Högskolan i Skövde

A literature study has identified the major impacts of importantdesign choices in simulation models and simulation-games that model criticalinfrastructure resilience. The four major groups of design choices discussed inthis article are: (1) the chosen learning goal (system understanding or collaborationtraining), (2) realism and time scale of the scenario, (3) design of playerroles and communication rules, (4) number of action alternatives, replay-abilityand richness of performance feedback while playing. Researchers and practitionerswho build simulation-games for studying critical infrastructure resiliencecan use the accumulated insights on these four aspects to improve the quality oftheir game design and the quality of the simulation models the game participantsinteract with.

Critical infrastructures become more and more entangled and rely extensively on information technology. Adeeper insight into the relationships between critical infrastructures enables the actors involved to more quicklyunderstand the severity of information technology disruptions and to identify robust cross-functional mitigatingactions. This study illustrates how and why disruptions in the payment system in Sweden could create cascadingeffects in other critical infrastructures with potentially severe consequences for many citizens, governmentinstitutions and companies. Data from document studies, interviews and workshops with field experts revealseven challenges for collective cross-functional critical infrastructure resilience that need to be dealt with: 1)Shortage of food, fuel, cash, medicine; 2) Limited capacity of alternative payment solutions; 3) Cities are morevulnerable than the countryside; 4) Economically vulnerable groups in society are more severely affected; 5)Trust maintenance needs; 6) Crisis communication needs; 7) Fragmentation of responsibility for criticalinfrastructures across many actors.

Critical infrastructures (CIs) are becoming increasingly sophisticated with embedded cyber-physical systems (CPSs) that provide managerial automation and autonomic controls. Yet these advances expose CI components to new cyber-threats, leading to a chain of dysfunctionalities with catastrophic socio-economical implications. We propose a comprehensive architectural model to support the development of incident management tools that provide situation-awareness and cyber-threats intelligence for CI protection, with a special focus on smart-grid CI. The goal is to unleash forensic data from CPS-based CIs to perform some predictive analytics. In doing so, we use some AI (Artificial Intelligence) paradigms for both data collection, threat detection, and cascade-effects prediction. 

Military forces operate in complex and dynamic environments [1] where bad decisions might have fatal consequences. A key ability of the commander, team and individual warfighter is to quickly adapt to novel situations. Live, Virtual and Constructive training environments all provide elements of best practices for this type of training. However, many of the virtual training are designed without thorough consideration of the effectiveness and efficiency of embedded instructional strategies [2], and without considering the cognitive capabilities and limitations of trainees. As highlighted recently by Stacy and Freeman [3], large military training exercises require a significant commitment of resources, and to net a return on that investment, training scenarios for these events should systematically address well-specified training objectives, even if they often, do not.

In order to overcome these shortcomings with both Live and Virtual training systems and following our previous work [4,5,6], this paper presents a design solution for a proof-of-concept prototype that visualizes and manages training objectives and performance measures, at individual and collective levels. To illustrate its functionality we use real-world data from Live training exercises. Finally, this paper discusses how to learn from previous training experiences using data mining methods in order to build training models to provide instructional personalized feedback to trainees.

Cybersecurity success is essentially the result of an effective risk management process. However, this process is being challenged by the inherent complexity of systems, developed with vulnerable components and protocols, and the crescent sophistication of attackers, now backed by well-resourced criminal organizations and nations. With this scenario of uncertainties and high volume of events, it is essential the ability of cyber resiliency. Cyber resiliency is the ability of a system, organization, mission, or business process to anticipate, withstand, recover from, and adapt capabilities in the face of adversary conditions, stresses, or attacks on the cyber resources it needs to function. In the present work, it is presented a framework for cyber resiliency where a segmentation strategy and the Intrusion Kill Chain (IKC) attack model, developed by Lockheed-Martin, are central elements. Segmentation allows the construction of a layered defense, where the highest-priority assets are in the inner layers and the attackers are forced to surpass several layers to reach them. The IKC attack model is a model of seven phases that the attackers must perform to achieve their goals. Each segment is supposed to be designed with the best efforts to prevent, detect and contain an IKC. According to the Situational Awareness (SA) model of Endsley, the Level of Perception is achieved through sensors connected to the controls of prevention, detection and containment of IKC in different segments. The Level of Understanding is obtained by identifying the segments impacted by the attackers, and the Level of Projection by the identification of the next segments to be attacked and defense actions required to contain this advance. The use of the framework leads to the development of a structured set of defense mechanisms, and supports the development of SA capability to allow defenders to make correct decisions in order to maintain the mission even under a heavy attack

In Security Operations Center there is a need to perceive, comprehend and project cyber activities. Therefore it requires developing Cyber Situational Awareness (CSA) capability that involves perception of different security events, comprehension of the meaning of the current cyber security situation in the organization, and the projection of future status in order to select better positioning of security mechanisms. Current techniques of CSA are limited by the high speed of events generation, large volume of information from multiple sensors, and the complexity of interactions of highly automated services that shape the Cyberspace. This study presents a framework to track and project multistage cyber-attacks supporting CSA activities and enables a faster correlation of event logs using Big Data Technologies.

In order to identify needed skills and competencies for privacy and security, we propose a systematic process that maps privacy and security threats to related controls that are required to prevent, detect or remove such threats. This work suggests how to apply the process, while discussing how games and simulations can be used both to develop the desired behavior and to monitor the current competency level.

This work‐in‐progress paper presents a proposal on how to consider cyber security for the middleware system architecture. The text discusses the steps needed to incorporate cyber security aspects to the Interoperability Reference Model Architecture. The Interoperability Reference Model Architecture was chosen since it provides an effective communication process among components of distributed Real‐Time Systems. The process reduces architectural layers and the development effort due to the formalized reference model design. Also, it may be pointed that the decision for the selection of this framework benefits from a previous research in which the Interoperability Reference Model Architecture was applied in a Real‐Time System prototype to test and validate it. In this research, the focus will be the incorporation of cyber security aspects to Interoperability Reference Model Architecture.

A trend over the past years is that simulation systems for training are being connected in simulation networks, allowing the interaction of teams spread in distributed sites. By combining interconnected simulation systems the simulation complexity increases and may affect time-critical simulation tasks in a negative way. As a consequence, the training simulation objectives may not be met. The same problem may occur when performing, for example, mission rehearsal on site, since available computation resources are usually very limited in this scenario, or for a joint fires scenario, where the large and complex functional chain (including intelligence, C2, forward observer, pilots, etc.) may overload existing resources. In this work, the technique of imprecise computation in real-time systems (ICRS) to preserve time-critical simulation tasks is presented. The ICRS technique allows time-critical tasks to produce quicker solutions for approximate results and saves computational resources. This paper discusses the main advantages of theICRS technique by a review of the commonly used optimization concepts built upon imprecise computation field. Thepaper ends with presenting a work-in-progress: an architectural solution for aligning ICRS with the High Level Architecture (HLA), standardized as the IEEE 1516-series.