and Prioritization Project (2015-…)
General sector assessment in regards to the critical infrastructures
Interviews with each sector facilities/Corporation
Determination of critical assets in each sectors
Prioritization of critical assets
Critical infrastructure assessment (critical infrastructure security assessment metodology) and Critical Sector Assessment Report
Analysis of Energy (Electric, Petrol, Natural Gas, Solid Fuel), Transport (Maritime Lines, Airways, Highways, Railways), Water Managements and Dams, Communication, Banking and Finance, Agriculture and Food, Culture and Turism, Critical Production/Trading Facilities, Health, Critical Public Services
- National Critical Infrastructure Information Systems Protection ( )
Risk Analysis methodology formulation.
Penetration tests and audits of critical sectors
Analysis of Energy, Communication, Water and Wastewater, Government Facilities sectors
“ Information Systems Security ” regulaion development for energy sector
Minimum Security Precautions guideline.
- Advanced Persistent Threat Analysis ( ) (funded by Republic of Turkey Ministry of Transport, Maritime Affairs and Communications)
Objectives of this project is threefold. First objective is developing custom tools and systems for aiding APT analysis tasks in areas including computer and network forensics, as well as malware analysis. Second objective is preparing and publishing analysis documents for guiding agencies on APT analysis. Third and most important objective is conducting on site APT analyses in critical governmental agencies, a total of 21 top agencies, and sharing the findings with a confidential analysis report.
Project has 6 phases, each for 6 months. After every 2 phases, new versions of the tools and documents are published, therefore it is aimed to improve and enhance them after gaining more experience with ongoing APT analyses in agencies."
- Projects funded under European Comission FP7
- Managing Threats And Vulnerabilities in the Future Internet (SYSSEC) ( )
Network of Excellence
Increase cooperation between universities in EU
Specification of future cyber threats
Malware map of Türkiye
- Cloud For Europe (C4E) Project (2013-…)
Contribution to cloud deployment in public sector
Requirements for government clouds
Scenarios for government clouds
Procedures for cloud service procurement
- Penetration Testing and Security Assessment
Custom testing methodology
15 different test categories; DDoS, Social Engineering, External Tests, Web Application, Mobile Application,…
Expert personnel
Automatic reporting
Systems hardening support
Industry specific reports and analysis (like Banking)

3. TÜBİTAK – BİLGEM – SGE Potential partnership activity
CIP : Prevention, detection, response and mitigation of the combination of physical and cyber threats to the critical infrastructure of Europe
Critical infrastructure assessment methodology, risk analysis methodology formulation, Analysis of Critical Sectors
Security audit checklist development of ICT components in the Industrial Control Systems (ICS).
Vulnerability assessment methodology development of ICSs.
Penetration testing methodology development of web and desktop applications of ICSs.
Determination of fuzzing and reverse engineering methods for ICSs.
Firmware analysis methodology development for ICSs components.
Remote Terminal Unit (RTU) security audits and penetrations testing.
ICSs network security and protocol security formulation.
Hardware security testing method formulation for DCSs (Distributed Control Systems), and PLCs (Programmable Logic Controllers).
SMIG January 2016
Analysis of Critical Sectors
Energy (Electric, Petrol, Natural Gas, Solid Fuel),
Transport (Maritime Lines, Airways, Highways, Railways),
Water Managements and Dams,
Communication,
Banking and Finance,
Agriculture and Food,
Culture and Turism,
Critical Production/Trading Facilities,
Health,
Critical Public Services