© CARONTE·· Slide 1
The research leading to the results of the project has received funding from the European Union Seventh Framework Programme (FP7/2013-2016) under grant agreement n° 606967.
Brussels, 11. June 2015
Joachim Kochsiek - Coordinator
CARONTE – MID TERM CONFERENCE
© CARONTE·· Slide 2
AGENDA OF THIS PRESENTATION
The project in brief
Main objectives
Approach
Interims results
About today
© loosely-coupled / fotolia.com
© CARONTE·· Slide 3
AGENDA OF THIS PRESENTATION
The project in brief
Main objectives
Approach
Interims results
About today
© loosely-coupled / fotolia.com
© CARONTE·· Slide 4
The project in brief
Duration: September 2014 to February 2016
CARONTE is a FP7 project but contributes to H2020
H2020 reinforces support to EU’s security policies
Improving competitiveness of EU industries to address security gaps and prevent threats (incl. cyber-threats)
CARONTE is Coordination and Support action not a research project
Fotolia_56826856_Subscription_Monthly
© CARONTE·· Slide 5
The project in brief – CARONTE in relation with existing security projects
Current and finalised projects:
Work on specific, sometimes very detailed issues
Provide concrete results (products, measures, processes) for implementation
Proposes future research and policy activities
Considers existing project and achieved results
Recommends new and follow up approaches
© CARONTE·· Slide 6
The project in brief – partners
University of Security Management in Košice(USMKE)
11 Partners covering 8 Member States from North to South and from West to Eastand all transport modes
© CARONTE·· Slide 7
AGENDA OF THIS PRESENTATION
The project in brief
Main objectives
Approach
Interims results
About today
© loosely-coupled / fotolia.com
© CARONTE·· Slide 8
Main objective
CARONTE addresses the question:
„How can a Research Agenda most efficiently tackle current and future threats to land transportation?“
© CARONTE·· Slide 9
Objectives from operators’ point of view
Looking at relevance
Keeping transport flow easy and affordable
Considering and supporting European cohesion by cheap and easy transport with a high level of security
Searching for synergies in security and transport processes, technologies,...
“Those who give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.”(Benjamin Franklins’ Contributions to the Conference on February 17 (III) Fri, Feb 17, 1775
Operative relevance
Cargo theft /
extreme weather /reliability
Terrorism
© CARONTE·· Slide 10
Objectives from operators’ point of view
Looking at relevance
Keeping transport flow easy and affordable
Considering and supporting European cohesion by cheap and easy transport with a high level of security
Searching for synergies in security and transport processes, technologies,...
Those who give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.”(Benjamin Franklins’ Contributions to the Conference on February 17 (III) Fri, Feb 17, 1775
Operative relevance
Cargo theft /
extreme weather /reliability
Terrorism
Terroris
m is no daily
business
?! But take in
mind th
e
unfore
seeable!
What c
ould one imagine
before
9/11?
© CARONTE·· Slide 11
AGENDA OF THIS PRESENTATION
The project in brief
Main objectives
Approach
Interims results
About today
© loosely-coupled / fotolia.com
assessment of the state of play
existing and emerging risks
High Level Advisory Board
Gaps and requirements
Potential approaches and
solutions
High Level Advisory Board
FINAL RESEARCH AGENDA AND ROADMAP
Approach
© CARONTE·· Slide 13
AGENDA OF THIS PRESENTATION
The project in brief
Main objectives
´Approach
Interims results
About today
© loosely-coupled / fotolia.com
© CARONTE·· Slide 14
Interims results –State of the play
Assessment of the state of play in security and in transport
Identified projects, best practices, regulations and standards
Created characteristic sheets for each item (available on the web-site, soon)
Different analyses to verify and consolidate state of the play
Challenge: Many policies are in preparation, many research project are active, fulfilled on national and EU-level,....
Survey is not over
© a_korn / fotolia.com
© CARONTE·· Slide 15
Interims results –State of the play
Assessment of the state of play in security and in transport
Analysis of the results - Split among various inputs
© CARONTE·· Slide 16
Status and interims results –State of the play
Relevant policies as a frame for land transportation Frames for transport
European Agenda on SecurityOf note: Cyber, CBRNE, counter radicalism and recruitment, counter organised
crime, resilience
European Agenda on SecurityOf note: Cyber, CBRNE, counter radicalism and recruitment, counter organised
crime, resilience
EU approach
to the detection
and mitigation of CBRN-E
risks
EU approach
to the detection
and mitigation of CBRN-E
risks
An open and
secure Europe:
making it happen(covers
migration)
An open and
secure Europe:
making it happen(covers
migration)
Customs Risk
Manage-ment and Security of the supply chain
Customs Risk
Manage-ment and Security of the supply chain
Cyber Security Strategy
and Proposal
for Directive to ensure
a high common level of
NIS
Cyber Security Strategy
and Proposal
for Directive to ensure
a high common level of
NIS
A European program
for Critical Infra-
structure protection
A European program
for Critical Infra-
structure protection
Preventing
Radicali-sation to Terrorism
and Violent
Extremism
Preventing
Radicali-sation to Terrorism
and Violent
Extremism
© CARONTE·· Slide 17
Interims results –State of the play
H2020 Calls from Work Program – Secure societies – Preotecting freedom and security of Europe
CRITICAL INFRASTRUCTURE
PROTECTIONSEC - CIP
Disaster-resilience: safeguarding and securing society,
including adapting to
climate changeSEC - DRS
Fight against crime and Terrorism
SEC - FCT
Border Security and External Security
SEC – BESDetection DIGITAL SECURITY
H2020 adresses many aspects from the policies
© CARONTE·· Slide 18
Interims results –State of the play
Work Program Smart, green and integrated transport can indicate new
Solutions
Threats
SafetyInfrastructure
ResilienceSocio-economic and behavoural
Physical internetAutomated road
transport
Intelligent transportation
systems
© CARONTE·· Slide 19
Interims results –Risks
Identifying existing and emerging risks (WP3)
Identified 252 risk scenarios(description of source, reason, method, threat, impact, vulnerability,...)
Assessed relevance of the scenarios with different methods
Identified main vulnerabilities, threats and risks in quantity and quality statements
Included external experts via a cyber-security-workshop
© a_korn / fotolia.com
© CARONTE·· Slide 20
Interims results –Risk scenarios
Security Target Number of reported risk scenarios
1. Road 782. Rail 129
2.1 Connecting Infrastructure 392.2 Mobile units 162.3 Control systems 102.7 Cargo 162.8 Passenger 14
4. Interfaces 23
Analyses made, lead to qualitative statements for potential risks and threats
© CARONTE·· Slide 21
Interims results –Risks
Physical risks Personal risks Cyber risks Crime Rising violence in cargo theft Rising organisation of crime Bombing (often by suicide
attackers or with the help of vehicles) the most important mean of terrorists (followed by sabotage, and arson)
Very low, up to no, reporting of dirty bombs, or poison
Attractive targets are junctions, tunnels, and bridges
Also important passenger trains (especially Metros, as frequently seen in Russia or Belarus)
Aging or poorly maintained infrastructure in some countries can cause more vulnerabilities, as robustness, bypassing possibilities or the likelihood or easiness to cause failures rise
Staff as a target of criminals or terrorists
Staff as an enabler for terrorists and criminals
Force / extortion Corruption Lack of knowledge (IT-Security,
security recommendation) Careless Lack of acceptance due to
complexity of use regarding IT and IT Security
Lack of education and training in security and in use of modern technologies, processes and IT
Lack of motivation Each private end device which has
access to a network could be a security risk
Internet of the things introduces new communication between items with new potential gates for attacks
Software errors multiple with the number of connected systems
Open information flow in logistic systems also offers gates for criminals and terrorists
IT-Systems with different levels of security, especially quickly aging software or hardware in connected systems introduces weak points to a chain
Access to web based communication systems with unsecured end devices (esp. private devices with lower security standard and not hardly manageable security policies)
Rising interconnection and interdependency of traffic management and control systems also with relation to safety (automatic train control)
Outsourcing of IT-Systems also for traffic control with new interfaces and actors and uncertain security measures
Spoofing of information / signals Disturbing of information / signals As vehicles communicate between
each other spoofing of information or infiltration of wrong information can cause high risks in transport
New dangers due to increasing ICT and connectivity in more and more automatic and autonomous cars
© CARONTE·· Slide 22
Interims results –Risks
Physical risks Personal risks Cyber risks Crime Rising violence in cargo theft Rising organisation of crime Bombing (often by suicide
attackers or with the help of vehicles) the most important mean of terrorists (followed by sabotage, and arson)
Very low, up to no, reporting of dirty bombs, or poison
Attractive targets are junctions, tunnels, and bridges
Also important passenger trains (especially Metros, as frequently seen in Russia or Belarus)
Aging or poorly maintained infrastructure in some countries can cause more vulnerabilities, as robustness, bypassing possibilities or the likelihood or easiness to cause failures rise
Staff as a target of criminals or terrorists
Staff as an enabler for terrorists and criminals
Force / extortion Corruption Lack of knowledge (IT-Security,
security recommendation) Careless Lack of acceptance due to complexity
of use regarding IT and IT Security Lack of education and training in
security and in use of modern technologies, processes and IT
Lack of motivation Each private end device which has
access to a network could be a security risk
Internet of the things introduces new communication between items with new potential gates for attacks
Software errors multiple with the number of connected systems
Open information flow in logistic systems also offers gates for criminals and terrorists
IT-Systems with different levels of security, especially quickly aging software or hardware in connected systems introduces weak points to a chain
Access to web based communication systems with unsecured end devices (esp. private devices with lower security standard and not hardly manageable security policies)
Rising interconnection and interdependency of traffic management and control systems also with relation to safety (automatic train control)
Outsourcing of IT-Systems also for traffic control with new interfaces and actors and uncertain security measures
Spoofing of information / signals Disturbing of information / signals As vehicles communicate between
each other spoofing of information or infiltration of wrong information can cause high risks in transport
New dangers due to increasing ICT and connectivity in more and more automatic and autonomous cars
Problem:relevance and likelihood of risks
“expect the unforseeable”
© CARONTE·· Slide 23
Interims results –Risks
Compensating and relativizing statements
Density of land transport networks make bypassing of weak points easy
Public transport companies and authorities have made large efforts to improve the security
Terrorist attacks have not been reported in the supply chains in Europe
Dirty bombs or poisoning have not been reported (apart from the Sarin Attack in Tokyo 1995), although the general
discussion about the possibility is present.
© CARONTE·· Slide 24
Interims results –Gaps
Gap & Requirement analyses bases on three pillars
Matrix-Analyses of threats vs. research
projects, policies, standards,...
Matrix-Analyses of threats vs. research
projects, policies, standards,...
Expert interviewsExpert interviews Expert workshopExpert workshop
© CARONTE·· Slide 25
Interims results –Gaps&reqirements
Sectors
RailRailRoadRoad
CyberCyber Interfaces /Logistics
Interfaces /Logistics
Cross cutting / Generic
Cross cutting / Generic
© CARONTE·· Slide 26
Interims results –Gaps&reqirements
Maintain freely accessible systemStaff • education, learning, awareness•selection•ProtectionSharing of best practicesFinance•value •cost coverage•EfficiencyUsability of security solutions•Standardisation (danger or enabler?)Ethical / privacy issues•obstacle or driver?Detection and monitoring systemsRisk assessmentCrises management
The top headlines
Cross cutting / Generic
Cross cutting / Generic
© CARONTE·· Slide 27
Interims results – Some (main) statements from the Advisory Board
Need of general solutions to deal with hazards – all hazard approach
Need to assess the value of security and preparedness
Rehabilitation of operations to be improved
Global supply chains make supply more vulnerable
Soft measures to improve security: Education Awareness Understanding risk assessments
Need of a definition of criticality
Considering customers needs
© CARONTE·· Slide 28
Interims results –Potential development directions / visions
Finalisation of gaps, risks or state of the art not yet possible or even
dangerous indicators shown
Working-Groups finding potential approaches and matching with
continuing analyses of gaps, risks,....
Matching and selecting relevant approaches at a later stage
Rail Road CyberInterfaces /
logistics
Mass of data, opinions, ongoing activities difficult to handle
© CARONTE·· Slide 29
Interims results –Potential development directions / visions
Finalisation of gaps, risks or state of the art not yet possible or even
dangerous indicators shown
Working-Groups finding potential approaches and matching with
continuing analyses of gaps, risks,....
Matching and selecting relevant approaches at a later stage
Rail Road CyberInterfaces /
logistics
Mass of data, opinions, ongoing activities difficult to handle
Next slide shows the full range of ideas
Not yet consolidated to future needs
© CARONTE·· Slide 30
Interims results –Solutions / Visions summary
Increased cyber securityIncreased cyber securityEducation and learning actions
Education and learning actions
Assessment of the value of security
Assessment of the value of security Testing areasTesting areas
Harmonisation and clearance of standards
Harmonisation and clearance of standards
Awareness and in general integrated security
Awareness and in general integrated security
Identification the real transport needs and the reals use of it
CARONTE
Identification the real transport needs and the reals use of it
CARONTE
Defining and assessment of criticality
Defining and assessment of criticality
Cheap and easy to integrate detection technologies
Cheap and easy to integrate detection technologies
© CARONTE·· Slide 31
Interims results –Result / view forward
Many aspects could be solved by policies and activities in general security
The more transport is integrated in general security the better or
Standards set by transport solutions as lighthouses or standards
Question: How to integrate transport and how to transfer to transport CARONTE
© CARONTE·· Slide 32
AGENDA OF THIS PRESENTATION
The project in brief
Main targets
Approach
Interims results
About today
© loosely-coupled / fotolia.com
© CARONTE·· Slide 33
Interims results –About today
Panel I. Land Transport: the salient issues – and general industry needs
debate on land transport security trends, obstacles facing the sector, cost considerations for public vs private sector, threat analysis; privacy vs security issues
The current activities and needs / demands / aspects from the industry
Panel II. European & national security research needs in land transport, from global to local: keeping land transport moving
How to come from the needs and frames to practical results on local and sectorial basis
How to treat policies and directives on local and sectoral sector
Demands: How can CARONT provide added value to the completed or ongoing security projects?
Top Related