Impact case study database

(1) INDUSTRIAL IMPACT

The ICS work performed by the CTI has led to the recognition of DMU as an Academic Centre of Excellence in Cyber Security Research (ACE) by the NCSC and EPSRC, which includes a grant of GBP60,000 [C1]. DMU is one of only 19 ACEs in the country, the first ACE in the East Midlands and the joint-first post-92 university to gain this recognition.

Dr Richard Smith is also a full member NCSC’s Industrial Control System’s community of interest – open only to those with a demonstrable expertise within the field with a track record of impactful work for industry – and is currently leading a workstream on how organisational readiness of a critical infrastructure provider can be tested and exercised. Membership of the community of interest has also provided Dr Smith the opportunity to contribute to the NCSC cyber research problem book, used to inform research direction for cyber security projects nationwide. He has been invited to give keynote presentations at industrial events in the UK, Romania, Australia, Austria, the USA, Germany and France.

DMU has also been recognised as one of only two Airbus Academic Centres of Excellence in ICS cyber security in Europe [C2]. This has been realised in the form of an enhanced Knowledge Transfer Partnership, supported by Innovate UK, in Tools and Techniques for ICS/SCADA Digital Forensics, with Airbus Group supported by GBP225,000 funding. The work has generated a forensic memory acquisition tool used by Airbus workers on their factory floors to allow direct memory acquisition from industrial devices for the first time, increasing the chance of identification and mitigation of attacks against the company. Previously, suspect devices would simply be thrown away, losing valuable forensic information. Now, the evidence is extracted and stored for the investigative team [C3].

Cyber Warfare and incident response exercises have been used to enhance participants’ skillsets and change the way IR teams operate. The DMU Agile Incident Response for ICS (AIR4ICS) project, worth GBP250,000 with additional contributions in kind of GBP160,000 from Airbus, Rolls-Royce, BT and Limes Security, has produced new Agile methodologies and tools providing benefits for IR teams who have adapted their business practices [C4]. This modular framework was funded by the NCSC and allows organisations to choose which elements they feel can be best incorporated into their working practices. Organisations such as Nettitude have chosen to adopt practices and tools from AIR4ICS, such as the Sprint cycle, Incident backlog and Incident board which focus on communication and information sharing between team members and have seen a number of benefits. ‘The first is an increase in technical confidence of the participants, which has manifested itself in more confident decision making’ and ‘The improved situational awareness has assisted the management team and the SOC analysts to be more efficient’ [C5], and the UK military ‘On the exercise itself, there was a clear uplift in capability and performance … demonstrated in the feedback from the exercise assessors in both qualitative and quantitative terms’ [C6].

Cyber Warfare and Incident Response exercises designed, developed and delivered by DMU, for the UK Army, Navy and Air Force response teams in January 2016 and February, April, June, August, November and December 2017 have been used to improve the skills of 124 participants. These skills were then demonstrated and described during cyber exercises of up to 1,000 international participants from NATO countries [C6, C7]. Events during DMU CyberWeek in 2018 and 2019 and AIR4ICS which have trained 123 participants from 22 organisations including SMEs, NHS, local government, industry such as Emerson and Rolls-Royce. These events have utilised DMU’s state-of-the-art hybrid cyber range CYRAN [R4] to create realistic sandboxed cyber environments along with the new IR approaches to introduce new working practices for industry, such as at Nettitude where 11 staff were trained on the AIR4ICS techniques, who have since introduced them to their colleagues and adopted them within the organisation. The main benefits of adopting these techniques has been seen in task management and tracking, ‘the 15 Security Operations Centre staff have implemented a number of measures to improve the efficiency of the Nettitude SOC. These include SCRUM meetings and kanban boards. We have also introduced sprints into aspects of the platform, monitoring and IR operations’ [C5].

Valuable hands-on practical experience of the ICS equipment used in DMU’s CYRAN cyber range has had the added benefit of providing device penetration tests, identifying vulnerabilities for manufacturers to be used to inform their patch cycle. The work has also allowed the Red team participants, from Austria, Germany and Denmark, who were responsible for attacking the network, to use AIR4ICS techniques to increase the efficiency of their penetration testing service and therefore provide better security recommendations:

Our staff doing blue team benchmarking projects became certainly more efficient through the AIR4ICS contributions. Also, in cases where we support customers with incident response, the agile approach gives guidance yet does not bloat the activities like a formal process, so we certainly consider it useful for real-world projects. The value provided even for senior OT security staff as in our case, where realistic attacks lead to realistic responses is substantial, we are glad to have joined the consortium as our invested resources have had a good knowledge-return already. [C8]

To raise awareness of the risk posed to ICS by cyber threats and to increase the understanding of the unique environment in which they exist, SCIPS exercises have been performed at both private events, such as for UK Cyber Defence Academy, and at public events like DMU CyberWeek 2018 and 2019. Some 104 participants have successfully taken part in these SCIPS exercises, including people from organisations including Thales, Rolls-Royce and Emerson. Successful identification of industrial cyber risk increased by 75% and 90% of respondents registering an increased cyber awareness of the threats to ICS [C9].

DMU’s expertise in the area of IR and security operations has been recognised by Deloitte with GBP20,000 funding provided to create a new research Security Operations Centre that will be used to define more effective defensive offerings in the future for Deloitte: ‘It is essential that when providing advice to our clients we are informed by research that is subjected to rigor and scrutiny. Shaping research with DMU in the SOC allows us to develop solutions that address organisations’ most complex cyber security challenges’ [C10].

(2) SOCIETAL IMPACT

DMU has changed the perception of industrial risk within the cyber security and engineering community. Cyber Security attack demonstration devices developed by in conjunction with Airbus and Claroty have successfully been included at major international events where previously there was no ICS representation. These include the first ever ICS ‘capture the flag’ event at RSA 2018, an event attended by over 25,000 people. Some 250 participants were trained and reported an increased understanding of issues within ICS security at the RSA 2018 international conference [C3]. Additional demonstrator devices developed by DMU have also been presented at international events including DEFCON25 ICS Village, the Hong Kong GREAT festival of Innovation, BruCon (Belgium’s largest hacking conference), the IET/BCS Turing EngTalk and DMU have hosted events at their Leicester campus for participants from organisations such as British Gypsum and Siemens Rail.