BU Research Blog

A year ago, we received Fusion funding to build the Bournemouth-Athens Network in Critical Infrastructure Security. The aim of this project was to build collaborative links between the BU Cyber Security Research group and the Information Security & Critical Infrastructure Protection Laboratory at Athens University of Economics & Business (AUEB). We built these links by working on a joint project, which we advanced through visits and other activities.

The aim of our joint activities was to build human-centered specification exemplars of Critical Infrastructure (CI) operating environments.
We depend on infrastructure associated with things like water, gas, electricity, or transport, but the criticality of such infrastructure is usually lost on us because it fades into the background of our everyday lives. The damage or loss of such infrastructure is only felt when it becomes unavailable, and its significance can range from mild annoyance if its means the trains are late, through to civil disorder and loss of life if we are unable to access clean water for a prolonged period. Despite their importance, there are no useful models of environments that people can use when developing or evaluating technology for CI. Our work aimed to remedy this by building specification exemplars for typical CI companies. In doing so, these would capture the human nuances associated with different aspects of CI, and help people identify possible security issues associated with new ideas before, rather than after, they are deployed in the field.

Together, a team of BU and AUEB researchers carried out work to build two specification exemplars of hypothetical CI companies. One of these was a UK Water Company (ACME Water). The other was a rail company in South East Europe (Balkan Rail). BU hosted researchers from AUEB and ran a number of workshops to identify different security aspects of these companies. In return, AUEB hosted BU undergraduate research assistants as they collected data from a Greek CI company, and ran workshops to develop and evaluate different aspects of the exemplars with AUEB researchers.

The exemplars have been made publicly available, and are modelled using CAIRIS – an open-source security design tool maintained by researchers at BU. To date, several publications have so far arisen from our preliminary work building [1] and applying the ACME Water exemplar [2, 3, 4]. We’re also using the exemplars as part of our teaching to provide case studies for Forensic & Computer Security lab exercises and seminars. Although the studies provided are hypothetical, they are grounded in real world data, and make visible to students the root causes of a variety of cybersecurity risks.

Looking forward, our work has gained the interest of a number of UK and international collaborators, and we’re looking for opportunities to build a library of human-cantered specification exemplars for many other, non-CI, environments. Such environments might include homes, and different types of ‘soft target’. Our long term aim is to make sure people don’t design security as an afterthought. Our work on BANCIS has made a small, but significant, step towards achieving this goal.

References

[1] S. Faily, G. Lykou, A. Partridge, D. Gritzalis, A. Mylonas, and V. Katos, “Human-Centered Specification Exemplars for Critical Infrastructure Environments,” in Proceedings of the 30th British HCI Group Annual Conference on People and Computers, 2016.

[2] S. Faily, C. Iacob, and S. Field, “Ethical Hazards and Safeguards in Penetration Testing,” in Proceedings of the 30th British HCI Group Annual Conference on People and Computers: Fusion, 2016. 

[3] D. Ki-Aries, S. Faily, and K. Beckers, “Persona-Driven Information Security Awareness,” in Proceedings of the 30th British HCI Group Annual Conference on People and Computers: Fusion, 2016. 

[4] A. Partridge and S. Faily, “The application of useless japanese inventions for requirements elicitation in information security,” in Proceedings of the 30th British HCI Group Annual Conference on People and Computers: Fusion, 2016. 

Although largely invisible to us, our lives are dependent on critical infrastructure (CI).  CI is made up of roads, rail, pipelines, power lines, together with buildings, technology, and people.  Some of this infrastructure is modern, but much of it is ageing and interconnected in so many ways that we fail to realise our dependency on CI or its dependencies until its loss disrupts our day-to-day lives.

This dependency has not been lost on governments, which now invest significant sums on securing this infrastructure from cybersecurity threats. Unfortunately, in most cases, this investment entails bolting security mechanisms onto existing infrastructure.  Such investment decisions are made by people with little knowledge of the infrastructure they are securing and, has such, little visibility of the impact that poorly designed security might have on the day-to-day delivery of these critical services.  Moreover, because technology innovation does not evolve at the same pace in different cultures, and security which mitigate the risks faced by critical infrastructure in one country may not be as effective in another.   The reason for these differences are myriad, and range from differences in working practices to expectations about the scale of infrastructure being secured.  There is, therefore, a need to evaluate security solutions against specification exemplars based on these nuanced, representative environments.  However, to develop exemplars of such environments requires data collection and knowledge sharing about nuances associated with particular forms of critical infrastructure for different cultures.

The Bournemouth-Athens Network in Critical Infrastructure Security (BANCIS) project will examine and model the nuances associated with two forms of critical infrastructure in different national cultures.  It will do so by building a network between Cybersecurity researchers at BU, and the Information Security & Critical Infrastructure Protection Laboratory at Athens University of Economics & Business (AUB). These nuances will be modelled as specification exemplars of UK and Greek water and rail companies. By developing these exemplars, researchers and practitioners will be able to conduct a cost-effective evaluation of new ideas based on realistic CI environments.  The exemplars will also help students appreciate the challenges associated with designing security for complex, real-world systems.  The exemplars will be modelled using the CAIRIS security design tool; this is an open-source software product maintained by researchers at BU. The data necessary to build these exemplars will be collected over a series of visits by AUB researchers to BU, and BU researcher to AUB.

Please contact Shamal Faily if you’re interested in finding out more about BANCIS, or getting involved in the project.