H2020 CYRENE Project: Certification of the security and resilience of supply chain services

CYRENE began by collecting legal and security requirements for supply chain services (SCS). Security requirements were collected from SCS stakeholders (both project partners and external stakeholders via online questionnaires), while legal requirements were collected by the consortium's legal partner. Requirements were categorized, analyzed, and reported. The requirements analysis led to the specification of the conformity certification assessment scheme and the conformity assessment process, defined as a stepwise, multi-level, evidence-based evaluation process between different actors (auditors, assessors, supply chain service providers, administrators, and security officers) with hierarchical access control rights. Furthermore, ontological models were developed for infrastructure dependencies and events, as well as for hardware and software assets, threats, vulnerabilities, cyberdependencies, actors and their interactions, and algorithms for the cascading effects of threats, risks, and vulnerabilities.

Likewise, an architecture for a platform that will support the conformity assessment process was defined. The successful completion of the aforementioned deliverables marked the fulfillment of the project's first three milestones: MS1, MS2, and MS3. Subsequent work focused on the design and implementation of prerequisites (i.e., assets, vulnerabilities, supply chain services, business processes in a CVSS3.1-compliant relational database schema) to facilitate horizontal risk calculations across interconnected supply chains involving multiple actors (i.e., supply chain providers, auditors, and assessors). Automated crawling services were designed and implemented to collect and extract information from the dark web. Similarly, a data pipeline was implemented for data processing, curation, storage, graphing, and text analysis. Machine learning was employed to classify text based on its content relevance to cyberattacks, illegal activities, and emerging events detected on dark web forums, marketplaces, and sites.

The Threat Intelligence Sharing Platform was used to match and classify terms extracted from the dark web into cyber concepts correlated with cybersecurity incidents and malware. Appropriate technologies were also set up to enable the successful integration of the previously developed modules. These include a GitLab repository for uploading the relevant module code to the integration system, and various integration tools such as Kafka Broker, Elasticsearch, and KeyCloak for secure access.

Additionally, the Redmine environment has been set up for issue reporting and tracking project activities. Continuous integration tasks include the aforementioned GitLab environment for the code repository, the process that runs tests, and deploys code for each iteration. Finally, a template has been distributed for gathering information that will lead to the testing scheme for individual modules as well as the integrated system. Furthermore, Work Package 5 activities include the design of the experimentation methodology with the creation of appropriate templates to guide the actual design of the experiments to be performed in Work Package 6.