1 of 11

�European Knowledge Hub and Policy Testbed for Critical Infrastructure Protection�

A novel pan European knowledge network for Resilient Infrastructures

RESEARCH AND INNOVATION SYMPOSIUM FOR EUROPEAN SECURITY AND DEFENSE 2023 | MAY 29^TH – MAY 31^ST | RHODES, GREECE

2 of 11

EU-CIP FACTS & FIGURES

MISSION: Offer data analysis and services (knowledge, insights, foresights and guidance) for the development of evidence-based R&I policies and opportunities in the CIP domain.

EU-CIP is a three-year Coordination and Support Action (CSA) that is funded by the European Commission under the call topic SSRI (Strengthened Security Research and Innovation) Knowledge Networks for security research and innovation. The EU-CIP consortium has 20 partners including the coordinators of recent EU projects in resilient infrastructures in different sectors that are part of the ECSCI cluster. So, the project is a natural evolution of the ECSCI knowledge network on resilient infrastructures.

EU-CIP’s vision is to establish a sustainable knowledge network of European CIP experts and stakeholders, with the mission to provide knowledge, insights, foresights and guidance regarding research and innovation opportunities in the CIP domain. The main goal of EU-CIP is to establish a unique pan European knowledge network for Resilient Infrastructures, which will enable policy makers to shape and produce data-driven evidence-based policies, while boosting innovation capacity.

3 of 11

EU-CIP COVERAGE

Geographical Coverage

North: Finland, Norway
Central: Italy, France, Belgium, Germany, Ireland
Southern-East: Greece, Cyprus, Poland, Romania
Southern-West: Spain, Portugal

Value Chain Coverage

CIP/CIR/security solutions for resilient infrastructures, including end-users and CI operators in various sectors (AIA, FV, FST, ORO, EDF)
CIP/CIR solution providers for these sectors (ENG, GFT, LDO)
Providers of research solutions and practices (LAU, NRS, SINTEF, INOV, DLR, PPHS, KUL)
Innovative high-tech SME with security expertise (ICP, INNOV, EU-VRi).
Standardisation (AFNOR, EOS)

4 of 11

EU-CIP LANDSCAPE

Innovation and policy development for Resilient Infrastructures and Critical Infrastructure Protection (CIP) is a complex, multi-disciplinary process involving different stakeholders and analysing a very rich set of data and information from different sources.

Current Challenges (setback to data-driven evidence-based policy making)

Monitoring and analysing research outcomes, security technologies, policies and standards towards evidence-based policy making.
Infrastructures’ heterogeneity across different sectors
Engaging the required diverse stakeholders at EU scale
Boosting the competitiveness of innovators and providing commercialization opportunities

>> REDUCING information fragmentation

>> ENSURING structured analysis

>> BOOSTING evidence-based policy making

MAIN DRIVERS

Innovation and policy development for Resilient Infrastructures and Critical Infrastructure Protection (CIP) is a complex, multi-disciplinary process that must involve different stakeholders (e.g., CI operators and authorities, innovators, technology providers, policy makers) and must analyse a very rich set of data and information from different sources (e.g., research outcomes, state of the art technologies, policies and standards). To ensure the effectiveness of the policy making and the innovation development processes there is a need for reducing information fragmentation, ensuring the continuous and structured analysis of the state of the art, and boosting evidence-based policy making in the scope of a vibrant ecosystem that engages all relevant stakeholders.

Nowadays, European policy makers and innovators that focus on critical infrastructures security and resilience are faced with the following challenges:

Monitoring and analysing research outcomes, security technologies, policies and standards towards evidence-based policy making: Despite the recent specification of a common EU-wide policy framework for Critical Infrastructures Protection (CIP) and Critical Infrastructures Resilience (CIR), there is still a great variety of research outcomes, technologies, policies, and standards. This complicates the task of mapping the various initiatives into an up-to-date CIR/CIP landscape and is a setback to data-driven evidence-based policy making.
Infrastructures’ heterogeneity across different sectors: There are also many different types of Critical Infrastructures (CIs) in various sectors of the economy like energy, gas, transport, finance, healthcare, water management, industrial sites, e-commerce and more. Hence, there is also a need for understanding the peculiarities of the different sectors for evidence-based policy making and innovation development. This adds up to the complexity of understanding gaps and proposing effective solutions.
Engaging the required diverse stakeholders at EU scale: Stakeholders’ collaboration is a key prerequisite for effective innovation development and research policy making. Therefore, there is also a need for bringing together different CI actors (e.g., CI operators, security experts, security technology providers, CIP system integrators, innovators, policy makers) and for fostering their collaboration.
Boosting the competitiveness of innovators and providing commercialization opportunities: Despite the establishment of many innovation management structures in the EU (e.g., Digital Innovation Hubs (DIHs)), the CIP/CIR field is quite under-represented and under-supported. This is a setback to innovation development and to the commercialization of EU CIP/CIR projects outcomes. CIP/CIR innovation development can greatly benefit from a practical approach to testing and validating solutions that engages end-users (e.g., CI operators) and receives their feedback. In this direction, EU funded projects could serve as solutions and policy testbeds where different policy ideas and linked technical solutions can be validated with active stakeholders’ participation.

5 of 11

EU-CIP MAIN OBJECTIVE

The main goal of eu-cip is to establish a novel pan european knowledge network for resilient infrastructures, which will enable policy makers to shape and produce data-driven evidence-based policies, while boosting the innovation capacity of critical infrastructures (ci) operators, authorities, and innovators (including smes).

In this direction, the EU-CIP consortium partners have already established the European Cluster for Securing Critical Infrastructures (ECSCI), which is a knowledge network that brings together more than 30 EU projects on secure and resilient infrastructures. The main goal of EU-CIP is to establish a novel pan European knowledge network for Resilient Infrastructures, which will enable policy makers to shape and produce data-driven evidence-based policies, while boosting the innovation capacity of Critical Infrastructures (CI) operators, authorities, and innovators (including SMEs).

EU-CIP will offer advanced information analysis capabilities for evidence-based policy making and innovation support services for exploiting and commercializing research outcomes. To maximize the impact of its activities, EU-CIP will establish and grow a vibrant ecosystem of interested and committed stakeholders around the project’s information analysis and innovation support services.

6 of 11

EU-CIP HIGH LEVEL OVERVIEW OF ACTIVITIES AND RESULTS

EU-CIP Main Objectives/Pillars
OBJECTIVE 1 - EU-CIP-ANALYSIS: Enhance Europe’s analytical capability regarding research outcomes, technologies, and policies – foster data-driven evidence-based policy and innovation development.
OBJECTIVE 2 - EU-CIP-AMPLIFY: maximize the impact of R&I CIP/CIR activities in Europe through innovation support and solution validation services.
OBJECTIVE 3 - EU-CIP-ECOSYSTEM: establish a Knowledge-Hub and create a vibrant ecosystem of interested and committed stakeholders around the project’s results.

OBJECTIVE 1 EU-CIP ANALYSIS - Enhance Europe’s analytical capability regarding research outcomes, technologies, and policies – foster data-driven evidence-based policy and innovation development:

Challenge: Deal with the fragmentation of information regarding research outcomes, research projects, technologies, policies, and standards for resilient infrastructures.

A well-structured and streamlined information collection and analysis infrastructure. The approach will include streamlined and automated workflows for transforming raw data to foresight, insights and knowledge that will enable evidence-based policies.
The information to be collected and analysed will be mainly focused on: (i) Security research activities and outcomes for resilient infrastructures, notably information about activities and outcomes of H2020/HEU projects; (ii) Security solutions and technologies for resilient infrastructures with emphasis on cutting edge technologies that advance the state of the art and fill-in existing gaps in infrastructures resilience; (iii) Security and infrastructure resilience polices (regional, national, EU level); and (iv) Related standards in collaboration with SDOs (Standards Development Organizations).

OBJECTIVE 2 EU-CIP AMPLIFY - Maximize the impact of R&I CIP/CIR activities in Europe through innovation support and solution validation services:

Challenge: European R&I projects (including EU funded projects) produce innovative outcomes, yet their full commercialization and impact potential is not always realized. Also, there is no effective way to validate innovative solutions, research policies.

Provide a set of services for innovation management services (including solution validation) of the research outcomes and solutions in the areas of resilient infrastructures (CIP/CIR) to boost the exploitation and commercialization efforts of CIP/CIR innovators and to support them in identifying the unique selling propositions of their developments, along with ways for commercializing them and realizing their market potential. Moreover, the project will offer a virtualized testbed for the experimentation with standards based CIP/CIR solutions and certification schemes, along with relevant validation & evaluation processes with stakeholders’ engagement.

OBJECTIVE 3 EU-CIP ECOSYSTEM - Establish a Knowledge-Hub and create a vibrant ecosystem of interested and committed stakeholders around the project’s results:

Challenge: There is significant fragmentation across the EU CIP/CIR ecosystem, given the multitude of stakeholders, the different sectors involved, the diversity of the technologies and solutions for resilient infrastructures, as well as the diverse strategies of the various countries of the EEA (European Economic Area).

The EU-CIP analysis reports, along with other knowledge assets (e.g., directories of policies and standards, a directory of CIP/CIR technologies and research outcomes, a directory of research and innovation projects, training materials, white papers) will be integrated in a Knowledge-Hub which will be supported by a proper digital infrastructure and will provide a single access point to the project’s results. It will facilitate stakeholders’ access to information, which will support their on-line collaboration.
EU-CIP will establish Europe’s largest community and ecosystem around the project’s analytical services, innovation support services and other knowledge assets. The community will be built over the existing ECSCI community, which will provide readily available access to a critical mass of relevant stakeholders that will boost the bootstrapping of the project’s community. Coupled with the knowledge infrastructures and services, the EU-CIP community will lead to the development of EU’s most prominent ecosystem of CIP/CIR knowledge and solutions.

7 of 11

EU-CIP IMPACT CREATION APPROACH

The overall impact of the project will be reflected on: (i) increased resilience of cis; (ii) increased competitiveness, market opportunities and innovation capacity for cip/cir solution providers; and (iii) more effective evidence-based policy development processes. the realization of these impacts will be based on the following pathway:

Bootstrapping the project’s developments and producing the results (Results R1-R10) (M1-M18)
Validating the results and demonstrating the expected outcomes (M18-M36)
Demonstrating and Scaling Up the Project’s Impact (M24-M36)

The overall impact of the project will be reflected on: (i) Increased resilience of CIs; (ii) Increased competitiveness, market opportunities and innovation capacity for CIP/CIR solution providers; and (iii) More effective evidence-based policy development processes. The realization of these impacts will be based on the following pathway:

1) Bootstrapping the project’s developments and producing the results (Results R1-R10) (M1-M18): In-line with the methodology, the project will initially establish the EU-CIP baseline infrastructures for data collection and consolidated data analysis (R1-R5), innovation support (R6, R10) and policy validation (R7). These infrastructures will enable the development of the knowledge-hub and ecosystem (R8, R9).

2) Validating the results and demonstrating the expected outcomes (M18-M36): During the project’s implementation (notably during the second half of the project i.e., M18-M36), EU-CIP will validate the established infrastructures based on the engagement of relevant stakeholders leveraging the partners’ business networks and the Open Calls processes of the project. The project will demonstrate the expected outcomes in terms of the availability of consolidated information about research outcomes, policies and standards, as well as about data driven policy making. Likewise, the project’s ability to improve policy making and the innovation capacity of CIP/CIR vendors/innovators will be validated. The dissemination and communication activities will play a key role towards engaging stakeholders and

growing the project’s community (R9).

3) Demonstrating and Scaling Up the Project’s Impact (M24-M36): During the last year of the project’s lifetime EU-CIP will demonstrate its medium- and long-term impact potential, which will be reflected on more evidence-based policies, increasing innovation capacity for CIP/CIR solution integrators, more effective funding decisions and EU-funded project results, as well as increased infrastructure resilience in various sectors. Most importantly, leveraging the project’s exploitation activities, EU-CIP will boost the sustainability of its processes and knowledge hub (R8). Key to the long-term impact of the project will be the sustainability of the results that will comprise the knowledge hub, as well as the continuous expansion and sustainable growth of the EU-CIP ecosystem targeting >=10

sectors and >=1000 stakeholders/members from EU-27 and the EEA.

Moreover, the following main impact pathways will be pursued to scale the impacts:

Impact Pathway #1 – Scaling up the project’s information analysis infrastructure (EU-CIP-ANALYSIS): The project’s infrastructure for information collection and analysis towards extracting foresight and producing value-added reports will be initially established leveraging on the KI framework and the Reference Model of the project (R1, R3-R5). It will be accompanied by the observatory (R2) and will be validated in the full range of H2020 projects on CIP/CIR, starting from the >=22 projects of the ECSCI cluster. It will be gradually scale-up to >=70 research projects and initiatives based on additions from HEU and national projects of the partners’ network.
Impact Pathway #2 – Scaling up the project’s innovation management and validation services (EU-CIPAMPLIFY): The project will engage >=120 innovators (including SMEs) from the projects of the partners, new HEU projects, as well as the partners’ business networks. Based on the dissemination and communication activities, as well as on the project’s ecosystem, EU-CIP will scale this support to >=300 innovators.
Impact Pathway #3 – Scaling up engagement (EU-CIP-ECOSYSTEM): The project will scale-up the EU-CIPECOSYSTEM through engaging and registering participants with the knowledge hub. Starting for the over 250 organizations that participate in the ECSCI cluster, the project will engage >=1000 stakeholders/members during its lifetime. The ambition is to scale up this community to >=2000 participants in the medium and long term. In these directions, the project will implement an aggressive dissemination and communication plan, which will extend beyond the end of the project (i.e. post project dissemination/communication actions will be implemented).

The consortium has a track record of implementing such activities without relevant funding, as part of the user and industry driven ECSCI cluster. The activities and the community of the ECSCI cluster constitute a natural baseline for EU-CIP. Building on ECSCI, the impact KPI targets of this section are realistic and achievable.

8 of 11

EU-CIP PRELIMINARY FINDINGS

some of the findings of the eu-cip analysis, notably findings produced following state of the art analysis and consultation with cip stakeholders within the eu-cip consortium and the ecsci cluster.

CIP capabilities

not adequately supported and covered by state-of-the-art solutions

Capabilities Gaps

partly linked to the capabilities needs

C1 - Enhanced adaptability
C2 - Reduced Response Times
C3 - Increased Transparency
C4 - Improved Detection Capabilities
C5 - Improved risk and impact assessment capabilities
C6 - Better integration Between Telco Security and Information Security Management tools
C7 – Solutions addressing cascading effects
C8 - Transformation of proactive and adaptive protection tools and methods to incorporate real-time functionalities
C9 – Better Exploitation of information from critical sensors towards augmented situation awareness
C10 - Risk prediction and anticipation
C11 - Training, Reskilling and Upskilling

CG1 - Poor Automation
CG2 – Lack of proper control of Interconnectedness
CG3 – Poor Alignment of Resilience Indicators
CG4 – Lack of agreed Standards-based stress-testing procedures
CG5 – Problems with the classification of IoT Devices
CG6 – Scalability in the Mitigation of DDoS attacks
CG7 – Development and Deployment of AI-based systems
CG8 – Lack of Holistic Security Management Systems
CG9 – Gaps in Emergency Management Processes
CG10 – Inability to cope with dynamically evolving threats
CG11 – Poor Awareness about modern CIP/CIR challenges

The EU-CIP-ANALYSIS activities will be implemented in a period of three years following the start of the project in October 2022. This slides presents some of the findings of the EU-CIP-ANALYSIS, notably findings produced following state of the art analysis and consultation with CIP stakeholders with the EU-CIP consortium and the ECSCI (European Cluster for Securing Critical Infrastructures) cluster i.e., a cluster comprising more than 30 of the most prominent European projects on security and critical infrastructures protection.

The EU-CIP Consortium members have identified the following CIP capabilities that are not adequately supported and covered by state-of-the-art solutions:

C1 - Enhanced adaptability: There is a need to enhance adaptability to new threats, as the novel and sometimes asymmetric threats against CIs happen with higher frequency than ever before.
C2 - Reduced Response Times: EU-CIP experts identified a need for increasing the speed of response as a means of coping with highly volatile environments and minimize the costs of potential damage.
C3 - Increased Transparency: In an era where complex threats are handled by sophisticated technologies, there is a need for improving transparency of the solution for the stakeholders.
C4 - Improved Detection Capabilities: Improved detection over current state of the art based on solutions that: (i) Address novel threats like hybrid threats combining cyber security and physical security aspects); (ii) Provide improved analytics capabilities of detection & response tools that account for the rapid shifting in the IoT and 5G spaces, while offering improved informed decision making.
C5 - Improved risk and impact assessment capabilities to address novel integrated, hybrid and asymmetric threats against a broad range of cyber and physical assets.
C6 - Better integration of Telco Security tools with Information Security Management tools. This integration should strive to avoid existing silos and fragmentation in security systems and capabilities.
C7 – Solutions addressing cascading effects between different entities and states. Such solutions must help preventing disruptions on supply chain services towards ensuring the continuity of business operations across different value chains.
C8 - Transformation of proactive and adaptive protection tools and methods to incorporate real-time functionalities. Such functionalities will boost the protection and resilience of CI through improved collection and analysis of real-time data in the light of the ever evolving and dynamically changing threat landscape.
C9 – Better Exploitation of information from critical sensors towards augmented situation awareness. Input from critical sensors (e.g., cameras, human presence, luminosity, weather/environment parameters) must be better integrated and exploited within CIP systems towards improving situation awareness (e.g., about security personnel positions and CI assets state. The latter must be combined with proper revisions to security and emergency management processes.
C1o – Risk prediction and anticipation, leading to earlier detection of threats and subsequently enhancing resilience, monitoring, patrolling, decision support, and event management applications.

C11 –Training, Reskilling and Upskilling. There is a need for developing relevant skills and competences in collaboration with the research and the academic community. Prominent examples of the required skills development, include cybersecurity and cyber-resilience trainings. Moreover, EU-CIP has also identified the following list of preliminary Capability Gaps (CG), which are partly linked to the above listed needs:

CG1 - Poor Automation: There is currently poor automation when it comes to achieving fast detection, protection and recovery from cyber-attacks. Specifically, there is a gap in closing the cybersecurity automation loop to automatically verify, diagnose, rectify, monitor, measure, and improve security controls. This gap is very evident when it comes to supporting heterogeneous technology and configurations in a systematic and justifiable manner.
CG2 – Lack of proper control of Interconnectedness: CI operators are not currently offered with strong control over interconnected assets and their dependencies. This makes it difficult to implement a holistic CIP approach that considers the dependencies of the various assets, as well as related cascading effects.
CG3 – Poor Alignment of Resilience Indicators: Currently CI operators deal with a host of resilience indicators, which are not aligned and, in several cases, diverse and non-compatible. This hinders the implementation of a structured CIR approach.
CG4 – Lack of agreed Standards-based stress-testing procedures: Along with poor alignment of indicators, there is also a lack of agreed stress-testing procedures that could foster the implementation of structured, standards-based CIR approaches.
CG5 – Problems with the classification of IoT Devices: In recent years there is a proliferation of IoT devices in Cis. However, the identification and classification of IoT-based assets is lagging behind the output of the suppliers and does not scale to account for the increased diversity and complexity of the various classes of IoT devices.
CG6 – Scalability in the Mitigation of Distributed Denial of Service (DDoS) attacks: DDoS attack mitigation is not scaling optimal given the increase in the bandwidth that is nowadays available to end-users (e.g., multi-gigabit per second connectivity is now widely available to SMEs).
CG7 – Development and Deployment of AI-based systems: Despite recent advances in AI systems and technologies, the potential of AI in CIP/CIR solutions remains underexploited. Moreover, there is still poor awareness about AI capabilities within employees and CIP/CIR vendors. Likewise, existing solutions cannot deal effectively with AI-powered cyberattacks based on new adaptive AI technologies.
CG8 – Lack of Holistic Security Management Systems: There is a lack of holistic security management solutions, which are operationally applicable and do not need to be customised from scratch. Furthermore, there is a lack of solutions that are uniform and operations across the large number of different stakeholders.
CG9 – Gaps in Emergency Management Processes: There are significant gaps in standardised processes in cases of emergencies. For instance, there is a lack of universally agreed processes regarding the communication with external entities for emergency handling and with public authorities regarding security/safety incidents related communications.
CG10 – Inability to cope with dynamically evolving threats: There is a lack of dynamic and intelligent solutions that can deal with the ever evolving and dynamically changing threats proactively and adaptively. Adaptive, AI-based solutions could provide the required intelligence, yet they are still not widely developed and used in the CIP/CIR domain.
CG11 – Poor Awareness about modern CIP/CIR challenges: There is a generally a lack of awareness regarding contemporary CIP/CIR requirements, such as awareness about cascading events, preparedness against new natural and anthropic risks, and complex cyber resilience issues.

These capabilities needs and gaps will be detailed in the extended version of the paper, while solutions that could help filling in the gaps will be outlined as well.

9 of 11

EU-CIP 1^ST ANNUAL CONFERENCE

Join us in Brussels in September for a 2-day interactive conference bringing together CIP/CIR stakeholders, industry, NGOs, policymakers and end-users!

The conference will be an excellent opportunity for building & expanding your project networks.

The conference will be a joint event between EU-CIP, the ECSCI cluster projects & PRAETORIAN project

Save the date!

The development of the project’s ecosystem will leverage EU-CIP’s aggressive dissemination and communication strategy. The latter comprises a rich set of activities targeted to all relevant stakeholders, including a Flagship Annual Conference on Infrastructures Resilience. The Conference will be in Brussels on 20 and 21 September. Join us in Brussels in September for a 2-day interactive conference bringing together CIP/CIR stakeholders, industry, NGOs, policymakers and end-users!

The conference will be an excellent opportunity for building & expanding your project networks.

The conference will be a joint event between EU-CIP, the ECSCI cluster project & PRAETORIAN project.

The project’s ecosystem will provide a sound basis for the sustainability of the project’s results, based on proper exploitation planning.

10 of 11

ACKNOWLEDGEMENT

The work presented in this paper received funding from the European Commission, under the “HORIZON-CL3-2021-SSRI-01 Topic SSRI-01-02: Knowle dge Ne tworks for Se curity Rese arch & Innovation” entitled EU-CIP (European Knowledge Hub and Policy Testbed for Critical Infrastructure Protection) under Grant Agreement number 101073878.

11 of 11

Emilia Gugliandolo

Engineering Ingegneria Informatica S.p.A.

emilia.gugliandolo@eng.it

THANK YOU FOR YOUR ATTENTION

RESEARCH AND INNOVATION SYMPOSIUM FOR EUROPEAN SECURITY AND DEFENSE 2023 | MAY 29^TH – MAY 31^ST | RHODES, GREECE