The CyberSANE project is made up of 11 Work Packages with various objectives and concerns. The diagram below shows their targets as well as the different interactions between the WPs.
The Work Packages are as follows :
- WP1: Project Management, lead by PDMFC
- Decision making and conflict resolution.
- Administrative and financial management
- Technical and innovation management
- Quality assurance
- Risk management
- WP2: User requirements and Reference Scenarios, lead by INRIA
- Elicit, collect and analyse requirements associated with security incident management in CIIs
- Specify the close to real-life pilot scenario
- Entail preliminary analysis of legal and ethical framework
- Provide specifications of the architecture and delineate implementation process
- Identify high-level legal and ethical requirements associated with the technical innovation
- WP3: Live Security Monitoring and Analysis (LiveNet), lead by S2
- Desk research assessment on available security threat models with respect to suitability in CIIs
- Integrate cyber security monitoring sensors and tools developed by partners
- Specify necessary Encrypted Network Traffic Analysis mechanisms
- Design and develop appropriate transformation and normalisation techniques and functionalities
- Design and develop the LiveNet component
- WP4: Deep and Dark Web mining and intelligence (DarkNet), lead by JSI
- Identify methods and tools
- Specify and develop Deep and dark web crawling functionalities
- Specify and develop Social media crawling functionalities
- Specify methods and algorithms for prediction, knowledge extraction and business intelligence
- Design and develop the DarkNet component
- WP5: Data Fusion, Risk Evaluation and Event Management (HybridNet), lead by ATOS
- Produce efficient high-performing algorithms for generating multi-order evidence dependencies
- Produce reasoning method for optimisation of automatic analysis of huge amounts of data from different sources to identify malicious actions
- Evaluate proposed Evidence Chains Generation Algorithms and adopted data processing techniques
- Design and develop Security Incident/Attack Simulation and Behaviour Simulation Environments for facilitation of experimental data processing
- Design and develop the HybridNet component
- WP6: Intelligence and Information Sharing and Dissemination (ShareNet), lead by CNR
- Perform desk research assessment on available Threat Intelligence and Trust Management approaches and technologies for CIIs
- Design and develop Intelligence and Information Sharing models
- Specify and develop protocols and procedures required to guarantee secure communication and storage of incident-related data
- Design and develop the ShareNet component
- WP7: Privacy & Data Protection (PrivacyNet) Orchestrator, lead by PDMFC
- Perform assessment of all available security and privacy enabling technologies
- Specify security-related modelling methods and techniques for cyber incident handling
- Specify and develop the PrivacyNet component
- WP8: CyberSANE System Visualisation, Integration, Deployment and Fine tuning, lead by MAG
- Bundle and integrate all components in a single integrated system
- Customise, localise and deploy the integrated system across pilot sites
- Provide continuous technical support
- Take into consideration feedback received from pilots and improve the incident handling system accordingly
- WP9: Pilot Preparation and Operations, lead by VPF
- Plan pilot operations in detail
- Ensure engagement of target number of CII operators and stakeholders at pilot sites
- Train end-users to use the system
- Conduct pilot operations based on stakeholder involvement from partners and external pilot users
- Solicit and collect pilot user feedback
- WP10: Pilot Operations and Validation, lead by KN
- Establish evaluation and benchmarking methodology including tools, instruments and techniques
- Evaluate results from different perspectives
- Perform technological, usability and techno-economic evaluation of incident handling approach and associated system implementation
- Produce range of best practices and policy development guidelines for wider use of approach in scope of CIIs
- WP11: Dissemination, Exploitation, Sustainability and Market Take up, lead by ATOS
- Disseminate project results towards all relevant audiences as widely as possible
- Handle innovative results produces within the project and relative IPRs with partners contributions to the project resources
- Provide overall and individual exploitation/sustainability report plans
- Establish and engage external groups in validation, evaluation and wider use of results
- Closely collaborate with standardisation bodies and the NIS platform towards transforming CyberSANE to an EU wide best practice and blueprint for incident handling framework implementation
